Edit tour

Windows Analysis Report
https://sanctionssearch.ofac.treas.gov

Overview

General Information

Sample URL:	https://sanctionssearch.ofac.treas.gov
Analysis ID:	1587028
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected ZipBomb

Downloads suspicious files via Chrome

Creates a process in suspended mode (likely to inject code)

Detected suspicious crossdomain redirect

HTML page contains hidden javascript code

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential browser exploit detected (process start blacklist hit)

Sigma detected: Use Short Name Path in Command Line

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1948,i,3932446117496796213,13477073409366957186,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1276 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sanctionssearch.ofac.treas.gov" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

rundll32.exe (PID: 7260 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

MSOXMLED.EXE (PID: 6668 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\AppData\Local\Temp\Temp1_sdn_enhanced.zip\SDN_ENHANCED.XML" MD5: A2E6E2A1C125973A4967540FD08C9AF0)

iexplore.exe (PID: 6624 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\AppData\Local\Temp\Temp1_sdn_enhanced.zip\SDN_ENHANCED.XML MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 7304 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6624 CREDAT:9474 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

ie_to_edge_stub.exe (PID: 7432 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=7005c MD5: 89CF8972D683795DAB6901BC9456675D)

ssvagent.exe (PID: 1272 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)

ie_to_edge_stub.exe (PID: 6096 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=7005c MD5: 89CF8972D683795DAB6901BC9456675D)

msedge.exe (PID: 1768 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=7005c MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2280 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7644 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4132 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8160 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7412 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cookie_exporter.exe (PID: 2784 cmdline: cookie_exporter.exe --cookie-json=1128 MD5: 3DD7152D6D33725EA5958D7DE2586B97)

msedge.exe (PID: 3460 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7308 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3008 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4756 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

ssvagent.exe (PID: 1436 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Downloads\61027dfb-7586-44a7-b274-47122dedf238.tmp	JoeSecurity_ZipBomb	Yara detected ZipBomb	Joe Security

Sigma Signatures

System Summary

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine|base64offset|contains: w, Image: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, NewProcessName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, OriginalFileName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, ParentCommandLine: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6624 CREDAT:9474 /prefetch:2, ParentImage: C:\Program Files (x86)\Internet Explorer\iexplore.exe, ParentProcessId: 7304, ParentProcessName: iexplore.exe, ProcessCommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, ProcessId: 1272, ProcessName: ssvagent.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files\Internet Explorer\iexplore.exe, ProcessId: 6624, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://sanctionssearch.ofac.treas.gov/

HTTP Parser: Base64 decoded: ns List Search tool uses approximate string matching to identify possible matches between word or character strings as entered into Sanctions List Search, and any name or name component as it appears on the SDN List and/or the various other sanctions list...

Source: https://sanctionssearch.ofac.treas.gov/

HTTP Parser: No favicon

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Source: chrome.exe	Memory has grown: Private usage: 27MB later: 37MB
Source: iexplore.exe	Memory has grown: Private usage: 6MB later: 825MB

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: sanctionslistservice.ofac.treas.gov to https://wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.com/published/97945e6a-34a3-4fdd-ac66-f2cb63cae077/2025-01-06/a1c14476-9ac2-4955-a0a1-e3eca64d8ad7/sdn_enhanced.zip?x-amz-expires=3600&x-amz-security-token=fwodyxdzejl%2f%2f%2f%2f%2f%2f%2f%2f%2f%2fweaderfbxjaprppjvxy0ilubguj%2bkrz1hcqhc3fo6tpjznk89n4uajd42ltzu9taqogjvrkjqlpo43hxeslptx5qbwcu%2fjo9isly7lu8ghpkt%2f4bsgtou%2bsjnopej8acckwixwruzq7iyk8w8hmoxt%2bvimkuhqjm1kh2jvm67jumidgllgkz4nh%2bprv4hnyxwjt5o0mzvi1gn9fs6gjp4rfi2nsv1qscwu8om8%2fxlkphyacchovmz0natzztp9n6eaeqw1drgbu5sknllms2d6zmg72dbulwqiohql1owthq%2fqjydmmud2oixcis25rrroq2qxsqls4q7kogad26h3afohgba4sj2uyrkukpl4ksh5urclaed7ekjnitemke2qxorfqw3al%2bk47h42ymokk5d8bygwed%2fdq4yvudsabij9l1wljogesadsjkbadbso0er7zk2jxlnhztk%2fohoy9zpnbxwepbhzuyspzw%2fgal015d2j%2bp%2f40icpclbzwafu8nmzj%2flrcqx2un39svff0m%2bf3d6iggsgbxnq0gcl8qxok%2bl2xexdk6dcoahhnuomuaxvwqvosdmwygn%2beqwgebeivwoscnhqchxuqcrmej9jys6nbzclf0mv%2bsxs6ki7ib%2fhojdvlsytc9wwtzhspkdemel5wd%2fqf%2bo%2b0zixjfxu6f0etesna9xucvktgyjty1ohnuw7smnjhgyfbfvjwy003xstm7jsx1iq2oznc9awm97gauz8rybs8dmgtwipde9bschs%2bbkdyy%2bfm0o%2ff%2bixkmdx2tgotekmvcw7na8dc8c%2focpzcchcdlzwywz9ojknqjy2tchyhe%2fvhi38oic%2bavayyqz87%2bxfmwy8zfgcrtxm%2fi5rrwhrzbfarepadu%2btsmno543qwaz5cttyoiq7ye%2bwzlns%2fopyxfsqrxd6ynedyplln&response-content-disposition=attachment%3b%20filename%3d%22sdn_enhanced.zip%22&response-content-type=application%2fzip&x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=asiasarblfplgq3bqz5m/20250109/us-gov-west-1/s3/aws4_request&x-amz-date=20250109t203240z&x-amz-signedheaders=host&x-amz-signature=5d7f76c8c35835d4b2c41005715cc9ca5ff32f4eaafdb74b6e0a0348f9e3554e
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: sanctionslistservice.ofac.treas.gov to https://wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.com/published/97945e6a-34a3-4fdd-ac66-f2cb63cae077/2025-01-06/a1c14476-9ac2-4955-a0a1-e3eca64d8ad7/cons_enhanced.xml?x-amz-expires=3600&x-amz-security-token=fwodyxdzejp%2f%2f%2f%2f%2f%2f%2f%2f%2f%2fweadoiu0aijltr45ah7lylubf2va%2bwv%2b31sscl5t9svikqebg8xm4pjgllf0kc6awz2oqhokeduf02itg0hurdrqrxuw9o87r%2fuzt1bsnopylg7yzhejcgnsmfa%2ffkdslnjpvjqleyas0rf1%2byufitmiq6icewhrtjbumpaozawew22dz%2flskeqzokavwv4jwbhm8uxf5rykpzbrjzpqo8swngbjael6t6avelpxtrsypif8dso7w%2bquuk7fr%2fnwa%2fm1jwb5xwdi0lkdaeukxjcuhqf2iaikt0c74cqqcyqddzejrapqmu9ep9ughrvvulzy7pmvcvc%2fisf8pkmlm%2bseoxfipdmghj0btl9lsgocf1vpyvz5umnwxoknvj3xsuh%2b3xafp7rv%2ffisqauy%2bh7sqanwk38oj9qvdahuufoq0jrz4zeiew3fglatvdwg5n6l9qpnulltv4sb1iygpojp16cpjbibmaurberdwtgrz7gj743fffxapue7runwnzhk%2brc9tqf8%2fcvfkxzcfjuugzz377qjssknx5maqpwvo1p5rbnbwe7qrkfk2pvxqoynlc0%2fifdx0pbf9pgznd%2b6wuom54bjvajodl2%2fjhmx%2foh%2by63fmw5ul1qjwo4oa8jk%2fznxmxya9tl5cwkxnqq6laj8bs9qp79csqrazms52l0gfqnglxuf218u74zvhlcoisuxthqgmsjlgibmptyve2qtiid%2b%2fceducgb8volvr201%2fsibhdkw3xq%2bc5i9wgjqtpxszfbxbhbjfb575u0vpv8upjvlham5zvbpznmrofbgthugcv5bg32q7hjyadhflilfkzjxab%2bxfxfroohogavayyqyuikis0hirfho8nqnboopf6zdvdyjn73ucdfqgpbv2nh2gka9fa5hxthg8zhilhklko3fxtyg4ysfeb%2bqunkegc&response-content-disposition=attachment%3b%20filename%3d%22cons_enhanced.xml%22&response-content-type=text%2fxml&x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=asiasarblfplofeekbmh/20250109/us-gov-west-1/s3/aws4_request&x-amz-date=20250109t203335z&x-amz-signedheaders=host&x-amz-signature=99233f8231947cf56a3fb35e2b35a9d3bcead41fba04000443d751435769755a
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: sanctionslistservice.ofac.treas.gov to https://wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.com/published/97945e6a-34a3-4fdd-ac66-f2cb63cae077/2025-01-06/a1c14476-9ac2-4955-a0a1-e3eca64d8ad7/cons_prim.csv?x-amz-expires=3600&x-amz-security-token=fwodyxdzejl%2f%2f%2f%2f%2f%2f%2f%2f%2f%2fweadeu1zp1p2dh6vgl%2bvsltbkibylsoeziiryx8%2fcsk17tv0qq%2bcfml8%2bvy4rzunc4naxbu9x0ubivnrzyim1vy0imhottkbijy1l086o8md7uw5yqbodw569biyqlpya3gydktn2lzcd8b20d5zuaesdh74u5nre0dib25inh2b9dbo%2bsze4wjmq1pdhcly%2foh11bmzjfsnnwddgfifzvigr8um3nq7m7cmowpowxmu8ioo2kbexuyndccykqd7ujktqhjcy4k3ravkaj6eumquiwqzkb4jwquifwithuxasoqpgpaewx4ihfxiyn5cvhbq6kqhvkj7%2ftmwpssdycvgs40rjmhsgfgvqwfkyzu3vuxgrjizmywtxh%2fw4bywetwme3pcj9qcrordf10%2bshk%2bue5qkowg3l%2fkju4qavoknmqv8ltrkfg103nbxl6zjlqzfpwo%2brhpyctaanerhkfzllculdqeizcwpckxfdlhwlwjet4vrjmandzzyaplzydviakv0aodkgpfemd6yeb3hqmqo9pem6c%2b2utcu4rbycf6lhwqu4tlkdg%2fgwuo4ehtjphlabnxp%2fvop7iuaiyn0qfhzrob0hwyusmhyfbzsf1aeqqezncduqi8buslipzl6l8smlv75apf6raaqntjzsnclkxcyewdfwocjvjmb51t6ipljvs7cs%2bwosi9fjaufpuu%2fxigzea2qkvt%2fyc6wvvkmgyfcmu3a%2flffp3tbny2ivta8tzizxhoxteawpoizwgh6i6umvos0m%2bxo9xuf1nypb3t2a005k1ir%2bey9o9bn5bshaf%2bghcavrpzuehj0k24pplnhty1tzrrsjl0oc8bjjbeqvwdwksii3ntoacvm9pi7dyh8fezba5wynxv9oc%2b0cycwkvtocdomrstos%2fmpf7hffe0xumyjhswec4dxgucko%3d&response-content-disposition=attachment%3b%20filename%3d%22cons_prim.csv%22&response-content-type=text%2fcsv&x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=asiasarblfplghykwomg/20250109/us-gov-west-1/s3/aws4_request&x-amz-date=20250109t203352z&x-amz-signedheaders=host&x-amz-signature=dfc66866b9331faf67342f4e8c2721f3243e926bf592f40c9b82b6b249f56415
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: sanctionslistservice.ofac.treas.gov to https://wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.com/published/97945e6a-34a3-4fdd-ac66-f2cb63cae077/2025-01-06/a1c14476-9ac2-4955-a0a1-e3eca64d8ad7/cons_prim.ff?x-amz-expires=3600&x-amz-security-token=fwodyxdzejp%2f%2f%2f%2f%2f%2f%2f%2f%2f%2fweadoiu0aijltr45ah7lylubf2va%2bwv%2b31sscl5t9svikqebg8xm4pjgllf0kc6awz2oqhokeduf02itg0hurdrqrxuw9o87r%2fuzt1bsnopylg7yzhejcgnsmfa%2ffkdslnjpvjqleyas0rf1%2byufitmiq6icewhrtjbumpaozawew22dz%2flskeqzokavwv4jwbhm8uxf5rykpzbrjzpqo8swngbjael6t6avelpxtrsypif8dso7w%2bquuk7fr%2fnwa%2fm1jwb5xwdi0lkdaeukxjcuhqf2iaikt0c74cqqcyqddzejrapqmu9ep9ughrvvulzy7pmvcvc%2fisf8pkmlm%2bseoxfipdmghj0btl9lsgocf1vpyvz5umnwxoknvj3xsuh%2b3xafp7rv%2ffisqauy%2bh7sqanwk38oj9qvdahuufoq0jrz4zeiew3fglatvdwg5n6l9qpnulltv4sb1iygpojp16cpjbibmaurberdwtgrz7gj743fffxapue7runwnzhk%2brc9tqf8%2fcvfkxzcfjuugzz377qjssknx5maqpwvo1p5rbnbwe7qrkfk2pvxqoynlc0%2fifdx0pbf9pgznd%2b6wuom54bjvajodl2%2fjhmx%2foh%2by63fmw5ul1qjwo4oa8jk%2fznxmxya9tl5cwkxnqq6laj8bs9qp79csqrazms52l0gfqnglxuf218u74zvhlcoisuxthqgmsjlgibmptyve2qtiid%2b%2fceducgb8volvr201%2fsibhdkw3xq%2bc5i9wgjqtpxszfbxbhbjfb575u0vpv8upjvlham5zvbpznmrofbgthugcv5bg32q7hjyadhflilfkzjxab%2bxfxfroohogavayyqyuikis0hirfho8nqnboopf6zdvdyjn73ucdfqgpbv2nh2gka9fa5hxthg8zhilhklko3fxtyg4ysfeb%2bqunkegc&response-content-disposition=attachment%3b%20filename%3d%22cons_prim.ff%22&response-content-type=text%2fplain&x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=asiasarblfplofeekbmh/20250109/us-gov-west-1/s3/aws4_request&x-amz-date=20250109t203400z&x-amz-signedheaders=host&x-amz-signature=5d8998613cc6aa9bda70a89779baecff7b3c345eedc7914856865bb5f8b71455

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.37
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.37
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.37
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.37
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.37
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.37
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.37
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.37
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.37
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.37
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.37

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C

Jump to behavior

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/global.css HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=iYXJJpU9my9xzhYp_OtAutrOkLPdguC-zMsLLBgxNdyJFKYEfeu4j-lm2zWq_LQPrz5Pd7C0AyOo0YqPeqA0n7EyTg5oPbzMwN7_yNEsfX0ticwfmtYaQelHMfpxan7vuW1JUA2&t=637418434420000000 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /scripts/resizeResults.js HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=Ffy_MXmL-37QvvzdQkWz4etD9G5iSAnzWAM-R_TwamjRIKnMqQAicBA9pg7-Az8QOy66qpJM9Dsui5ACYqihYleqYak1&t=638628063619783110 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=C3SCPT7cxW9L0JZEvulI3OCKCO4zdbGH12XO_XTiLtl7pu0lP_YZOYvC2eNk1mA1sGV3o3MvWT6YDrdHa-C1iXeNf53TXKDidCvGvPPs6Mne3tJb0&t=ffffffffec54f2d7 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=w6ZF-zq6tzm7FtC8jUZcwGF8VjfOGz8YmWrhTdSBnCpvKQhpTXLmNP-BDPjZEKO_7WAsEwrnG5z1iGuMjU840sjg1EjvFPeSkFcbvbVf46Gc5XmDH92hTGUK-OH4s8p0bj-aVg2&t=ffffffffec54f2d7 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /default.aspx?_TSM_HiddenField_=ctl00_ctl03_HiddenField&_TSM_CombinedScripts_=%3b%3bAjaxControlToolkit%2c+Version%3d3.5.40412.0%2c+Culture%3dneutral%2c+PublicKeyToken%3d28f01b0e84b6d53e%3aen-US%3a1547e793-5b7e-48fe-8490-03a375b13a33%3a475a4ef5%3a5546a2b%3ad2e10b12%3a497ef277%3aeffe2a26 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=SyIOILT-Mwsboa35foPtI49PZ_mO0xwpYyMS2rv26r7B3x5MNl6GrBLmxkvGFCNyqfj9_W4I-8X9xNk-BBAr9ZGtHLesOC9Wh3A8ZDWDXaAlXpu2zMNkhis7BUpb8Ljt6Wn0tA2&t=ffffffffec54f2d7 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /images/Background.png HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sanctionssearch.ofac.treas.gov/css/global.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /scripts/resizeResults.js HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=w6ZF-zq6tzm7FtC8jUZcwGF8VjfOGz8YmWrhTdSBnCpvKQhpTXLmNP-BDPjZEKO_7WAsEwrnG5z1iGuMjU840sjg1EjvFPeSkFcbvbVf46Gc5XmDH92hTGUK-OH4s8p0bj-aVg2&t=ffffffffec54f2d7 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=Ffy_MXmL-37QvvzdQkWz4etD9G5iSAnzWAM-R_TwamjRIKnMqQAicBA9pg7-Az8QOy66qpJM9Dsui5ACYqihYleqYak1&t=638628063619783110 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=C3SCPT7cxW9L0JZEvulI3OCKCO4zdbGH12XO_XTiLtl7pu0lP_YZOYvC2eNk1mA1sGV3o3MvWT6YDrdHa-C1iXeNf53TXKDidCvGvPPs6Mne3tJb0&t=ffffffffec54f2d7 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=tD8q9yfA70B22Chsc5X1mCS43V0itVSWBub2aYAsIsXPnXIHSgEQqgrV6xNx5E5eCQUaHIRijSKwPnzx56gchzz2C-Z0OJDunO5GH8-2C-YZpvHMXoBW-twpAUvKAuqPY7PXWA2&t=637418578420000000 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sanctionssearch.ofac.treas.gov/WebResource.axd?d=iYXJJpU9my9xzhYp_OtAutrOkLPdguC-zMsLLBgxNdyJFKYEfeu4j-lm2zWq_LQPrz5Pd7C0AyOo0YqPeqA0n7EyTg5oPbzMwN7_yNEsfX0ticwfmtYaQelHMfpxan7vuW1JUA2&t=637418434420000000Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /default.aspx?_TSM_HiddenField_=ctl00_ctl03_HiddenField&_TSM_CombinedScripts_=%3b%3bAjaxControlToolkit%2c+Version%3d3.5.40412.0%2c+Culture%3dneutral%2c+PublicKeyToken%3d28f01b0e84b6d53e%3aen-US%3a1547e793-5b7e-48fe-8490-03a375b13a33%3a475a4ef5%3a5546a2b%3ad2e10b12%3a497ef277%3aeffe2a26 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=3_RVinVmJovhKfbiF1QGoXBpzmAU7zmBMGrgOgsvHZpRd8DMeDpHHTJKZ_EUmX7PQjQyehXLtRRx9O_2wycbxiybNg2qIxe7dfbymHCiVRsZE1G91fknqdo084XueWVOyGY9dw2&t=637418434420000000 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /images/Logo.png HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /images/Background.png HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /images/printerIcon.gif HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=SyIOILT-Mwsboa35foPtI49PZ_mO0xwpYyMS2rv26r7B3x5MNl6GrBLmxkvGFCNyqfj9_W4I-8X9xNk-BBAr9ZGtHLesOC9Wh3A8ZDWDXaAlXpu2zMNkhis7BUpb8Ljt6Wn0tA2&t=ffffffffec54f2d7 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /images/excel.gif HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /css/print.css HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=3_RVinVmJovhKfbiF1QGoXBpzmAU7zmBMGrgOgsvHZpRd8DMeDpHHTJKZ_EUmX7PQjQyehXLtRRx9O_2wycbxiybNg2qIxe7dfbymHCiVRsZE1G91fknqdo084XueWVOyGY9dw2&t=637418434420000000 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=tD8q9yfA70B22Chsc5X1mCS43V0itVSWBub2aYAsIsXPnXIHSgEQqgrV6xNx5E5eCQUaHIRijSKwPnzx56gchzz2C-Z0OJDunO5GH8-2C-YZpvHMXoBW-twpAUvKAuqPY7PXWA2&t=637418578420000000 HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /images/printerIcon.gif HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /images/Logo.png HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /images/excel.gif HTTP/1.1Host: sanctionssearch.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
Source: global traffic	HTTP traffic detected: GET /policy-issues/financial-sanctions/specially-designated-nationals-list-data-formats-data-schemas HTTP/1.1Host: home.treasury.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Home/SdnList HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Home/main.4c18940969d5b18ddf1b.css HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://sanctionslist.ofac.treas.gov/Home/SdnListAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc
Source: global traffic	HTTP traffic detected: GET /Home/bundle.js HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sanctionslist.ofac.treas.gov/Home/SdnListAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc
Source: global traffic	HTTP traffic detected: GET /Universal-Federated-Analytics-Min.js?agency=OFAC HTTP/1.1Host: dap.digitalgov.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sanctionslist.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Universal-Federated-Analytics-Min.js?agency=OFAC HTTP/1.1Host: dap.digitalgov.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Home/bundle.js HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sanctionslist.ofac.treas.gov/Home/SdnListAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc; _ga=GA1.1.720102056.1736454744; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454744.0.0.0
Source: global traffic	HTTP traffic detected: GET /policy-issues/financial-sanctions/consolidated-sanctions-list-data-files HTTP/1.1Host: home.treasury.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Home/ConsolidatedList HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://sanctionssearch.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc; _ga=GA1.1.720102056.1736454744; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454744.0.0.0
Source: global traffic	HTTP traffic detected: GET /Home/main.4c18940969d5b18ddf1b.css HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://sanctionslist.ofac.treas.gov/Home/ConsolidatedListAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc; _ga=GA1.1.720102056.1736454744; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454744.0.0.0
Source: global traffic	HTTP traffic detected: GET /Home/bundle.js HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sanctionslist.ofac.treas.gov/Home/ConsolidatedListAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc; _ga=GA1.1.720102056.1736454744; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454744.0.0.0
Source: global traffic	HTTP traffic detected: GET /Home/4a1efbe82eaa84ff89ed34a0bd374991.woff2 HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://sanctionslist.ofac.treas.govsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://sanctionslist.ofac.treas.gov/Home/main.4c18940969d5b18ddf1b.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc; _ga=GA1.1.720102056.1736454744; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454749.0.0.0
Source: global traffic	HTTP traffic detected: GET /Home/64cd5b0762a5bb22557372b8f7b84916.png HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sanctionslist.ofac.treas.gov/Home/SdnListAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc; _ga=GA1.1.720102056.1736454744; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454749.0.0.0
Source: global traffic	HTTP traffic detected: GET /api/PublicationPreview/PublicationList?list=SDN HTTP/1.1Host: sanctionslistservice.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.1.720102056.1736454744; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454749.0.0.0
Source: global traffic	HTTP traffic detected: GET /Home/64cd5b0762a5bb22557372b8f7b84916.png HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc; _ga=GA1.1.720102056.1736454744; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454749.0.0.0
Source: global traffic	HTTP traffic detected: GET /Home/bundle.js HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc; _ga=GA1.1.720102056.1736454744; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454749.0.0.0
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sanctionslist.ofac.treas.gov/Home/ConsolidatedListAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc; _ga=GA1.1.720102056.1736454744; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454751.0.0.0
Source: global traffic	HTTP traffic detected: GET /api/PublicationPreview/exports/SDN_ENHANCED.ZIP HTTP/1.1Host: sanctionslistservice.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.1.720102056.1736454744; BIGipServerf5tgdXlwGjuDKDylgpnMJA=!RvkDCB3kBdAnvei+T0s9tzEcVdNrwJYZmkgje6LTeoEAFzBRKgjbZWAFpYKpbSKE31IVMKCBb7EYKnQ=; TS0185916d=01f6e3b1e9f5212d22f7d2fb9598ad7ddf915224e597c2b21821fa6d5798676a4d2d304add8ff0d5c93299c5d761ed527401a87b4e87353065892c27f2b1f0da3087faf56e; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454757.0.0.0
Source: global traffic	HTTP traffic detected: GET /Home/64cd5b0762a5bb22557372b8f7b84916.png HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sanctionslist.ofac.treas.gov/Home/ConsolidatedListAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc; _ga=GA1.1.720102056.1736454744; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454757.0.0.0
Source: global traffic	HTTP traffic detected: GET /Published/97945e6a-34a3-4fdd-ac66-f2cb63cae077/2025-01-06/a1c14476-9ac2-4955-a0a1-e3eca64d8ad7/SDN_ENHANCED.ZIP?X-Amz-Expires=3600&X-Amz-Security-Token=FwoDYXdzEJL%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaDERFBxjAprPPjvxy0iLuBGuJ%2Bkrz1hCqHc3fo6TPJZNK89N4UAJd42LTZu9TaqOgjVRkJqlPo43HXesLptx5qbWCu%2FjO9IsLy7Lu8gHpkT%2F4bsGTOU%2BsjnOPEj8AccKWIXwruZq7IyK8w8hmoXT%2BVIMKuHQjM1Kh2jvm67juMiDglLgkz4NH%2BPRV4hNYXWjT5o0mZvI1GN9fs6gjP4rFI2nsV1qScwu8oM8%2FXlKPhYACCHOVmz0NAtzZtP9N6EaEqW1drgBu5sKnlLms2D6zmG72dbulwQIohQL1OWtHQ%2FQjyDmmUD2OiXcis25rRrOq2QxSQlS4Q7KOgAD26H3AFOhGba4Sj2UYRKuKpL4kSh5uRCLaEd7EkJnITEmke2qXOrFQW3aL%2BK47H42YmOKK5d8ByGweD%2FDq4yVUDSABIj9L1wLJoGEsAdsjkbadbSO0ER7ZK2jxlNhzTK%2FohoY9zPNbXWePbhZuySPZw%2FgAL015d2J%2Bp%2F40IcPcLBZWAFU8nMzj%2FLRcQx2un39svFf0m%2BF3D6IGgSGBXnQ0GcL8Qxok%2Bl2xEXdk6dCOahHnUOMuaXvWqvoSdMwygN%2BeQWGEBEivWosCNhqChxUQcRmeJ9jyS6nBzcLf0mV%2BSxS6Ki7Ib%2FhoJDvLSYTc9wWTzHSPkDEmeL5Wd%2FqF%2Bo%2B0zIxjFXU6f0EteSnA9xUcvKtGYjTY1oHnuw7SMnJhgYFBfvjwY003xstm7Jsx1iQ2ozNc9AWM97GAuZ8RyBS8DMgtwipDe9bsCHS%2BBKdyy%2Bfm0O%2FF%2BIxkMDX2tgotekmvCW7NA8Dc8C%2FoCPzCchcdLZWYwz9oJKnqJy2tcHYhE%2FvhI38oic%2BAvAYyQZ87%2BxFmwY8ZfGCRTXM%2FI5RRWhRZbfaRePadu%2BTSmNo543qWaz5CttyOIq7Ye%2BwZLNs%2FOpyxfSQRXD6ynEdypLLN&response-content-disposition=attachment%3B%20filename%3D%22sdn_enhanced.zip%22&response-content-type=application%2Fzip&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIASARBLFPLGQ3BQZ5M/20250109/us-gov-west-1/s3/aws4_request&X-Amz-Date=20250109T203240Z&X-Amz-SignedHeaders=host&X-Amz-Signature=5d7f76c8c35835d4b2c41005715cc9ca5ff32f4eaafdb74b6e0a0348f9e3554e HTTP/1.1Host: wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/PublicationPreview/PublicationList?list=CONSOLIDATED HTTP/1.1Host: sanctionslistservice.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.1.720102056.1736454744; BIGipServerf5tgdXlwGjuDKDylgpnMJA=!RvkDCB3kBdAnvei+T0s9tzEcVdNrwJYZmkgje6LTeoEAFzBRKgjbZWAFpYKpbSKE31IVMKCBb7EYKnQ=; TS0185916d=01f6e3b1e9f5212d22f7d2fb9598ad7ddf915224e597c2b21821fa6d5798676a4d2d304add8ff0d5c93299c5d761ed527401a87b4e87353065892c27f2b1f0da3087faf56e; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454757.0.0.0
Source: global traffic	HTTP traffic detected: GET /Home/64cd5b0762a5bb22557372b8f7b84916.png HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc; _ga=GA1.1.720102056.1736454744; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454757.0.0.0
Source: global traffic	HTTP traffic detected: GET /Home/4a1efbe82eaa84ff89ed34a0bd374991.woff2 HTTP/1.1Host: sanctionslist.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://sanctionslist.ofac.treas.govsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://sanctionslist.ofac.treas.gov/Home/main.4c18940969d5b18ddf1b.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipServer4OR9DWPzI4DOHnkCsAwe1w=!V8yyZloyuaiZ1EK+T0s9tzEcVdNrwPfVZwh+xlTFItZ3h2Lrr0jen3PIw9uaAxcPA87Y2CjDMYA84g==; TS01c2c0da=01f6e3b1e961e52475d81bc01078ee66abbd59ca5e09d792375053492f25992d210197a49650613444d5417245b27adb1f15241f721a76eb9b78226d6b23aa50844040accc; _ga=GA1.1.720102056.1736454744; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454757.0.0.0
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif HTTP/1.1Host: c.clarity.msConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?ctsa=mr&CtsSyncId=DE3D9F89BC3D42139918164BD9B10C35&MUID=3E4F48E5D92E698F38955D8ADD2E67A0 HTTP/1.1Host: c.clarity.msConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: SM=T; MUID=3E4F48E5D92E698F38955D8ADD2E67A0
Source: global traffic	HTTP traffic detected: GET /api/PublicationPreview/exports/CONS_ENHANCED.XML HTTP/1.1Host: sanctionslistservice.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.1.720102056.1736454744; BIGipServerf5tgdXlwGjuDKDylgpnMJA=!RvkDCB3kBdAnvei+T0s9tzEcVdNrwJYZmkgje6LTeoEAFzBRKgjbZWAFpYKpbSKE31IVMKCBb7EYKnQ=; TS0185916d=01f6e3b1e9f5212d22f7d2fb9598ad7ddf915224e597c2b21821fa6d5798676a4d2d304add8ff0d5c93299c5d761ed527401a87b4e87353065892c27f2b1f0da3087faf56e; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454813.0.0.0
Source: global traffic	HTTP traffic detected: GET /Published/97945e6a-34a3-4fdd-ac66-f2cb63cae077/2025-01-06/a1c14476-9ac2-4955-a0a1-e3eca64d8ad7/CONS_ENHANCED.XML?X-Amz-Expires=3600&X-Amz-Security-Token=FwoDYXdzEJP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaDOIu0AIjLTR45AH7LyLuBF2Va%2BWv%2B31sscL5T9svIkqEBg8xm4pJGLlf0Kc6AWZ2oQHOkeDUF02iTg0hURdRQRxuW9O87r%2FuZT1BSnoPYLG7YZHejcgNSMfA%2FfKdslNJPvJQleyas0Rf1%2BYufiTMIq6IcEWhRtjBumPaOzaWeW22Dz%2FLskEqZoKAvWv4JwBHM8uXf5rykpzbrJzpqo8swNgbjAEL6t6aVELpXtRSYpIF8Dso7W%2BquUk7fR%2FnwA%2Fm1jwB5XwdI0LkdAEukXJCUhQF2iAiKT0C74CQQcYqddZejrApQmu9Ep9UghrVvUlZY7pmvCvc%2FiSF8PKmLm%2BseOXfipdMGHj0Btl9lSgOCf1vPYVZ5UmnWXoknvj3XsUh%2B3xAfP7rV%2FFISqauY%2BH7SQAnWK38Oj9qVDahuuFoQ0jrz4ZeIEw3FGlatvdWG5n6L9qpnuLltV4SB1IyGpojp16CpJBIBMauRberdWTGrz7GJ743ffFXAPue7RunwnZHK%2BrC9TqF8%2FcVFKxzCfJuugzz377QjsSkNx5mAqPWvo1p5RbNbwE7QrkFK2PVXQOyNLc0%2FIfDx0Pbf9pGZnd%2B6WUoM54BJvAjODl2%2Fjhmx%2FOh%2By63fMW5uL1QJwO4oA8Jk%2FZnxMXya9TL5cwkXNQQ6LaJ8BS9Qp79CSQRazms52l0GFqNgLXuf218U74zvHlCOIsuxThQGmsJlgiBMptyVe2qTiID%2B%2FcEDUcgb8voLvR201%2FsiBhDkW3xq%2BC5i9WGjqTpxsZfBXBHBJfb575U0vPV8upJvLHAm5zVBPzNmRofbgthuGCv5BG32Q7HjYaDHflIlFkZJxAb%2BXFxfRoohOGAvAYyQYuikiS0HIRFhO8nQnBOopF6zDVDyjN73UcDfQGPBV2NH2gkA9Fa5HXthG8zHIlHKLkO3fxtyg4ySfeB%2BquNkeGc&response-content-disposition=attachment%3B%20filename%3D%22cons_enhanced.xml%22&response-content-type=text%2Fxml&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIASARBLFPLOFEEKBMH/20250109/us-gov-west-1/s3/aws4_request&X-Amz-Date=20250109T203335Z&X-Amz-SignedHeaders=host&X-Amz-Signature=99233f8231947cf56a3fb35e2b35a9d3bcead41fba04000443d751435769755a HTTP/1.1Host: wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgets/fullpage/distribution/edgewelcome?experiences=DistributionPage&ocid=edge-whatsnew HTTP/1.1Host: www.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/distribution/latest/vendors.d049fb344a15489e568f.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/distribution/latest/microsoft.a64b2be15baaa46efd42.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /npm/@shoelace-style/shoelace@2.12.0/cdn/themes/light.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://apps.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/PublicationPreview/exports/CONS_PRIM.CSV HTTP/1.1Host: sanctionslistservice.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.1.720102056.1736454744; BIGipServerf5tgdXlwGjuDKDylgpnMJA=!RvkDCB3kBdAnvei+T0s9tzEcVdNrwJYZmkgje6LTeoEAFzBRKgjbZWAFpYKpbSKE31IVMKCBb7EYKnQ=; TS0185916d=01f6e3b1e9f5212d22f7d2fb9598ad7ddf915224e597c2b21821fa6d5798676a4d2d304add8ff0d5c93299c5d761ed527401a87b4e87353065892c27f2b1f0da3087faf56e; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454830.0.0.0
Source: global traffic	HTTP traffic detected: GET /Published/97945e6a-34a3-4fdd-ac66-f2cb63cae077/2025-01-06/a1c14476-9ac2-4955-a0a1-e3eca64d8ad7/CONS_PRIM.CSV?X-Amz-Expires=3600&X-Amz-Security-Token=FwoDYXdzEJL%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaDEU1ZP1P2DH6VGl%2BvSLtBKiBYlSoEziIryx8%2FCsk17tv0QQ%2BCfmL8%2BVy4RZuNc4NAXbu9x0ubiVNRZyIM1VY0Imhottkbijy1L086O8Md7UW5YqbodW569bIYqlPYa3GYDkTn2LZcD8B20d5zuAesdh74u5NrE0DiB25inh2B9dBO%2BSze4wjMq1pDhCly%2FOh11bmZJfsNnwDDgFIfZviGR8UM3nq7M7cMoWpOwXmu8ioO2KbexUyNDCcykQD7ujKtqHjCY4k3raVkaJ6EUmquiWqzKB4jwquIfwitHUXAsOQPGPAEWX4IhfXIyn5cvhbQ6kQHvKJ7%2FTmWPsSDyCvgS40rJMHSGfgVqwFKyzu3vuxGrJiZmyWtXh%2Fw4ByweTwME3PCj9QcRorDF10%2Bshk%2BUe5qkoWG3l%2Fkju4qavokNmqv8LTrKFg103nbXL6ZjLQzFpwO%2BRhPyCTaAnerhKfzLlcUlDqeiZcwPCkXfdLhwLwjET4VrJMaNdZzyAPLzYDViAkv0AODkgpfeMD6yeB3HQMqO9pEM6C%2B2uTCU4rbyCf6Lhwqu4TlKdg%2FgWUO4ehTJpHlaBNxp%2FVOP7iUAIyn0QFHZROb0hwYusmhYFbZSf1AeqQEZNcduqi8bUsLIpzL6l8sMLv75aPF6raaqNTjzSNclKXcyEWDFWocJVJmB51T6IpljVS7cs%2BWOsI9fjAUfPuU%2FxIgZea2qKVt%2FyC6wvVkMgYfcmu3a%2FLFFp3tbNy2iVtA8TziZxHOXTEAwpOiZwGh6i6uMvoS0M%2BxO9xuF1nYpB3T2A005k1iR%2BeY9O9Bn5bshaf%2BGhCAvrPZUeHJ0K24ppLNhtY1tZRRSjL0oC8BjJBEQVWDwksIi3ntOaCvm9PI7DYH8feZbA5WYNXV9oc%2B0cyCwkVtOcdOmrstoS%2FMpf7hffe0xUmyJhSWEc4DXgucko%3D&response-content-disposition=attachment%3B%20filename%3D%22cons_prim.csv%22&response-content-type=text%2Fcsv&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIASARBLFPLGHYKWOMG/20250109/us-gov-west-1/s3/aws4_request&X-Amz-Date=20250109T203352Z&X-Amz-SignedHeaders=host&X-Amz-Signature=dfc66866b9331faf67342f4e8c2721f3243e926bf592f40c9b82b6b249f56415 HTTP/1.1Host: wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/PublicationPreview/exports/CONS_PRIM.FF HTTP/1.1Host: sanctionslistservice.ofac.treas.govConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.1.720102056.1736454744; BIGipServerf5tgdXlwGjuDKDylgpnMJA=!RvkDCB3kBdAnvei+T0s9tzEcVdNrwJYZmkgje6LTeoEAFzBRKgjbZWAFpYKpbSKE31IVMKCBb7EYKnQ=; TS0185916d=01f6e3b1e9f5212d22f7d2fb9598ad7ddf915224e597c2b21821fa6d5798676a4d2d304add8ff0d5c93299c5d761ed527401a87b4e87353065892c27f2b1f0da3087faf56e; _ga_CSLL4ZEK4L=GS1.1.1736454744.1.1.1736454838.0.0.0
Source: global traffic	HTTP traffic detected: GET /Published/97945e6a-34a3-4fdd-ac66-f2cb63cae077/2025-01-06/a1c14476-9ac2-4955-a0a1-e3eca64d8ad7/CONS_PRIM.FF?X-Amz-Expires=3600&X-Amz-Security-Token=FwoDYXdzEJP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaDOIu0AIjLTR45AH7LyLuBF2Va%2BWv%2B31sscL5T9svIkqEBg8xm4pJGLlf0Kc6AWZ2oQHOkeDUF02iTg0hURdRQRxuW9O87r%2FuZT1BSnoPYLG7YZHejcgNSMfA%2FfKdslNJPvJQleyas0Rf1%2BYufiTMIq6IcEWhRtjBumPaOzaWeW22Dz%2FLskEqZoKAvWv4JwBHM8uXf5rykpzbrJzpqo8swNgbjAEL6t6aVELpXtRSYpIF8Dso7W%2BquUk7fR%2FnwA%2Fm1jwB5XwdI0LkdAEukXJCUhQF2iAiKT0C74CQQcYqddZejrApQmu9Ep9UghrVvUlZY7pmvCvc%2FiSF8PKmLm%2BseOXfipdMGHj0Btl9lSgOCf1vPYVZ5UmnWXoknvj3XsUh%2B3xAfP7rV%2FFISqauY%2BH7SQAnWK38Oj9qVDahuuFoQ0jrz4ZeIEw3FGlatvdWG5n6L9qpnuLltV4SB1IyGpojp16CpJBIBMauRberdWTGrz7GJ743ffFXAPue7RunwnZHK%2BrC9TqF8%2FcVFKxzCfJuugzz377QjsSkNx5mAqPWvo1p5RbNbwE7QrkFK2PVXQOyNLc0%2FIfDx0Pbf9pGZnd%2B6WUoM54BJvAjODl2%2Fjhmx%2FOh%2By63fMW5uL1QJwO4oA8Jk%2FZnxMXya9TL5cwkXNQQ6LaJ8BS9Qp79CSQRazms52l0GFqNgLXuf218U74zvHlCOIsuxThQGmsJlgiBMptyVe2qTiID%2B%2FcEDUcgb8voLvR201%2FsiBhDkW3xq%2BC5i9WGjqTpxsZfBXBHBJfb575U0vPV8upJvLHAm5zVBPzNmRofbgthuGCv5BG32Q7HjYaDHflIlFkZJxAb%2BXFxfRoohOGAvAYyQYuikiS0HIRFhO8nQnBOopF6zDVDyjN73UcDfQGPBV2NH2gkA9Fa5HXthG8zHIlHKLkO3fxtyg4ySfeB%2BquNkeGc&response-content-disposition=attachment%3B%20filename%3D%22cons_prim.ff%22&response-content-type=text%2Fplain&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIASARBLFPLOFEEKBMH/20250109/us-gov-west-1/s3/aws4_request&X-Amz-Date=20250109T203400Z&X-Amz-SignedHeaders=host&X-Amz-Signature=5d8998613cc6aa9bda70a89779baecff7b3c345eedc7914856865bb5f8b71455 HTTP/1.1Host: wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	String found in binary or memory: "url": "http://www.facebook.com/" equals www.facebook.com (Facebook)
Source: d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	String found in binary or memory: "url": "http://www.twitter.com/" equals www.twitter.com (Twitter)
Source: d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	String found in binary or memory: "url": "http://www.youtube.com/" equals www.youtube.com (Youtube)
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log9.19.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log9.19.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log9.19.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: SiteList.xml.19.dr	String found in binary or memory: <site url="www.yahoo.co.jp"> equals www.yahoo.com (Yahoo)
Source: chromecache_373.1.dr	String found in binary or memory: F.src="https://www.youtube.com/iframe_api";z=document.getElementsByTagName("script")[0];z.parentNode.insertBefore(F,z);var C=[],p=[],u=[],A=d.YT_MILESTONE,K=[];onYouTubeIframeAPIReady=function(){for(var a=0;a<C.length;a++)p[a]=new YT.Player(C[a],{events:{onReady:onPlayerReady,onStateChange:onPlayerStateChange,onError:onPlayerError}})};onPlayerReady=function(a){};onPlayerError=function(a){q("video_error",{videotitle:void 0!==a.target.playerInfo?a.target.playerInfo.videoData.title:a.target.getVideoData().title})}; equals www.youtube.com (Youtube)
Source: chromecache_370.1.dr	String found in binary or memory: return b}JE.F="internal.enableAutoEventOnTimer";var Vb=wa(["data-gtm-yt-inspected-"]),LE=["www.youtube.com","www.youtube-nocookie.com"],ME,NE=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: sanctionssearch.ofac.treas.gov
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: home.treasury.gov
Source: global traffic	DNS traffic detected: DNS query: sanctionslist.ofac.treas.gov
Source: global traffic	DNS traffic detected: DNS query: dap.digitalgov.gov
Source: global traffic	DNS traffic detected: DNS query: sanctionslistservice.ofac.treas.gov
Source: global traffic	DNS traffic detected: DNS query: wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /api/PublicationPreview/PublicationList?list=SDN HTTP/1.1Host: sanctionslistservice.ofac.treas.govConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://sanctionslist.ofac.treas.govSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://sanctionslist.ofac.treas.gov/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 20:32:11 GMTContent-Type: text/htmlContent-Length: 1245Connection: closeX-Powered-By: ASP.NETX-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=31536000; includeSubDomains
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 09 Jan 2025 20:32:26 GMTContent-Type: application/jsonContent-Length: 23x-amzn-RequestId: c9d10b4c-ba77-4143-8a1d-9e28cfb15619x-amzn-ErrorType: ForbiddenExceptionx-amz-apigw-id: EIzOLHY4vHMFv2Q=Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 09 Jan 2025 20:32:34 GMTContent-Type: application/jsonContent-Length: 23x-amzn-RequestId: c218681c-78ec-4bfc-9989-81af3c85f7d9x-amzn-ErrorType: ForbiddenExceptionx-amz-apigw-id: EIzPZEvpvHMFi7A=Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains

Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://ckbrm.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://ckbrm.ru;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://con-sirius.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://con-sirius.ru;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://en.media.transneft.ru/
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://en.media.transneft.ru/;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://en.vtb-bank.kz/
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://en.vtb-bank.kz/;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://en.vtb.az/
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://en.vtb.az/;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://iz-kartex.com
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://iz-kartex.com;
Source: chromecache_410.1.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://omz-izhora.com
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://omz-izhora.com;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://rostec.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://rostec.ru;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://rtguard.ru/
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://rtguard.ru/;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://sgmsk.ru/about/raskrytie-informacii/oao-sg-msk
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://sgmsk.ru/about/raskrytie-informacii/oao-sg-msk;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://sibnefteprovod.transneft.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://sibnefteprovod.transneft.ru;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://splav.org
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://splav.org;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://surgutmebel.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://surgutmebel.ru;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://vtbcapital.com
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://vtbcapital.com;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.90zavod.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.90zavod.ru;
Source: d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	String found in binary or memory: http://www.amazon.com/
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.bmbank.com.ua
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.bmbank.com.ua;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.concern-orion.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.concern-orion.ru;
Source: d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	String found in binary or memory: http://www.google.com/
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.kcplant.ru/
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.kcplant.ru/;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.kinef.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.kinef.ru;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.kostroma.novatek.ru/
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.kostroma.novatek.ru/;
Source: d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	String found in binary or memory: http://www.live.com/
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.mzmayak.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.mzmayak.ru;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.novikom.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.novikom.ru;
Source: d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	String found in binary or memory: http://www.nytimes.com/
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.oao-aps.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.oao-aps.ru;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.opkrt.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.opkrt.ru;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.pskovnefteprodukt.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.pskovnefteprodukt.ru;
Source: d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	String found in binary or memory: http://www.reddit.com/
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.rshb.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr, 8d2f7b3d-ceb8-4aef-98f7-41e96cf089f5.tmp.0.dr	String found in binary or memory: http://www.rshb.ru;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.rt-stanko.ru/
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.rt-stanko.ru/;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.tpe.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.tpe.ru;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.treasury.gov/resource-center/sanctions/OFAC-Enforcement/Pages/OFAC-Recent-Actions.aspx
Source: cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.treasury.gov/resource-center/sanctions/OFAC-Enforcement/Pages/OFAC-Recent-Actions.aspx;
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.treasury.gov/resource-center/sanctions/Programs/Pages/ukraine.aspx#directives
Source: cons_prim.csv.crdownload.0.dr, 8d2f7b3d-ceb8-4aef-98f7-41e96cf089f5.tmp.0.dr	String found in binary or memory: http://www.treasury.gov/resource-center/sanctions/Programs/Pages/ukraine.aspx#directives.
Source: 8d2f7b3d-ceb8-4aef-98f7-41e96cf089f5.tmp.0.dr	String found in binary or memory: http://www.treasury.gov/resource-center/sanctions/Programs/Pages/ukraine.aspx#directives.;
Source: cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.treasury.gov/resource-center/sanctions/Programs/Pages/ukraine.aspx#directives;
Source: d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	String found in binary or memory: http://www.twitter.com/
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: http://www.ulgap.ru
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: http://www.ulgap.ru;
Source: d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	String found in binary or memory: http://www.wikipedia.com/
Source: d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	String found in binary or memory: http://www.youtube.com/
Source: chromecache_370.1.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://bard.google.com/
Source: Reporting and NEL.20.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: chromecache_370.1.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: service_worker_bin_prod.js.19.dr, offscreendocument_main.js.19.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: Web Data.19.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.19.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_414.1.dr, chromecache_387.1.dr	String found in binary or memory: https://dap.digitalgov.gov/Universal-Federated-Analytics-Min.js?agency=OFAC
Source: chromecache_373.1.dr	String found in binary or memory: https://dap.digitalgov.gov/web-vitals/dist/web-vitals.attribution.iife.js
Source: Reporting and NEL.20.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.20.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Web Data.19.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.19.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.19.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log9.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log9.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log9.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log8.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log9.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log9.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: Favicons.19.dr	String found in binary or memory: https://edgestatic.azureedge.net/welcome/static/favicon.png
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_369.1.dr, chromecache_410.1.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_369.1.dr, chromecache_410.1.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://gaana.com/
Source: chromecache_369.1.dr, chromecache_410.1.dr	String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_369.1.dr, chromecache_410.1.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.29.1/LICENSE
Source: chromecache_389.1.dr	String found in binary or memory: https://home.treasury.gov/policy-issues/financial-sanctions/consolidated-sanctions-list-data-files
Source: 8d2f7b3d-ceb8-4aef-98f7-41e96cf089f5.tmp.0.dr	String found in binary or memory: https://home.treasury.gov/policy-issues/financial-sanctions/sanctions-programs-and-country-informati
Source: chromecache_389.1.dr	String found in binary or memory: https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-list-data
Source: chromecache_389.1.dr	String found in binary or memory: https://home.treasury.gov/policy-issues/office-of-foreign-assets-control-sanctions-programs-and-info
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: chromecache_369.1.dr, chromecache_410.1.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_369.1.dr, chromecache_410.1.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_369.1.dr, chromecache_410.1.dr	String found in binary or memory: https://js.foundation/
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://m.kugou.com/
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://m.soundcloud.com/
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://m.vk.com/
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://music.amazon.com
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://music.apple.com
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://music.yandex.com
Source: chromecache_389.1.dr	String found in binary or memory: https://ofac.treasury.gov/faqs/287
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: https://ofac.treasury.gov/sanctions-programs-and-country-information/burma#directives
Source: cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	String found in binary or memory: https://ofac.treasury.gov/sanctions-programs-and-country-information/burma#directives;
Source: cons_prim.csv.crdownload.0.dr	String found in binary or memory: https://ofac.treasury.gov/sanctions-programs-and-country-information/ukraine-russia-related-sanction
Source: chromecache_389.1.dr	String found in binary or memory: https://ofac.treasury.gov/specially-designated-nationals-list-sdn-list/program-tag-definitions-for-o
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://open.spotify.com
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_370.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_370.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: chromecache_414.1.dr, chromecache_387.1.dr	String found in binary or memory: https://sanctionslist.ofac.treas.gov/Home/static/index.html
Source: chromecache_369.1.dr, chromecache_410.1.dr	String found in binary or memory: https://sizzlejs.com/
Source: chromecache_370.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_370.1.dr	String found in binary or memory: https://td.doubleclick.net
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://tidal.com/
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://twitter.com/
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://vibe.naver.com/today
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://web.telegram.org/
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://web.whatsapp.com
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.deezer.com/
Source: chromecache_370.1.dr	String found in binary or memory: https://www.google.com
Source: content_new.js.19.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.19.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_370.1.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_370.1.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_373.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.instagram.com
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.last.fm/
Source: chromecache_370.1.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.messenger.com
Source: 000003.log1.19.dr	String found in binary or memory: https://www.msn.com
Source: 000003.log0.19.dr	String found in binary or memory: https://www.msn.com/
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: Session_13380928376147550.19.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/distribution/edgewelcome?experiences=DistributionPage&ocid=edge
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.office.com
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.tiktok.com/
Source: Unconfirmed 872728.crdownload.0.dr	String found in binary or memory: https://www.treasury.gov/resource-center/sanctions/Programs/Pages/ukraine.aspx#directives
Source: cons_prim.csv.crdownload.0.dr	String found in binary or memory: https://www.treasury.gov/resource-center/sanctions/Programs/Pages/ukraine.aspx#directives;
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://www.youtube.com
Source: chromecache_373.1.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\sdn_enhanced.zip (copy)

Jump to dropped file

Source: classification engine

Classification label: mal52.evad.win@92/335@36/20

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF921FACCCC0E8A3B6.TMP

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

System information queried: HandleInformation

Source: C:\Program Files\Internet Explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1948,i,3932446117496796213,13477073409366957186,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sanctionssearch.ofac.treas.gov"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE "C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\AppData\Local\Temp\Temp1_sdn_enhanced.zip\SDN_ENHANCED.XML"
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\AppData\Local\Temp\Temp1_sdn_enhanced.zip\SDN_ENHANCED.XML
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6624 CREDAT:9474 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=7005c
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=7005c
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=7005c
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4132 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7412 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7308 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe cookie_exporter.exe --cookie-json=1128
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4756 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1948,i,3932446117496796213,13477073409366957186,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4132 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\AppData\Local\Temp\Temp1_sdn_enhanced.zip\SDN_ENHANCED.XML	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6624 CREDAT:9474 /prefetch:2	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=7005c	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=7005c	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=7005c	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4132 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7412 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7308 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4756 --field-trial-handle=2000,i,12020179800588036875,16728450634420741618,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe cookie_exporter.exe --cookie-json=1128

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: appvisvsubsystems32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: c2r32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: msedge.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: msedge_elf.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Section loaded: winnsi.dll

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: Web Data.19.dr	Binary or memory string: outlook.office365.comVMware20,11696584680t
Source: Web Data.19.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696584680
Source: Web Data.19.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696584680p
Source: Web Data.19.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696584680^
Source: Web Data.19.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696584680n
Source: Web Data.19.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696584680]
Source: Web Data.19.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696584680x
Source: Web Data.19.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696584680
Source: Web Data.19.dr	Binary or memory string: outlook.office.comVMware20,11696584680s
Source: Web Data.19.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696584680\|UE
Source: Web Data.19.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696584680x
Source: Web Data.19.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696584680u
Source: Web Data.19.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696584680
Source: Web Data.19.dr	Binary or memory string: ms.portal.azure.comVMware20,11696584680
Source: Web Data.19.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696584680}
Source: cookie_exporter.exe, 0000001A.00000002.1695255968.000001D6E3A45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.19.dr	Binary or memory string: bankofamerica.comVMware20,11696584680x
Source: Web Data.19.dr	Binary or memory string: turbotax.intuit.comVMware20,11696584680t
Source: Web Data.19.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696584680
Source: Web Data.19.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696584680
Source: Web Data.19.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696584680~
Source: Web Data.19.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696584680}
Source: Web Data.19.dr	Binary or memory string: AMC password management pageVMware20,11696584680
Source: Web Data.19.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696584680h
Source: Web Data.19.dr	Binary or memory string: interactivebrokers.comVMware20,11696584680
Source: Web Data.19.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696584680z
Source: Web Data.19.dr	Binary or memory string: tasks.office.comVMware20,11696584680o
Source: Web Data.19.dr	Binary or memory string: discord.comVMware20,11696584680f
Source: Web Data.19.dr	Binary or memory string: global block list test formVMware20,11696584680
Source: Web Data.19.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696584680
Source: Web Data.19.dr	Binary or memory string: dev.azure.comVMware20,11696584680j
Source: Web Data.19.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696584680d

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Exploitation for Client Execution	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Process Injection	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Rundll32	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label
http://omz-izhora.com;	0%	Avira URL Cloud	safe
http://sibnefteprovod.transneft.ru	0%	Avira URL Cloud	safe
http://rtguard.ru/	0%	Avira URL Cloud	safe
http://omz-izhora.com	0%	Avira URL Cloud	safe
http://www.rt-stanko.ru/;	0%	Avira URL Cloud	safe
http://www.kcplant.ru/	0%	Avira URL Cloud	safe
http://www.kcplant.ru/;	0%	Avira URL Cloud	safe
https://sanctionslist.ofac.treas.gov/Home/64cd5b0762a5bb22557372b8f7b84916.png	0%	Avira URL Cloud	safe
http://surgutmebel.ru	0%	Avira URL Cloud	safe
http://www.concern-orion.ru;	0%	Avira URL Cloud	safe
http://www.bmbank.com.ua;	0%	Avira URL Cloud	safe
http://vtbcapital.com;	0%	Avira URL Cloud	safe
http://rtguard.ru/;	0%	Avira URL Cloud	safe
https://sanctionslist.ofac.treas.gov/Home/main.4c18940969d5b18ddf1b.css	0%	Avira URL Cloud	safe
http://www.ulgap.ru;	0%	Avira URL Cloud	safe
http://www.90zavod.ru	0%	Avira URL Cloud	safe
http://www.90zavod.ru;	0%	Avira URL Cloud	safe
http://en.vtb-bank.kz/;	0%	Avira URL Cloud	safe
http://www.mzmayak.ru;	0%	Avira URL Cloud	safe
http://www.tpe.ru	0%	Avira URL Cloud	safe
http://www.bmbank.com.ua	0%	Avira URL Cloud	safe
http://www.rshb.ru	0%	Avira URL Cloud	safe
http://ckbrm.ru	0%	Avira URL Cloud	safe
http://splav.org;	0%	Avira URL Cloud	safe
http://en.vtb.az/;	0%	Avira URL Cloud	safe
http://www.opkrt.ru	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
sanctionslistservice.ofac.treas.gov	164.95.9.80	true	false	high
sanctionslist.ofac.treas.gov	164.95.8.134	true	false	high
d27f3qgc9anoq2.cloudfront.net	13.32.27.113	true	false	unknown
s3.us-gov-west-1.amazonaws.com	108.175.50.40	true	false	unknown
www.google.com	142.250.186.36	true	false	high
home.treasury.gov	2.21.65.143	true	false	high
googlehosted.l.googleusercontent.com	172.217.18.1	true	false	high
sanctionssearch.ofac.treas.gov	164.95.8.162	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
dap.digitalgov.gov	unknown	unknown	false	high
wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://home.treasury.gov/policy-issues/financial-sanctions/consolidated-sanctions-list-data-files	false		high
https://sanctionslist.ofac.treas.gov/Home/64cd5b0762a5bb22557372b8f7b84916.png	false	Avira URL Cloud: safe	unknown
https://sanctionssearch.ofac.treas.gov/images/Background.png	false		high
https://sanctionssearch.ofac.treas.gov/css/print.css	false		high
https://sanctionssearch.ofac.treas.gov/images/printerIcon.gif	false		high
https://bat.bing.net/actionp/0?ti=355008692&Ver=2&mid=632bc3af-4a90-47c3-b5b5-d9415d7200bf&bo=1&evt=consent&src=default&cdb=AQAQ&asc=D	false		high
https://sanctionssearch.ofac.treas.gov/WebResource.axd?d=3_RVinVmJovhKfbiF1QGoXBpzmAU7zmBMGrgOgsvHZpRd8DMeDpHHTJKZ_EUmX7PQjQyehXLtRRx9O_2wycbxiybNg2qIxe7dfbymHCiVRsZE1G91fknqdo084XueWVOyGY9dw2&t=637418434420000000	false		high
https://sanctionssearch.ofac.treas.gov/	false		high
https://sanctionslist.ofac.treas.gov/Home/main.4c18940969d5b18ddf1b.css	false	Avira URL Cloud: safe	unknown
https://sanctionssearch.ofac.treas.gov/default.aspx?_TSM_HiddenField_=ctl00_ctl03_HiddenField&_TSM_CombinedScripts_=%3b%3bAjaxControlToolkit%2c+Version%3d3.5.40412.0%2c+Culture%3dneutral%2c+PublicKeyToken%3d28f01b0e84b6d53e%3aen-US%3a1547e793-5b7e-48fe-8490-03a375b13a33%3a475a4ef5%3a5546a2b%3ad2e10b12%3a497ef277%3aeffe2a26	false		high
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=DE3D9F89BC3D42139918164BD9B10C35&MUID=3E4F48E5D92E698F38955D8ADD2E67A0	false		high
https://sanctionssearch.ofac.treas.gov/css/global.css	false		high
https://sanctionslistservice.ofac.treas.gov/api/PublicationPreview/PublicationList?list=CONSOLIDATED	false		high
https://sanctionssearch.ofac.treas.gov/ScriptResource.axd?d=w6ZF-zq6tzm7FtC8jUZcwGF8VjfOGz8YmWrhTdSBnCpvKQhpTXLmNP-BDPjZEKO_7WAsEwrnG5z1iGuMjU840sjg1EjvFPeSkFcbvbVf46Gc5XmDH92hTGUK-OH4s8p0bj-aVg2&t=ffffffffec54f2d7	false		high
https://sanctionslist.ofac.treas.gov/Home/SdnList	false		unknown
https://dap.digitalgov.gov/Universal-Federated-Analytics-Min.js?agency=OFAC	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&ext.intweb.msfpc=GUID%3Ddca45732884c4497868001b89526d72b%26HASH%3Ddca4%26LV%3D202501%26V%3D4%26LU%3D1736454826194&w=0&anoncknm=app_anon	false		high
https://sanctionslistservice.ofac.treas.gov/api/PublicationPreview/PublicationList?list=SDN	false		high
https://sanctionssearch.ofac.treas.gov/favicon.ico	false		high
https://c.clarity.ms/c.gif	false		high
https://sanctionssearch.ofac.treas.gov/scripts/resizeResults.js	false		high
https://sanctionssearch.ofac.treas.gov/images/excel.gif	false		high
https://z.clarity.ms/collect	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
http://omz-izhora.com	Unconfirmed 872728.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
http://www.rt-stanko.ru/;	cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.19.dr	false		high
http://www.kcplant.ru/	Unconfirmed 872728.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
http://rtguard.ru/	Unconfirmed 872728.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/g/collect	chromecache_370.1.dr	false		high
https://duckduckgo.com/ac/?q=	Web Data.19.dr	false		high
http://www.kcplant.ru/;	cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
http://www.treasury.gov/resource-center/sanctions/OFAC-Enforcement/Pages/OFAC-Recent-Actions.aspx	Unconfirmed 872728.crdownload.0.dr	false		high
https://github.com/zloirock/core-js	chromecache_369.1.dr, chromecache_410.1.dr	false		high
https://www.treasury.gov/resource-center/sanctions/Programs/Pages/ukraine.aspx#directives	Unconfirmed 872728.crdownload.0.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.20.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.20.dr	false		high
http://surgutmebel.ru	Unconfirmed 872728.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
https://www.youtube.com	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
https://fontawesome.com	chromecache_369.1.dr, chromecache_410.1.dr	false		high
https://www.instagram.com	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
https://ofac.treasury.gov/sanctions-programs-and-country-information/burma#directives;	cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	false		high
https://home.treasury.gov/policy-issues/financial-sanctions/sanctions-programs-and-country-informati	8d2f7b3d-ceb8-4aef-98f7-41e96cf089f5.tmp.0.dr	false		high
https://www.msn.com	000003.log1.19.dr	false		high
https://ofac.treasury.gov/specially-designated-nationals-list-sdn-list/program-tag-definitions-for-o	chromecache_389.1.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
http://www.concern-orion.ru;	cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
https://outlook.office.com/mail/compose?isExtension=true	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
http://www.reddit.com/	d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	false		high
http://omz-izhora.com;	cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
https://i.y.qq.com/n2/m/index.html	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
https://www.deezer.com/	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
https://web.telegram.org/	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
http://sibnefteprovod.transneft.ru	Unconfirmed 872728.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
http://en.vtb-bank.kz/;	cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	service_worker_bin_prod.js.19.dr, offscreendocument_main.js.19.dr	false		high
http://www.treasury.gov/resource-center/sanctions/Programs/Pages/ukraine.aspx#directives;	cons_prim.csv.crdownload.0.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.19.dr	false		high
https://www.msn.com/	000003.log0.19.dr	false		high
http://www.treasury.gov/resource-center/sanctions/Programs/Pages/ukraine.aspx#directives.	cons_prim.csv.crdownload.0.dr, 8d2f7b3d-ceb8-4aef-98f7-41e96cf089f5.tmp.0.dr	false		high
https://excel.new?from=EdgeM365Shoreline	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
http://www.bmbank.com.ua;	cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
https://home.treasury.gov/policy-issues/office-of-foreign-assets-control-sanctions-programs-and-info	chromecache_389.1.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.20.dr	false		high
https://ofac.treasury.gov/sanctions-programs-and-country-information/ukraine-russia-related-sanction	cons_prim.csv.crdownload.0.dr	false		high
https://jquery.com/	chromecache_369.1.dr, chromecache_410.1.dr	false		high
http://www.ulgap.ru;	cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
https://bard.google.com/	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
https://sizzlejs.com/	chromecache_369.1.dr, chromecache_410.1.dr	false		high
http://www.90zavod.ru;	cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
https://www.office.com	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
https://outlook.live.com/mail/0/	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
http://rtguard.ru/;	cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
http://www.tpe.ru	Unconfirmed 872728.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
http://www.amazon.com/	d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	false		high
http://vtbcapital.com;	cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
http://www.90zavod.ru	Unconfirmed 872728.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
http://www.mzmayak.ru;	cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
http://www.twitter.com/	d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	false		high
https://tidal.com/	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
https://fontawesome.com/license/free	chromecache_369.1.dr, chromecache_410.1.dr	false		high
https://gaana.com/	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
https://outlook.live.com/mail/compose?isExtension=true	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
http://www.bmbank.com.ua	Unconfirmed 872728.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
http://ckbrm.ru	Unconfirmed 872728.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
https://latest.web.skype.com/?browsername=edge_canary_shoreline	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
https://word.new?from=EdgeM365Shoreline	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
http://www.nytimes.com/	d2784914-be1b-407f-bef8-ec3a54f846b5.tmp.19.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.19.dr	false		high
https://www.treasury.gov/resource-center/sanctions/Programs/Pages/ukraine.aspx#directives;	cons_prim.csv.crdownload.0.dr	false		high
https://mail.google.com/mail/mu/mp/266/#tl/Inbox	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
http://www.rshb.ru	Unconfirmed 872728.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
https://open.spotify.com	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
https://twitter.com/	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
http://www.opkrt.ru	Unconfirmed 872728.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
https://m.vk.com/	b2c1f2d9-3517-4530-82c8-c868790d4f35.tmp.19.dr	false		high
http://en.vtb.az/;	cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	false	Avira URL Cloud: safe	unknown
https://jquery.org/license	chromecache_369.1.dr, chromecache_410.1.dr	false		high
http://splav.org;	cons_prim.ff.crdownload.0.dr, chromecache_379.1.dr, chromecache_374.1.dr, cons_prim.csv.crdownload.0.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
108.175.48.144	unknown	United States	8987	AMAZONEXPANSIONGB	false
164.95.8.134	sanctionslist.ofac.treas.gov	United States	13506	US-DEPARTMENT-OF-THE-TREASURYUS	false
151.101.193.229	unknown	United States	54113	FASTLYUS	false
52.168.117.170	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.21.65.143	home.treasury.gov	European Union	20940	AKAMAI-ASN1EU	false
23.49.251.37	unknown	United States	16625	AKAMAI-ASUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
164.95.9.80	sanctionslistservice.ofac.treas.gov	United States	13506	US-DEPARTMENT-OF-THE-TREASURYUS	false
108.175.50.40	s3.us-gov-west-1.amazonaws.com	United States	8987	AMAZONEXPANSIONGB	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
13.32.27.113	d27f3qgc9anoq2.cloudfront.net	United States	7018	ATT-INTERNET4US	false
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
164.95.8.162	sanctionssearch.ofac.treas.gov	United States	13506	US-DEPARTMENT-OF-THE-TREASURYUS	false
20.10.16.51	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.32.27.91	unknown	United States	7018	ATT-INTERNET4US	false
204.79.197.203	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587028
Start date and time:	2025-01-09 21:31:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://sanctionssearch.ofac.treas.gov
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.evad.win@92/335@36/20
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Input	Output
URL: https://sanctionssearch.ofac.treas.gov Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://sanctionssearch.ofac.treas.gov
URL: https://sanctionslist.ofac.treas.gov/Home/SdnList... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript code appears to be a browser detection and compatibility check script. It uses standard browser detection techniques and redirects users to a specific URL if the detected browser is not supported. This behavior is common for web applications that require specific browser capabilities. While the script uses some legacy APIs like `navigator.userAgent`, it does not exhibit any high-risk indicators such as dynamic code execution, data exfiltration, or suspicious redirects. The script's purpose seems to be legitimate, and the risk level is low." }
function get_browser() { var ua = navigator.userAgent, tem, M = ua.match(/(opera\|chrome\|safari\|firefox\|msie\|trident(?=\/))\/?\s*(\d+)/i) \|\| []; if (/trident/i.test(M[1])) { tem = /\brv[ :]+(\d+)/g.exec(ua) \|\| []; return { name: 'IE', version: (tem[1] \|\| '') }; } if (M[1] === 'Chrome') { tem = ua.match(/\bOPR\/(\d+)/) if (tem != null) { return { name: 'Opera', version: tem[1] }; } } if (window.navigator.userAgent.indexOf("Edge") > -1) { tem = ua.match(/\Edge\/(\d+)/) if (tem != null) { return { name: 'Edge', version: tem[1] }; } } M = M[2] ? [M[1], M[2]] : [navigator.appName, navigator.appVersion, '-?']; if ((tem = ua.match(/version\/(\d+)/i)) != null) { M.splice(1, 1, tem[1]); } return { name: M[0], version: +M[1] }; } var browser = get_browser() var isSupported = isSupported(browser); function isSupported(browser) { var supported = false; if (browser.name === "Chrome") { supported = true; } else if (browser.name === "Edge") { supported = true; } else if (browser.name === "Firefox") { supported = true; } else if (browser.name === "Safari") { supported = true; } return supported; } if (!isSupported) { window.location.href = "https://sanctionslist.ofac.treas.gov/Home/static/index.html"; }
URL: https://sanctionslist.ofac.treas.gov/Home/SdnList Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://sanctionssearch.ofac.treas.gov/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://sanctionslist.ofac.treas.gov/Home/SdnList Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://sanctionssearch.ofac.treas.gov/ Model: Joe Sandbox AI	{ "brands": "OFAC" }
	{ "brands": "OFAC" }
URL: https://sanctionslist.ofac.treas.gov/Home/bundle.j... Model: Joe Sandbox AI	```json { "risk_score": 2, "reasoning": "The script appears to be a Webpack bundle loader, which dynamically loads JavaScript chunks. It uses dynamic script injection to load additional code, which is a moderate-risk behavior due to potential external data transmission. However, there are no high-risk indicators like data exfiltration or redirects to suspicious domains. The script does not show signs of malicious intent, but the dynamic loading warrants a closer review." }
!function(e){function t(t){for(var n,a,o=t[0],i=t[1],s=0,u=[];s<o.length;s++)a=o[s],Object.prototype.hasOwnProperty.call(r,a)&&r[a]&&u.push(r[a][0]),r[a]=0;for(n in i)Object.prototype.hasOwnProperty.call(i,n)&&(e[n]=i[n]);for(l&&l(t);u.length;)u.shift()()}var n={},r={0:0};function a(t){if(n[t])return n[t].exports;var r=n[t]={i:t,l:!1,exports:{}};return e[t].call(r.exports,r,r.exports,a),r.l=!0,r.exports}a.e=function(e){var t=[],n=r[e];if(0!==n)if(n)t.push(n[2]);else{var o=new Promise((function(t,a){n=r[e]=[t,a]}));t.push(n[2]=o);var i,s=document.createElement("script");s.charset="utf-8",s.timeout=120,a.nc&&s.setAttribute("nonce",a.nc),s.src=function(e){return a.p+""+e+".bundle.js"}(e);var l=new Error;i=function(t){s.onerror=s.onload=null,clearTimeout(u);var n=r[e];if(0!==n){if(n){var a=t&&("load"===t.type?"missing":t.type),o=t&&t.target&&t.target.src;l.message="Loading chunk "+e+" failed.\n("+a+": "+o+")",l.name="ChunkLoadError",l.type=a,l.request=o,n[1](l)}r[e]=void 0}};var u=setTimeout((function(){i({type:"timeout",target:s})}),12e4);s.onerror=s.onload=i,document.head.appendChild(s)}return Promise.all(t)},a.m=e,a.c=n,a.d=function(e,t,n){a.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},a.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},a.t=function(e,t){if(1&t&&(e=a(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(a.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)a.d(n,r,function(t){return e[t]}.bind(null,r));return n},a.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return a.d(t,"a",t),t},a.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},a.p="",a.oe=function(e){throw console.error(e),e};var o=window.webpackJsonp=window.webpackJsonp\|\|[],i=o.push.bind(o);o.push=t,o=o.slice();for(var s=0;s<o.length;s++)t(o[s]);var l=i;a(a.s=492)}([function(e,t,n){"use strict";e.exports=n(201)},function(e,t,n){"use strict";e.exports=n(202)},function(e,t,n){"use strict";function r(e){return(r="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e){if(!("string"==typeof e\|\|e instanceof String)){var t=r(e);throw null===e?t="null":"object"===t&&(t=e.constructor.name),new TypeError("Expected a string but received a ".concat(t))}},e.exports=t.default,e.exports.default=t.default},function(e,t,n){var r=n(14),a=n(87).f,o=n(74),i=n(38),s=n(92),l=n(130),u=n(133);e.exports=function(e,t){var n,c,f,d,p,h=e.target,v=e.global,m=e.stat;if(n=v?r:m?r[h]\|\|s(h,{}):(r[h]\|\|{}).prototype)for(c in t){if(d=t[c],f=e.dontCallGetSet?(p=a(n,c))&&p.value:n[c],!u(v?c:h+(m?".":"#")+c,e.forced)&&void 0!==f){if(typeof d==typeof f)continue;l(d,f)}(e.sham\|\|f&&f.sham)&&o(d,"sham",!0),i(n,c,d,e)}}},function(e,t,n){var r; /! Copyright (c) 2018 Jed Watson. Licensed under the MIT License (MIT), see http://jedwatson.github.io/classnames /!function(){"use strict";var n={}.hasOwnProperty;function a(){for(var e=[],t=0;t<arguments.length;t++){var r=arguments[t];if(r){var o=typeof r;if("string"===o\|\|"number"===o)e.push(r);else if(Array.isArray(r)){if(r.length){var i=a.apply(null,r);i&&e.push(i)}}else if("object"===o){if(r.toString!==Object.prototype.toString&&!r.toString.toString().includes("[native code]")){e.push(r.toString());continue}for(var s in r)n.call(r,s)&&r[s]&&e.push(s)}}}return e.join(" ")}e.exports?(a.default=a,e.exports=a):void 0===(r=function(){return a}.apply(t,[]))\|\|(e.exports=r)}()},function(e,t,n){e.exports=n(459)()},function(e,t,n){var r=n(71),a=Function.prototype,o=a.call,i=r&&a.bind.bind(o,o);e.exports=r?i:function(e){return function(){return o.apply(e,arguments

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Reputation:	low
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58101
Entropy (8bit):	6.105811105967592
Encrypted:	false
SSDEEP:	1536:k/Ps+wsI7yOYi+EeTTvqrv7toYKBuSZ+aoo:k/0+zI7yOt+EGTiv3KBuWNP
MD5:	4C81323AF5E0678B35989494EF7CDCC5
SHA1:	8DFDD623C50D7AA04A3771228E8D417CE822157D
SHA-256:	E8F23D479F2448536E9AE570054F635EF500B69EAE605D2E7EDCDC2664B4E881
SHA-512:	ED019544D166D0B6999125A0F308E5D505593CE77B88E1DEE4A1C1D05F8C78CE078A8B65A1DE4840CC566EB50DDCE5F71EAF4604BB2BA996E4C43EF15C92D2FB
Malicious:	false
Reputation:	low
Preview:	{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 9 19:32:07 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9930221982979766
Encrypted:	false
SSDEEP:	48:8I8dDTrvwHKidAKZdA1FehwiZUklqehVy+3:8IAPx2y
MD5:	801660FF08C61ECCA013DE310CCC2A3B
SHA1:	2D60CCA21E87CFE4A83935D34E7137E1BC95FEE7
SHA-256:	2A563680C7B3DC8892F0B20DDE24244BF173C46CDAD01A6F95D41EB482004875
SHA-512:	8BB92E55C8EB89F608EC374310044D2B264E0690E226B0F30B26356EFEE07292D8356EB3A634A0CD79E16E86B176A3E7A779B3363067FAFD345B06BFB2480607
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....<...b..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I)Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V)Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........<.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 21:32:06.909773111 CET	192.168.2.16	1.1.1.1	0x8955	Standard query (0)	sanctionssearch.ofac.treas.gov	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:06.909934044 CET	192.168.2.16	1.1.1.1	0x3b34	Standard query (0)	sanctionssearch.ofac.treas.gov	65	IN (0x0001)	false
Jan 9, 2025 21:32:08.962620974 CET	192.168.2.16	1.1.1.1	0xec02	Standard query (0)	sanctionssearch.ofac.treas.gov	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:08.962898016 CET	192.168.2.16	1.1.1.1	0x1cec	Standard query (0)	sanctionssearch.ofac.treas.gov	65	IN (0x0001)	false
Jan 9, 2025 21:32:10.837359905 CET	192.168.2.16	1.1.1.1	0x14c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:10.837502003 CET	192.168.2.16	1.1.1.1	0x6044	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 9, 2025 21:32:20.712934017 CET	192.168.2.16	1.1.1.1	0x6297	Standard query (0)	home.treasury.gov	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:20.713138103 CET	192.168.2.16	1.1.1.1	0xdb8b	Standard query (0)	home.treasury.gov	65	IN (0x0001)	false
Jan 9, 2025 21:32:21.812000036 CET	192.168.2.16	1.1.1.1	0x2040	Standard query (0)	sanctionslist.ofac.treas.gov	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:21.812196970 CET	192.168.2.16	1.1.1.1	0xbe0a	Standard query (0)	sanctionslist.ofac.treas.gov	65	IN (0x0001)	false
Jan 9, 2025 21:32:22.876065969 CET	192.168.2.16	1.1.1.1	0xa783	Standard query (0)	dap.digitalgov.gov	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:22.876202106 CET	192.168.2.16	1.1.1.1	0x223f	Standard query (0)	dap.digitalgov.gov	65	IN (0x0001)	false
Jan 9, 2025 21:32:23.961483955 CET	192.168.2.16	1.1.1.1	0x9cce	Standard query (0)	dap.digitalgov.gov	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:23.961719036 CET	192.168.2.16	1.1.1.1	0x3182	Standard query (0)	dap.digitalgov.gov	65	IN (0x0001)	false
Jan 9, 2025 21:32:24.929735899 CET	192.168.2.16	1.1.1.1	0xa7ff	Standard query (0)	sanctionslist.ofac.treas.gov	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:24.929899931 CET	192.168.2.16	1.1.1.1	0xa9e9	Standard query (0)	sanctionslist.ofac.treas.gov	65	IN (0x0001)	false
Jan 9, 2025 21:32:31.737582922 CET	192.168.2.16	1.1.1.1	0xddbb	Standard query (0)	sanctionslistservice.ofac.treas.gov	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:31.737739086 CET	192.168.2.16	1.1.1.1	0xc990	Standard query (0)	sanctionslistservice.ofac.treas.gov	65	IN (0x0001)	false
Jan 9, 2025 21:32:32.773866892 CET	192.168.2.16	1.1.1.1	0x1eb4	Standard query (0)	sanctionslistservice.ofac.treas.gov	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:32.774003983 CET	192.168.2.16	1.1.1.1	0xed09	Standard query (0)	sanctionslistservice.ofac.treas.gov	65	IN (0x0001)	false
Jan 9, 2025 21:32:40.379082918 CET	192.168.2.16	1.1.1.1	0x4322	Standard query (0)	wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:40.379198074 CET	192.168.2.16	1.1.1.1	0x992a	Standard query (0)	wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.com	65	IN (0x0001)	false
Jan 9, 2025 21:32:53.431360006 CET	192.168.2.16	1.1.1.1	0x22d5	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:53.431509018 CET	192.168.2.16	1.1.1.1	0x36c8	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Jan 9, 2025 21:32:55.971822977 CET	192.168.2.16	1.1.1.1	0xf75d	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:55.971981049 CET	192.168.2.16	1.1.1.1	0x4344	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Jan 9, 2025 21:32:57.204363108 CET	192.168.2.16	1.1.1.1	0xc52a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:57.204534054 CET	192.168.2.16	1.1.1.1	0x5da9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 9, 2025 21:32:57.204817057 CET	192.168.2.16	1.1.1.1	0xbe93	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:57.204950094 CET	192.168.2.16	1.1.1.1	0x9c9d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 9, 2025 21:32:57.217106104 CET	192.168.2.16	1.1.1.1	0xf6c8	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:57.217294931 CET	192.168.2.16	1.1.1.1	0x4ea	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 9, 2025 21:33:35.143111944 CET	192.168.2.16	1.1.1.1	0x4c62	Standard query (0)	sanctionslistservice.ofac.treas.gov	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:33:35.143111944 CET	192.168.2.16	1.1.1.1	0xf39	Standard query (0)	sanctionslistservice.ofac.treas.gov	65	IN (0x0001)	false
Jan 9, 2025 21:33:52.189688921 CET	192.168.2.16	1.1.1.1	0x72c7	Standard query (0)	wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:33:52.189946890 CET	192.168.2.16	1.1.1.1	0x8443	Standard query (0)	wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 21:32:06.923319101 CET	1.1.1.1	192.168.2.16	0x8955	No error (0)	sanctionssearch.ofac.treas.gov		164.95.8.162	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:08.972769022 CET	1.1.1.1	192.168.2.16	0xec02	No error (0)	sanctionssearch.ofac.treas.gov		164.95.8.162	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:10.844125032 CET	1.1.1.1	192.168.2.16	0x14c	No error (0)	www.google.com		142.250.186.36	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:10.844491959 CET	1.1.1.1	192.168.2.16	0x6044	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 9, 2025 21:32:20.745563984 CET	1.1.1.1	192.168.2.16	0x6297	No error (0)	home.treasury.gov		2.21.65.143	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:20.745563984 CET	1.1.1.1	192.168.2.16	0x6297	No error (0)	home.treasury.gov		2.21.65.142	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:21.823987961 CET	1.1.1.1	192.168.2.16	0x2040	No error (0)	sanctionslist.ofac.treas.gov		164.95.8.134	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:22.883083105 CET	1.1.1.1	192.168.2.16	0xa783	No error (0)	dap.digitalgov.gov	d27f3qgc9anoq2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 21:32:22.883083105 CET	1.1.1.1	192.168.2.16	0xa783	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.27.113	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:22.883083105 CET	1.1.1.1	192.168.2.16	0xa783	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.27.50	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:22.883083105 CET	1.1.1.1	192.168.2.16	0xa783	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.27.91	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:22.883083105 CET	1.1.1.1	192.168.2.16	0xa783	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.27.21	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:22.898714066 CET	1.1.1.1	192.168.2.16	0x223f	No error (0)	dap.digitalgov.gov	d27f3qgc9anoq2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 21:32:23.977411985 CET	1.1.1.1	192.168.2.16	0x3182	No error (0)	dap.digitalgov.gov	d27f3qgc9anoq2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 21:32:23.984014988 CET	1.1.1.1	192.168.2.16	0x9cce	No error (0)	dap.digitalgov.gov	d27f3qgc9anoq2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 21:32:23.984014988 CET	1.1.1.1	192.168.2.16	0x9cce	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.27.91	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:23.984014988 CET	1.1.1.1	192.168.2.16	0x9cce	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.27.113	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:23.984014988 CET	1.1.1.1	192.168.2.16	0x9cce	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.27.21	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:23.984014988 CET	1.1.1.1	192.168.2.16	0x9cce	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.27.50	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:24.941411018 CET	1.1.1.1	192.168.2.16	0xa7ff	No error (0)	sanctionslist.ofac.treas.gov		164.95.8.134	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:31.752360106 CET	1.1.1.1	192.168.2.16	0xddbb	No error (0)	sanctionslistservice.ofac.treas.gov		164.95.9.80	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:32.783088923 CET	1.1.1.1	192.168.2.16	0x1eb4	No error (0)	sanctionslistservice.ofac.treas.gov		164.95.9.80	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:40.398401022 CET	1.1.1.1	192.168.2.16	0x4322	No error (0)	wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.com	s3.us-gov-west-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 21:32:40.398401022 CET	1.1.1.1	192.168.2.16	0x4322	No error (0)	s3.us-gov-west-1.amazonaws.com		108.175.50.40	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:40.402401924 CET	1.1.1.1	192.168.2.16	0x992a	No error (0)	wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.com	s3.us-gov-west-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 21:32:53.438134909 CET	1.1.1.1	192.168.2.16	0x22d5	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 21:32:53.438134909 CET	1.1.1.1	192.168.2.16	0x22d5	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:53.440874100 CET	1.1.1.1	192.168.2.16	0x36c8	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 21:32:55.978796005 CET	1.1.1.1	192.168.2.16	0x4344	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 21:32:55.980042934 CET	1.1.1.1	192.168.2.16	0xf75d	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 21:32:57.211414099 CET	1.1.1.1	192.168.2.16	0x5da9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 9, 2025 21:32:57.211427927 CET	1.1.1.1	192.168.2.16	0xc52a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:57.211427927 CET	1.1.1.1	192.168.2.16	0xc52a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:57.211576939 CET	1.1.1.1	192.168.2.16	0xbe93	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:57.211576939 CET	1.1.1.1	192.168.2.16	0xbe93	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:57.211587906 CET	1.1.1.1	192.168.2.16	0x9c9d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 9, 2025 21:32:57.223912954 CET	1.1.1.1	192.168.2.16	0x4ea	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 9, 2025 21:32:57.223926067 CET	1.1.1.1	192.168.2.16	0xf6c8	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:32:57.223926067 CET	1.1.1.1	192.168.2.16	0xf6c8	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:33:35.152611017 CET	1.1.1.1	192.168.2.16	0x4c62	No error (0)	sanctionslistservice.ofac.treas.gov		164.95.9.80	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:33:52.213345051 CET	1.1.1.1	192.168.2.16	0x72c7	No error (0)	wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.com	s3.us-gov-west-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 21:33:52.213345051 CET	1.1.1.1	192.168.2.16	0x72c7	No error (0)	s3.us-gov-west-1.amazonaws.com		108.175.48.144	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:33:52.222140074 CET	1.1.1.1	192.168.2.16	0x8443	No error (0)	wc2h-sls-prod-public-published.s3.us-gov-west-1.amazonaws.com	s3.us-gov-west-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:32:07 UTC	673	OUT	GET / HTTP/1.1 Host: sanctionssearch.ofac.treas.gov Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 20:32:07 UTC	558	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:32:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 46175 Connection: close Cache-Control: private Set-Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; path=/; secure; HttpOnly; SameSite=Lax X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Set-Cookie: BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==; path=/; Httponly; Secure
2025-01-09 20:32:07 UTC	9121	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0d 0a 3c 68 65 61 64 20 69 64 3d 22 63 74 6c 30 30 5f 48 65 61 64 31 22 3e 3c 74 69 74 6c 65 3e 0d 0a 09 53 61 6e 63 74 69 6f 6e 73 20 4c 69 73 74 20 53 65 61 72 63 68 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 68 72 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" ><head id="ctl00_Head1"><title>Sanctions List Search</title><link hr
2025-01-09 20:32:08 UTC	8259	IN	Data Raw: 4b 6c 4a 6c 5a 32 6c 76 62 6a 6f 67 51 32 39 74 62 57 39 75 64 32 56 68 62 48 52 6f 49 47 39 6d 49 45 6c 75 5a 47 56 77 5a 57 35 6b 5a 57 35 30 49 46 4e 30 59 58 52 6c 63 77 35 53 5a 57 64 70 62 32 34 36 49 45 4e 79 61 57 31 6c 59 51 78 53 5a 57 64 70 62 32 34 36 49 45 64 68 65 6d 45 54 55 6d 56 6e 61 57 39 75 4f 69 42 4c 59 57 5a 70 59 53 42 4c 61 57 35 6e 61 52 56 53 5a 57 64 70 62 32 34 36 49 45 35 76 63 6e 52 6f 5a 58 4a 75 49 45 31 68 62 47 6b 4f 55 6d 56 6e 61 57 39 75 4f 69 42 53 64 58 4e 7a 61 57 45 52 55 6d 56 6e 61 57 39 75 4f 69 42 58 5a 58 4e 30 49 45 4a 68 62 6d 73 48 55 6d 39 74 59 57 35 70 59 51 5a 53 64 58 4e 7a 61 57 45 47 55 6e 64 68 62 6d 52 68 46 56 4e 68 61 57 35 30 49 45 74 70 64 48 52 7a 49 47 46 75 5a 43 42 4f 5a 58 5a 70 63 79 42 Data Ascii: KlJlZ2lvbjogQ29tbW9ud2VhbHRoIG9mIEluZGVwZW5kZW50IFN0YXRlcw5SZWdpb246IENyaW1lYQxSZWdpb246IEdhemETUmVnaW9uOiBLYWZpYSBLaW5naRVSZWdpb246IE5vcnRoZXJuIE1hbGkOUmVnaW9uOiBSdXNzaWERUmVnaW9uOiBXZXN0IEJhbmsHUm9tYW5pYQZSdXNzaWEGUndhbmRhFVNhaW50IEtpdHRzIGFuZCBOZXZpcyB
2025-01-09 20:32:08 UTC	2760	IN	Data Raw: 72 73 20 6f 6e 20 74 68 65 20 53 44 4e 20 4c 69 73 74 20 61 6e 64 2f 6f 72 20 74 68 65 20 76 61 72 69 6f 75 73 20 6f 74 68 65 72 20 73 61 6e 63 74 69 6f 6e 73 20 6c 69 73 74 73 2e 20 53 61 6e 63 74 69 6f 6e 73 20 4c 69 73 74 20 53 65 61 72 63 68 20 68 61 73 20 61 20 73 6c 69 64 65 72 2d 62 61 72 20 74 68 61 74 20 6d 61 79 20 62 65 20 75 73 65 64 20 74 6f 20 73 65 74 20 61 20 74 68 72 65 73 68 6f 6c 64 20 28 69 2e 65 2e 2c 20 61 20 63 6f 6e 66 69 64 65 6e 63 65 20 72 61 74 69 6e 67 29 20 66 6f 72 20 74 68 65 20 63 6c 6f 73 65 6e 65 73 73 20 6f 66 20 61 6e 79 20 70 6f 74 65 6e 74 69 61 6c 20 6d 61 74 63 68 20 72 65 74 75 72 6e 65 64 20 61 73 20 61 20 72 65 73 75 6c 74 20 6f 66 20 61 20 75 73 65 72 27 73 20 73 65 61 72 63 68 2e 20 53 61 6e 63 74 69 6f 6e 73 Data Ascii: rs on the SDN List and/or the various other sanctions lists. Sanctions List Search has a slider-bar that may be used to set a threshold (i.e., a confidence rating) for the closeness of any potential match returned as a result of a user's search. Sanctions
2025-01-09 20:32:08 UTC	12239	IN	Data Raw: 22 3e 44 6f 77 6e 6c 6f 61 64 20 74 68 65 20 43 6f 6e 73 6f 6c 69 64 61 74 65 64 20 4e 6f 6e 2d 53 44 4e 20 4c 69 73 74 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 74 64 3e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 64 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 33 34 25 3b 22 3e 3c 2f 74 64 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 64 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 3b 20 77 69 64 74 68 3a 33 33 25 3b 22 3e Data Ascii: ">Download the Consolidated Non-SDN List</a> </td> <td style="width:34%;"></td> <td style="text-align:right; width:33%;">
2025-01-09 20:32:08 UTC	13796	IN	Data Raw: 6f 6d 69 6e 69 63 61 6e 20 52 65 70 75 62 6c 69 63 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 09 09 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 45 63 75 61 64 6f 72 22 3e 45 63 75 61 64 6f 72 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 09 09 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 45 67 79 70 74 22 3e 45 67 79 70 74 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 09 09 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 45 6c 20 53 61 6c 76 61 64 6f 72 22 3e 45 6c 20 53 61 6c 76 61 64 6f 72 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 09 09 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 45 71 75 61 74 6f 72 69 61 6c 20 47 75 69 6e 65 61 22 3e 45 71 75 61 74 6f 72 69 61 6c 20 47 75 69 6e 65 61 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 09 09 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 45 72 69 74 72 65 61 22 3e 45 Data Ascii: ominican Republic</option><option value="Ecuador">Ecuador</option><option value="Egypt">Egypt</option><option value="El Salvador">El Salvador</option><option value="Equatorial Guinea">Equatorial Guinea</option><option value="Eritrea">E

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:32:07 UTC	742	OUT	GET /css/global.css HTTP/1.1 Host: sanctionssearch.ofac.treas.gov Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://sanctionssearch.ofac.treas.gov/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
2025-01-09 20:32:08 UTC	331	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:32:08 GMT Content-Type: text/css Content-Length: 6767 Connection: close Last-Modified: Wed, 25 Nov 2020 00:55:22 GMT Accept-Ranges: bytes ETag: "0b9fda6c5c2d61:0" X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains
2025-01-09 20:32:08 UTC	6588	IN	Data Raw: ef bb bf 68 74 6d 6c 2c 20 62 6f 64 79 20 20 2f 2a 20 63 65 6e 74 65 72 20 6d 61 69 6e 20 63 6f 6e 74 65 6e 74 20 2a 2f 0d 0a 7b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 7d 0d 0a 0d 0a 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 74 65 78 74 61 72 65 61 0d 0a 7b 0d 0a 20 20 20 0d 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 61 72 69 61 6c 2c 20 68 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 2e 39 65 6d 3b 0d 0a 20 20 20 20 0d 0a 7d 0d 0a 0d 0a 62 6f 64 79 0d 0a 7b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 27 2e 2e 2f 69 6d 61 67 Data Ascii: html, body /* center main content */{ margin: 0; padding: 0; text-align: center;}html, body, textarea{ font-family: arial, helvetica, sans-serif; font-size: .9em; }body{ background:url('../imag
2025-01-09 20:32:08 UTC	179	IN	Data Raw: 67 2d 74 6f 70 3a 35 70 78 3b 0d 0a 7d 0d 0a 0d 0a 2e 77 61 72 6e 69 6e 67 42 6f 78 0d 0a 7b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 65 6d 20 30 20 32 65 6d 20 30 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 65 6d 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 62 6c 61 63 6b 3b 0d 0a 7d 0d 0a 0d 0a 2e 73 65 61 72 63 68 4c 69 6e 6b 0d 0a 7b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 65 6d 3b 0d 0a 7d Data Ascii: g-top:5px;}.warningBox{ margin: 1em 0 2em 0; padding: 0 1em; border: 1px solid black;}.searchLink{ text-align: center; margin-top: 2em;}

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://sanctionssearch.ofac.treas.gov

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0a393749-28fa-421c-b3dd-0ffca01fe467.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1b1283fc-3251-4172-90b7-679d8b5ed319.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6740cc23-755b-46e1-b874-d4388e6a6767.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\a4258038-70f7-4435-8f61-165c9a3c5ebe.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67803271-6E8.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\171dece5-5f57-4a06-8818-e49adc6fbb47.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2a4904a1-7cbb-4bc2-9011-70019d70a293.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\468a60a4-a465-4608-8034-3a72cbf2cc91.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4a9d9df1-4829-4f50-8386-4202af8dc29f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5f42b2b3-5617-4b58-8d6e-5bc8ae9bc5c8.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Windows Analysis Report
https://sanctionssearch.ofac.treas.gov

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:32:08 UTC	902	OUT	GET /WebResource.axd?d=iYXJJpU9my9xzhYp_OtAutrOkLPdguC-zMsLLBgxNdyJFKYEfeu4j-lm2zWq_LQPrz5Pd7C0AyOo0YqPeqA0n7EyTg5oPbzMwN7_yNEsfX0ticwfmtYaQelHMfpxan7vuW1JUA2&t=637418434420000000 HTTP/1.1 Host: sanctionssearch.ofac.treas.gov Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://sanctionssearch.ofac.treas.gov/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
2025-01-09 20:32:08 UTC	374	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:32:08 GMT Content-Type: text/css Content-Length: 673 Connection: close Cache-Control: public Expires: Fri, 09 Jan 2026 04:16:27 GMT Last-Modified: Wed, 25 Nov 2020 04:37:22 GMT X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains
2025-01-09 20:32:08 UTC	673	IN	Data Raw: ef bb bf 2e 61 6a 61 78 5f 5f 73 6c 69 64 65 72 5f 68 5f 72 61 69 6c 20 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 57 65 62 52 65 73 6f 75 72 63 65 2e 61 78 64 3f 64 3d 74 44 38 71 39 79 66 41 37 30 42 32 32 43 68 73 63 35 58 31 6d 43 53 34 33 56 30 69 74 56 53 57 42 75 62 32 61 59 41 73 49 73 58 50 6e 58 49 48 53 67 45 51 71 67 72 56 36 78 4e 78 35 45 35 65 43 51 55 61 48 49 52 69 6a 53 4b 77 50 6e 7a 78 35 36 67 63 68 7a 7a 32 43 2d 5a 30 4f 4a 44 75 6e 4f 35 47 48 38 2d 32 43 2d 59 5a 70 76 48 4d 58 6f 42 57 2d 74 77 70 41 55 76 4b 41 75 71 50 59 37 50 58 57 41 32 26 74 3d 36 33 37 34 31 38 35 37 38 34 32 30 30 30 30 30 30 30 29 20 72 65 70 65 61 74 2d 78 3b 68 65 69 67 68 74 3a 32 32 70 78 3b Data Ascii: .ajax__slider_h_rail {position:relative;background:url(WebResource.axd?d=tD8q9yfA70B22Chsc5X1mCS43V0itVSWBub2aYAsIsXPnXIHSgEQqgrV6xNx5E5eCQUaHIRijSKwPnzx56gchzz2C-Z0OJDunO5GH8-2C-YZpvHMXoBW-twpAUvKAuqPY7PXWA2&t=637418578420000000) repeat-x;height:22px;

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:32:08 UTC	738	OUT	GET /scripts/resizeResults.js HTTP/1.1 Host: sanctionssearch.ofac.treas.gov Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sanctionssearch.ofac.treas.gov/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
2025-01-09 20:32:08 UTC	344	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:32:08 GMT Content-Type: application/javascript Content-Length: 573 Connection: close Last-Modified: Wed, 25 Nov 2020 00:55:22 GMT Accept-Ranges: bytes ETag: "0b9fda6c5c2d61:0" X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains
2025-01-09 20:32:08 UTC	573	IN	Data Raw: ef bb bf 69 66 20 28 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 29 20 7b 0d 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 28 27 6f 6e 6c 6f 61 64 27 2c 20 72 65 73 69 7a 65 52 65 73 75 6c 74 73 29 3b 0d 0a 7d 20 65 6c 73 65 20 7b 0d 0a 20 20 20 20 69 66 20 28 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 76 61 72 20 63 20 3d 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3b 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 73 69 7a 65 52 65 73 75 6c 74 73 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 3b 0d 0a 20 20 20 20 7d 20 65 6c Data Ascii: if (window.attachEvent) { window.attachEvent('onload', resizeResults);} else { if (window.onload) { var c = window.onload; window.onload = function () { c(); resizeResults(); }; } el

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:32:08 UTC	845	OUT	GET /WebResource.axd?d=Ffy_MXmL-37QvvzdQkWz4etD9G5iSAnzWAM-R_TwamjRIKnMqQAicBA9pg7-Az8QOy66qpJM9Dsui5ACYqihYleqYak1&t=638628063619783110 HTTP/1.1 Host: sanctionssearch.ofac.treas.gov Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sanctionssearch.ofac.treas.gov/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
2025-01-09 20:32:09 UTC	392	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:32:08 GMT Content-Type: application/x-javascript Content-Length: 23063 Connection: close Cache-Control: public Expires: Fri, 09 Jan 2026 04:16:27 GMT Last-Modified: Wed, 25 Sep 2024 00:26:01 GMT X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains
2025-01-09 20:32:09 UTC	9287	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 50 6f 73 74 42 61 63 6b 4f 70 74 69 6f 6e 73 28 65 76 65 6e 74 54 61 72 67 65 74 2c 20 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 2c 20 76 61 6c 69 64 61 74 69 6f 6e 2c 20 76 61 6c 69 64 61 74 69 6f 6e 47 72 6f 75 70 2c 20 61 63 74 69 6f 6e 55 72 6c 2c 20 74 72 61 63 6b 46 6f 63 75 73 2c 20 63 6c 69 65 6e 74 53 75 62 6d 69 74 29 20 7b 0d 0a 20 20 20 20 74 68 69 73 2e 65 76 65 6e 74 54 61 72 67 65 74 20 3d 20 65 76 65 6e 74 54 61 72 67 65 74 3b 0d 0a 20 20 20 20 74 68 69 73 2e 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 20 3d 20 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 3b 0d 0a 20 20 20 20 74 68 69 73 2e 76 61 6c 69 64 61 74 69 6f 6e 20 3d 20 76 61 6c 69 64 61 74 69 6f 6e 3b 0d 0a 20 20 20 20 74 68 69 73 2e 76 61 6c Data Ascii: function WebForm_PostBackOptions(eventTarget, eventArgument, validation, validationGroup, actionUrl, trackFocus, clientSubmit) { this.eventTarget = eventTarget; this.eventArgument = eventArgument; this.validation = validation; this.val
2025-01-09 20:32:09 UTC	10864	IN	Data Raw: 74 42 79 49 64 28 63 61 6c 6c 62 61 63 6b 46 72 61 6d 65 49 44 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 78 6d 6c 52 65 71 75 65 73 74 46 72 61 6d 65 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 6d 6c 52 65 71 75 65 73 74 46 72 61 6d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 78 6d 6c 52 65 71 75 65 73 74 46 72 61 6d 65 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 57 65 62 46 6f 72 6d 5f 45 78 65 63 75 74 65 43 61 6c 6c 62 61 63 6b 28 63 61 6c 6c 62 61 63 6b 4f 62 6a 65 63 74 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 7d 0d 0a 7d 0d 0a 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 45 78 65 63 75 74 65 43 61 6c 6c 62 61 Data Ascii: tById(callbackFrameID); if (xmlRequestFrame) { xmlRequestFrame.parentNode.removeChild(xmlRequestFrame); } WebForm_ExecuteCallback(callbackObject); } }}function WebForm_ExecuteCallba
2025-01-09 20:32:09 UTC	2912	IN	Data Raw: 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 65 6c 65 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 74 61 67 4e 61 6d 65 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 65 6c 65 6d 65 6e 74 2e 61 6c 6c 20 26 26 20 65 6c 65 6d 65 6e 74 2e 61 6c 6c 2e 74 61 67 73 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 65 6c 65 6d 65 6e 74 2e 61 6c 6c 2e 74 61 67 73 28 74 61 67 4e 61 6d 65 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 0d 0a 7d 0d 0a 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 47 65 74 45 Data Ascii: ment.getElementsByTagName) { return element.getElementsByTagName(tagName); } if (element.all && element.all.tags) { return element.all.tags(tagName); } } return null;}function WebForm_GetE

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:32:08 UTC	867	OUT	GET /ScriptResource.axd?d=C3SCPT7cxW9L0JZEvulI3OCKCO4zdbGH12XO_XTiLtl7pu0lP_YZOYvC2eNk1mA1sGV3o3MvWT6YDrdHa-C1iXeNf53TXKDidCvGvPPs6Mne3tJb0&t=ffffffffec54f2d7 HTTP/1.1 Host: sanctionssearch.ofac.treas.gov Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sanctionssearch.ofac.treas.gov/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
2025-01-09 20:32:09 UTC	416	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:32:08 GMT Content-Type: application/x-javascript Content-Length: 27410 Connection: close Cache-Control: public Content-Encoding: gzip Expires: Fri, 09 Jan 2026 20:32:08 GMT Last-Modified: Thu, 09 Jan 2025 20:32:08 GMT X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains
2025-01-09 20:32:09 UTC	6503	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ac bd d9 72 1b 49 b2 28 f8 3e 66 f7 1f c4 3c 2a 16 b2 90 04 41 aa ba ba 1b 60 8a 97 22 b5 b0 4a 5b 4b aa ee ae 03 b2 69 b9 02 89 2d 41 2c 22 29 02 66 f3 29 f3 30 1f 30 ef f3 30 66 f7 53 e6 07 e6 17 c6 97 58 73 01 a9 73 ba ac 44 64 46 c6 1e 1e be 85 bb c7 ff f7 7f ff 3f fb fb 4f 1a 91 fb e4 b0 7d d0 7e 72 9a c7 c9 c7 71 72 fb e4 55 be 9a c6 c1 32 cb a7 ff e3 7f 6b a4 ab 69 84 8f 8d be 17 ba f7 5f 83 f9 93 dc 77 f2 70 98 44 4b c7 5b fa ce 22 59 5e 39 de d8 77 fe c3 f1 a6 be f3 d4 f1 46 90 b8 9c 67 d3 be e3 0d 7d a7 e5 78 03 df 79 e2 78 0b 28 36 9d 27 41 7c b7 58 06 cb 24 1a 04 d3 7e e2 78 13 df 19 e7 41 ec 78 77 be 73 45 9f ff b6 4a 56 f0 e1 16 de e3 7c f2 c9 48 9a fb 4e 32 9f e7 73 c7 8b fd 34 18 2f 12 ef 1a 2b 75 bc c0 9f ae Data Ascii: rI(>f<*A`"J[Ki-A,")f)000fSXssDdF?O}~rqrU2ki_wpDK["Y^9wFg}xyx(6'A\|X$~xAxwsEJV\|HN2s4/+u
2025-01-09 20:32:09 UTC	2760	IN	Data Raw: c3 bc 33 62 53 20 10 00 f7 da 74 a4 00 54 ff 3d f2 8d 81 df 66 47 02 4a 7c 85 6a 97 84 d3 83 bd e0 07 3a 12 08 8e da f0 ca 76 b1 c1 2d 50 83 a8 89 61 27 94 b3 15 30 b9 47 91 34 e4 8c 39 dc 87 72 63 0c 25 d8 dc d1 e1 77 1c a3 d9 f1 f4 1a 9d f6 0b e6 cc 41 4f 9e 22 a1 5c c0 99 0b 06 1d 9c af e8 1f 42 16 2f e3 24 b0 57 4e 85 73 69 f3 77 60 b3 2c 65 4e c1 bb 1c fd 3d 8f 7b 21 c8 43 97 9d a2 eb 0f 55 20 14 9f d5 36 d8 cb 90 5e 9f 73 63 71 52 1c 9f f6 67 96 a7 99 e2 0c ea 25 da ba 1b ca 2d da ba 72 6a d1 6d ad 6f ba ad f5 c9 6d cd 0c 83 62 5b 99 a4 6c 41 8e f6 1a d4 6f 3e f1 67 e0 59 86 f4 02 10 6b 91 2c d2 a7 05 c4 87 d0 59 50 5b 3a 66 d9 0c 9e 31 82 63 c1 3b 39 0d a7 19 34 1d d7 71 3b ec 3e c8 e1 3e 0a aa 3a c1 be 87 f4 d6 0d 60 86 10 ab 89 e6 02 33 14 8c 98 Data Ascii: 3bS tT=fGJ\|j:v-Pa'0G49rc%wAO"\B/$WNsiw`,eN={!CU 6^scqRg%-rjmomb[lAo>gYk,YP[:f1c;94q;>>:`3
2025-01-09 20:32:09 UTC	10864	IN	Data Raw: 62 3b f2 31 c5 91 66 e2 76 03 8d 07 18 61 ac ce c3 f8 6d ca 0b ba 2b 2c 48 e2 98 6a 37 31 5c 69 5e 4d ce a2 64 ee f2 ef e8 59 54 d5 af 4f a2 e9 c7 76 ae 60 5f a3 fa 65 1a 31 47 b2 7e ca dc 78 a8 ea c8 fb 2f 0e 8a c4 09 d8 a3 77 5e ec b5 5d 11 d6 a2 68 d7 82 97 bf dc 4b 9f 3a fc 28 d2 1e 1a ee 7f 07 04 e2 4b 0a ae 5c 61 0a 93 48 51 b2 ef db 7e 7e 32 5a 4c 9f 9c fd ee 2d a5 20 7d db da dd e4 bf 3e 85 d8 02 cd 61 2f bd 24 b3 4b 65 e2 aa c2 3c 55 1a e3 c4 e2 7c 26 7a 7e 07 7c bc 8a 05 a7 ec fe 50 38 35 47 71 c2 ac e0 f6 71 c4 ff 8e 71 24 3c fb 0a 6f 7f 07 2a b4 30 f7 af a2 33 0f 89 6a 12 83 17 04 1c 92 7e af 0a 81 54 3b 75 7c 5c 11 9f 93 a2 96 18 41 21 3e 3f ba a6 0a 6c 6e 54 56 68 a7 70 3d c7 83 3d e2 cb 35 ca 4d 6c a9 a7 ae 3f 5c 55 59 ac a8 1d 98 41 5d 58 Data Ascii: b;1fvam+,Hj71\i^MdYTOv`_e1G~x/w^]hK:(K\aHQ~~2ZL- }>a/$Ke<U\|&z~\|P85Gqqq$<o*03j~T;u\|\A!>?lnTVhp==5Ml?\UYA]X
2025-01-09 20:32:09 UTC	7283	IN	Data Raw: 63 d0 4f 44 e6 77 c1 14 5e e6 38 63 d2 4a 1d 7d 38 76 77 47 42 ec 35 5a 44 9d 58 6c 7c 31 1b 45 69 49 77 bd d4 4b e3 5b 45 57 37 6c 18 f8 fb 94 03 9c 98 6f 14 80 bd b4 37 ea bc 9a de 6a 6d 6d 66 b9 0f 57 e1 3f 97 b4 b9 13 3f 93 d4 75 70 34 e9 0e 64 14 87 a1 9f f5 06 8a fc 0f d9 8c 73 a8 09 e7 a6 aa 4a e5 3e 5d c0 67 36 3c 6f 45 69 cc 7e 5d b1 b7 3f 92 06 b4 6a e3 c3 80 42 72 61 cd 80 fa 1b 74 7d 53 20 09 68 5c 86 c4 e0 5d b2 1c e4 38 ab 09 86 94 92 e0 2d 98 21 d3 52 6b 52 bc 56 25 32 f9 c8 03 ed 79 3d f0 62 2f f4 46 7e 64 9c 20 2f 5e dc 7d 61 6e bf e1 fc e4 b8 de d0 1f 49 37 99 31 05 6e a0 b5 c1 5b 9b 13 98 2b 69 39 31 46 c7 93 11 5e 08 81 75 27 fe 70 ef a0 9b a0 5d 4b 22 ed 5a fa 3e e6 e9 e2 95 be 06 bb 34 50 7c cf 80 ac 2d fa 06 7b 23 62 b3 f7 95 6a 2c Data Ascii: cODw^8cJ}8vwGB5ZDXl\|1EiIwK[EW7lo7jmmfW??up4dsJ>]g6<oEi~]?jBrat}S h\]8-!RkRV%2y=b/F~d /^}anI71n[+i91F^u'p]K"Z>4P\|-{#bj,

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:32:08 UTC	889	OUT	GET /ScriptResource.axd?d=w6ZF-zq6tzm7FtC8jUZcwGF8VjfOGz8YmWrhTdSBnCpvKQhpTXLmNP-BDPjZEKO_7WAsEwrnG5z1iGuMjU840sjg1EjvFPeSkFcbvbVf46Gc5XmDH92hTGUK-OH4s8p0bj-aVg2&t=ffffffffec54f2d7 HTTP/1.1 Host: sanctionssearch.ofac.treas.gov Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sanctionssearch.ofac.treas.gov/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
2025-01-09 20:32:09 UTC	415	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:32:08 GMT Content-Type: application/x-javascript Content-Length: 9853 Connection: close Cache-Control: public Content-Encoding: gzip Expires: Fri, 09 Jan 2026 20:32:08 GMT Last-Modified: Thu, 09 Jan 2025 20:32:08 GMT X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains
2025-01-09 20:32:09 UTC	9264	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 7d d9 72 e3 48 92 e0 fb 98 cd 3f 50 d8 1a 16 b0 8a 42 29 7b 66 6d cd 88 42 a5 e9 ca 2e 55 67 66 a5 65 2a fb 30 b5 4c 16 00 82 24 44 10 a0 00 50 47 49 fc b2 7d d8 4f 9a 5f 18 f7 38 80 00 22 40 52 39 dd fb b4 2f 12 11 88 d3 dd c3 ef 08 fc e7 ff f9 bf 3f fe 38 72 63 6f f4 87 a3 37 47 a3 d3 22 61 9f 32 f6 38 7a 57 ac f3 84 d6 69 91 ff eb bf b8 d3 75 1e e3 4f d7 7b 56 3f 47 14 1e ee 69 39 aa 42 87 96 29 fd 61 9e 26 09 cb 1d b2 08 9d aa a6 f5 ba 72 c8 2d fc 5c 47 cb b4 76 c8 3c 74 42 87 cc 42 07 7a 65 d3 34 67 89 43 92 f0 87 37 64 1a 3a 0e 59 87 8e ea d7 21 65 e8 ac e8 8c bd 2f 68 92 e6 33 87 dc b5 cf d8 6a 15 3a 69 9e d6 29 cd d2 df d9 67 76 b7 66 15 f4 5f 84 0e cb 93 e6 31 0f 9d 88 cd d2 bc 29 58 c2 54 e2 32 5d c1 cf 0c aa 96 Data Ascii: }rH?PB){fmB.Ugfe*0L$DPGI}O_8"@R9/?8rco7G"a28zWiuO{V?Gi9B)a&r-\Gv<tBBze4gC7d:Y!e/h3j:i)gvf_1)XT2]
2025-01-09 20:32:09 UTC	589	IN	Data Raw: d4 b9 81 b7 df 87 d3 b7 88 22 7e e9 fb b3 1d b3 96 4f a4 ec e8 cd b3 4b 29 df f8 bc 89 bb 4d d8 79 7b 89 cf 2d b2 12 51 dd 85 d3 90 06 10 f3 af 25 54 ec 03 ab e7 05 9a 7d 8e 84 27 6a fc ad 7a b0 e5 b2 e1 bd 3a 6d 7b e2 f7 d1 9b f8 ee 50 d7 10 f6 77 40 65 eb 69 67 93 e5 7a db 81 b8 47 6f ed be f1 4c 7d 66 fb 57 95 35 7e d3 64 69 28 95 4f e4 02 6e 51 00 3d bb 2a f4 3a fd 74 88 9f 6d db 10 fd 0f 0f 7d e3 6e e8 7e 2f 68 fb 56 18 fc fa a0 49 77 0e 91 e5 d2 f2 e4 ae 66 29 0f e0 8d 00 2b ff 40 78 e9 b5 3f 9b be a5 07 df 51 20 74 c8 95 d3 78 48 3e 80 bc c9 c0 a0 ee 24 0e c3 f3 47 56 3f 14 e5 c2 b9 26 ea 23 0d 14 98 92 07 f0 fd d7 7f b9 04 fd b3 e9 1d 8f 53 56 2b b4 a9 bf d7 f1 f4 bd d8 99 7a b8 23 7c 76 fa f9 12 ce c4 91 8f a3 1a 9f 27 a3 bf af 8f 8e fe f0 bf 9f Data Ascii: "~OK)My{-Q%T}'jz:m{Pw@eigzGoL}fW5~di(OnQ=*:tm}n~/hVIwf)+@x?Q txH>$GV?&#SV+z#\|v'

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:32:08 UTC	999	OUT	GET /default.aspx?_TSM_HiddenField_=ctl00_ctl03_HiddenField&_TSM_CombinedScripts_=%3b%3bAjaxControlToolkit%2c+Version%3d3.5.40412.0%2c+Culture%3dneutral%2c+PublicKeyToken%3d28f01b0e84b6d53e%3aen-US%3a1547e793-5b7e-48fe-8490-03a375b13a33%3a475a4ef5%3a5546a2b%3ad2e10b12%3a497ef277%3aeffe2a26 HTTP/1.1 Host: sanctionssearch.ofac.treas.gov Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sanctionssearch.ofac.treas.gov/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
2025-01-09 20:32:09 UTC	392	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:32:09 GMT Content-Type: application/x-javascript Content-Length: 88989 Connection: close Cache-Control: public Expires: Fri, 09 Jan 2026 20:32:09 GMT Last-Modified: Thu, 02 Feb 2023 17:28:52 GMT X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains
2025-01-09 20:32:09 UTC	9287	IN	Data Raw: 2f 2f 53 54 41 52 54 20 43 6f 6d 6d 6f 6e 2e 43 6f 6d 6d 6f 6e 2e 6a 73 0d 0a 2f 2f 20 28 63 29 20 32 30 31 30 20 43 6f 64 65 50 6c 65 78 20 46 6f 75 6e 64 61 74 69 6f 6e 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 22 45 78 74 65 6e 64 65 64 43 6f 6d 6d 6f 6e 22 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 76 61 72 20 70 3d 22 57 61 74 65 72 6d 61 72 6b 43 68 61 6e 67 65 64 22 2c 6c 3d 22 68 69 64 64 65 6e 49 6e 70 75 74 54 6f 55 70 64 61 74 65 41 54 42 75 66 66 65 72 5f 43 6f 6d 6d 6f 6e 54 6f 6f 6c 6b 69 74 53 63 72 69 70 74 73 22 2c 67 3d 22 48 54 4d 4c 45 76 65 6e 74 73 22 2c 72 3d 22 6d 6f 75 73 65 6d 6f 76 65 22 2c 6b 3d 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 2c 6d 3d 22 55 49 45 76 65 6e 74 73 22 2c 6f 3d 22 64 69 73 70 6c 61 79 22 2c Data Ascii: //START Common.Common.js// (c) 2010 CodePlex Foundation(function(){var b="ExtendedCommon";function a(){var p="WatermarkChanged",l="hiddenInputToUpdateATBuffer_CommonToolkitScripts",g="HTMLEvents",r="mousemove",k="MouseEvents",m="UIEvents",o="display",
2025-01-09 20:32:09 UTC	8104	IN	Data Raw: 61 2e 73 75 62 73 74 72 28 61 2e 6c 65 6e 67 74 68 2d 62 2c 62 29 3b 65 6c 73 65 20 61 3d 61 2e 73 75 62 73 74 72 28 30 2c 62 29 3b 72 65 74 75 72 6e 20 61 7d 2c 5f 5f 44 4f 4d 45 76 65 6e 74 73 3a 7b 66 6f 63 75 73 69 6e 3a 7b 65 76 65 6e 74 47 72 6f 75 70 3a 6d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 63 29 7b 63 2e 69 6e 69 74 55 49 45 76 65 6e 74 28 22 66 6f 63 75 73 69 6e 22 2c 62 2c 61 2c 77 69 6e 64 6f 77 2c 31 29 7d 7d 2c 66 6f 63 75 73 6f 75 74 3a 7b 65 76 65 6e 74 47 72 6f 75 70 3a 6d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 63 29 7b 63 2e 69 6e 69 74 55 49 45 76 65 6e 74 28 22 66 6f 63 75 73 6f 75 74 22 2c 62 2c 61 2c 77 69 6e 64 6f 77 2c 31 29 7d 7d 2c 61 63 74 69 76 61 74 65 3a 7b 65 76 65 6e 74 47 72 6f 75 70 3a 6d 2c 69 6e 69 74 3a Data Ascii: a.substr(a.length-b,b);else a=a.substr(0,b);return a},__DOMEvents:{focusin:{eventGroup:m,init:function(c){c.initUIEvent("focusin",b,a,window,1)}},focusout:{eventGroup:m,init:function(c){c.initUIEvent("focusout",b,a,window,1)}},activate:{eventGroup:m,init:
2025-01-09 20:32:09 UTC	2760	IN	Data Raw: 75 6c 74 75 72 65 49 6e 66 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 67 65 74 41 62 62 72 4d 6f 6e 74 68 49 6e 64 65 78 29 7b 53 79 73 2e 43 75 6c 74 75 72 65 49 6e 66 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 67 65 74 41 62 62 72 4d 6f 6e 74 68 49 6e 64 65 78 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 61 3d 74 68 69 73 3b 69 66 28 21 61 2e 5f 75 70 70 65 72 41 62 62 72 4d 6f 6e 74 68 73 29 61 2e 5f 75 70 70 65 72 41 62 62 72 4d 6f 6e 74 68 73 3d 61 2e 5f 74 6f 55 70 70 65 72 41 72 72 61 79 28 61 2e 64 61 74 65 54 69 6d 65 46 6f 72 6d 61 74 2e 41 62 62 72 65 76 69 61 74 65 64 4d 6f 6e 74 68 4e 61 6d 65 73 29 3b 72 65 74 75 72 6e 20 41 72 72 61 79 2e 69 6e 64 65 78 4f 66 28 61 2e 5f 75 70 70 65 72 41 62 62 72 4d 6f 6e 74 68 73 2c 61 2e 5f 74 6f 55 70 70 Data Ascii: ultureInfo.prototype._getAbbrMonthIndex){Sys.CultureInfo.prototype._getAbbrMonthIndex=function(b){var a=this;if(!a._upperAbbrMonths)a._upperAbbrMonths=a._toUpperArray(a.dateTimeFormat.AbbreviatedMonthNames);return Array.indexOf(a._upperAbbrMonths,a._toUpp
2025-01-09 20:32:09 UTC	12239	IN	Data Raw: 2c 71 3d 22 68 65 69 67 68 74 22 2c 70 3d 22 77 69 64 74 68 22 2c 67 3d 22 6f 6e 45 6e 64 22 2c 64 3d 22 6f 6e 53 74 61 72 74 22 2c 69 3d 22 61 6e 69 6d 61 74 69 6f 6e 73 22 2c 6f 3d 22 73 74 65 70 22 2c 6e 3d 22 65 6e 64 65 64 22 2c 6d 3d 22 73 74 61 72 74 65 64 22 2c 73 3d 22 70 65 72 63 65 6e 74 43 6f 6d 70 6c 65 74 65 22 2c 72 3d 22 69 73 41 63 74 69 76 65 22 2c 66 3d 22 69 73 50 6c 61 79 69 6e 67 22 2c 65 3d 31 30 30 2c 62 3d 66 61 6c 73 65 2c 63 3d 74 72 75 65 2c 6c 3d 22 64 69 73 70 6f 73 65 22 2c 61 3d 6e 75 6c 6c 3b 54 79 70 65 2e 72 65 67 69 73 74 65 72 4e 61 6d 65 73 70 61 63 65 28 22 53 79 73 2e 45 78 74 65 6e 64 65 64 2e 55 49 2e 41 6e 69 6d 61 74 69 6f 6e 22 29 3b 24 41 41 3d 53 79 73 2e 45 78 74 65 6e 64 65 64 2e 55 49 2e 41 6e 69 6d 61 74 Data Ascii: ,q="height",p="width",g="onEnd",d="onStart",i="animations",o="step",n="ended",m="started",s="percentComplete",r="isActive",f="isPlaying",e=100,b=false,c=true,l="dispose",a=null;Type.registerNamespace("Sys.Extended.UI.Animation");$AA=Sys.Extended.UI.Animat
2025-01-09 20:32:09 UTC	24	IN	Data Raw: 69 6d 61 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 63 2c 65 2c 62 Data Ascii: imation=function(d,c,e,b
2025-01-09 20:32:09 UTC	16384	IN	Data Raw: 2c 61 29 7b 24 41 41 2e 43 61 73 65 41 6e 69 6d 61 74 69 6f 6e 2e 69 6e 69 74 69 61 6c 69 7a 65 42 61 73 65 28 74 68 69 73 2c 5b 64 2c 63 2c 65 2c 62 5d 29 3b 74 68 69 73 2e 5f 73 65 6c 65 63 74 53 63 72 69 70 74 3d 61 7d 3b 24 41 41 2e 43 61 73 65 41 6e 69 6d 61 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 67 65 74 53 65 6c 65 63 74 65 64 49 6e 64 65 78 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 2d 31 3b 69 66 28 74 68 69 73 2e 5f 73 65 6c 65 63 74 53 63 72 69 70 74 26 26 74 68 69 73 2e 5f 73 65 6c 65 63 74 53 63 72 69 70 74 2e 6c 65 6e 67 74 68 3e 30 29 74 72 79 7b 76 61 72 20 62 3d 65 76 61 6c 28 74 68 69 73 2e 5f 73 65 6c 65 63 74 53 63 72 69 70 74 29 3b 69 66 28 62 21 3d 3d 75 6e 64 65 66 69 6e 65 64 29 61 3d 62 7d 63 61 74 63 68 28 63 Data Ascii: ,a){$AA.CaseAnimation.initializeBase(this,[d,c,e,b]);this._selectScript=a};$AA.CaseAnimation.prototype={getSelectedIndex:function(){var a=-1;if(this._selectScript&&this._selectScript.length>0)try{var b=eval(this._selectScript);if(b!==undefined)a=b}catch(c
2025-01-09 20:32:09 UTC	1380	IN	Data Raw: 65 41 63 74 69 6f 6e 22 2c 24 41 41 2e 41 63 74 69 6f 6e 29 3b 24 41 41 2e 72 65 67 69 73 74 65 72 41 6e 69 6d 61 74 69 6f 6e 28 22 65 6e 61 62 6c 65 41 63 74 69 6f 6e 22 2c 24 41 41 2e 45 6e 61 62 6c 65 41 63 74 69 6f 6e 29 3b 24 41 41 2e 48 69 64 65 41 63 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 61 2c 64 2c 62 29 7b 24 41 41 2e 48 69 64 65 41 63 74 69 6f 6e 2e 69 6e 69 74 69 61 6c 69 7a 65 42 61 73 65 28 74 68 69 73 2c 5b 63 2c 61 2c 64 5d 29 3b 74 68 69 73 2e 5f 76 69 73 69 62 6c 65 3d 62 7d 3b 24 41 41 2e 48 69 64 65 41 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 64 6f 41 63 74 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 69 73 2e 67 65 74 5f 74 61 72 67 65 74 28 29 3b 61 26 26 24 63 6f 6d 6d 6f 6e 2e 73 65 74 56 Data Ascii: eAction",$AA.Action);$AA.registerAnimation("enableAction",$AA.EnableAction);$AA.HideAction=function(c,a,d,b){$AA.HideAction.initializeBase(this,[c,a,d]);this._visible=b};$AA.HideAction.prototype={doAction:function(){var a=this.get_target();a&&$common.setV
2025-01-09 20:32:09 UTC	5520	IN	Data Raw: 74 28 29 3b 61 26 26 24 63 6f 6d 6d 6f 6e 2e 73 65 74 45 6c 65 6d 65 6e 74 4f 70 61 63 69 74 79 28 61 2c 74 68 69 73 2e 5f 6f 70 61 63 69 74 79 29 7d 2c 67 65 74 5f 6f 70 61 63 69 74 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 6f 70 61 63 69 74 79 7d 2c 73 65 74 5f 6f 70 61 63 69 74 79 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 61 3d 74 68 69 73 3b 62 3d 61 2e 5f 67 65 74 46 6c 6f 61 74 28 62 29 3b 69 66 28 61 2e 5f 6f 70 61 63 69 74 79 21 3d 62 29 7b 61 2e 5f 6f 70 61 63 69 74 79 3d 62 3b 61 2e 72 61 69 73 65 50 72 6f 70 65 72 74 79 43 68 61 6e 67 65 64 28 22 6f 70 61 63 69 74 79 22 29 7d 7d 7d 3b 24 41 41 2e 4f 70 61 63 69 74 79 41 63 74 69 6f 6e 2e 72 65 67 69 73 74 65 72 43 6c 61 73 73 28 22 53 79 73 2e 45 78 Data Ascii: t();a&&$common.setElementOpacity(a,this._opacity)},get_opacity:function(){return this._opacity},set_opacity:function(b){var a=this;b=a._getFloat(b);if(a._opacity!=b){a._opacity=b;a.raisePropertyChanged("opacity")}}};$AA.OpacityAction.registerClass("Sys.Ex
2025-01-09 20:32:09 UTC	16384	IN	Data Raw: 63 74 69 6f 6e 2e 63 72 65 61 74 65 44 65 6c 65 67 61 74 65 28 61 2c 61 2e 5f 6f 6e 44 72 61 67 53 74 61 72 74 29 3b 61 2e 5f 6d 6f 75 73 65 4d 6f 76 65 48 61 6e 64 6c 65 72 3d 46 75 6e 63 74 69 6f 6e 2e 63 72 65 61 74 65 44 65 6c 65 67 61 74 65 28 61 2c 61 2e 5f 6f 6e 4d 6f 75 73 65 4d 6f 76 65 29 3b 61 2e 5f 64 72 61 67 45 6e 74 65 72 48 61 6e 64 6c 65 72 3d 46 75 6e 63 74 69 6f 6e 2e 63 72 65 61 74 65 44 65 6c 65 67 61 74 65 28 61 2c 61 2e 5f 6f 6e 44 72 61 67 45 6e 74 65 72 29 3b 61 2e 5f 64 72 61 67 4c 65 61 76 65 48 61 6e 64 6c 65 72 3d 46 75 6e 63 74 69 6f 6e 2e 63 72 65 61 74 65 44 65 6c 65 67 61 74 65 28 61 2c 61 2e 5f 6f 6e 44 72 61 67 4c 65 61 76 65 29 3b 61 2e 5f 64 72 61 67 4f 76 65 72 48 61 6e 64 6c 65 72 3d 46 75 6e 63 74 69 6f 6e 2e 63 72 Data Ascii: ction.createDelegate(a,a._onDragStart);a._mouseMoveHandler=Function.createDelegate(a,a._onMouseMove);a._dragEnterHandler=Function.createDelegate(a,a._onDragEnter);a._dragLeaveHandler=Function.createDelegate(a,a._onDragLeave);a._dragOverHandler=Function.cr
2025-01-09 20:32:09 UTC	9484	IN	Data Raw: 4d 65 74 68 6f 64 29 7b 62 2e 5f 64 79 6e 61 6d 69 63 50 6f 70 75 6c 61 74 65 42 65 68 61 76 69 6f 72 3d 24 63 72 65 61 74 65 28 53 79 73 2e 45 78 74 65 6e 64 65 64 2e 55 49 2e 44 79 6e 61 6d 69 63 50 6f 70 75 6c 61 74 65 42 65 68 61 76 69 6f 72 2c 7b 69 64 3a 62 2e 67 65 74 5f 69 64 28 29 2b 22 5f 44 79 6e 61 6d 69 63 50 6f 70 75 6c 61 74 65 42 65 68 61 76 69 6f 72 22 2c 43 6f 6e 74 65 78 74 4b 65 79 3a 62 2e 5f 44 79 6e 61 6d 69 63 43 6f 6e 74 65 78 74 4b 65 79 2c 53 65 72 76 69 63 65 50 61 74 68 3a 62 2e 5f 44 79 6e 61 6d 69 63 53 65 72 76 69 63 65 50 61 74 68 2c 53 65 72 76 69 63 65 4d 65 74 68 6f 64 3a 62 2e 5f 44 79 6e 61 6d 69 63 53 65 72 76 69 63 65 4d 65 74 68 6f 64 2c 63 61 63 68 65 44 79 6e 61 6d 69 63 52 65 73 75 6c 74 73 3a 62 2e 5f 63 61 63 Data Ascii: Method){b._dynamicPopulateBehavior=$create(Sys.Extended.UI.DynamicPopulateBehavior,{id:b.get_id()+"_DynamicPopulateBehavior",ContextKey:b._DynamicContextKey,ServicePath:b._DynamicServicePath,ServiceMethod:b._DynamicServiceMethod,cacheDynamicResults:b._cac

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:32:09 UTC	889	OUT	GET /ScriptResource.axd?d=SyIOILT-Mwsboa35foPtI49PZ_mO0xwpYyMS2rv26r7B3x5MNl6GrBLmxkvGFCNyqfj9_W4I-8X9xNk-BBAr9ZGtHLesOC9Wh3A8ZDWDXaAlXpu2zMNkhis7BUpb8Ljt6Wn0tA2&t=ffffffffec54f2d7 HTTP/1.1 Host: sanctionssearch.ofac.treas.gov Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sanctionssearch.ofac.treas.gov/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
2025-01-09 20:32:09 UTC	398	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:32:09 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 16439 Connection: close Cache-Control: public Expires: Fri, 09 Jan 2026 20:32:09 GMT Last-Modified: Thu, 09 Jan 2025 20:32:09 GMT X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains
2025-01-09 20:32:09 UTC	3761	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 22 45 78 74 65 6e 64 65 64 53 6c 69 64 65 72 22 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 76 61 72 20 6d 3d 22 76 61 6c 75 65 43 68 61 6e 67 65 64 22 2c 6c 3d 22 73 6c 69 64 65 53 74 61 72 74 22 2c 6b 3d 22 73 6c 69 64 65 45 6e 64 22 2c 6f 3d 22 73 65 6c 65 63 74 73 74 61 72 74 22 2c 6e 3d 22 6b 65 79 70 72 65 73 73 22 2c 6a 3d 22 63 68 61 6e 67 65 22 2c 69 3d 22 49 4e 50 55 54 22 2c 68 3d 22 73 6c 69 64 65 72 49 6e 69 74 69 61 6c 69 7a 65 64 22 2c 65 3d 22 31 70 78 22 2c 64 3d 22 30 70 78 22 2c 67 3d 22 61 62 73 6f 6c 75 74 65 22 2c 66 3d 22 68 69 64 64 65 6e 22 2c 62 3d 74 72 75 65 2c 63 3d 66 61 6c 73 65 2c 61 3d 6e 75 6c 6c 3b 54 79 70 65 2e 72 65 67 69 73 74 65 72 4e 61 6d 65 73 70 61 63 65 28 22 Data Ascii: (function(){var b="ExtendedSlider";function a(){var m="valueChanged",l="slideStart",k="slideEnd",o="selectstart",n="keypress",j="change",i="INPUT",h="sliderInitialized",e="1px",d="0px",g="absolute",f="hidden",b=true,c=false,a=null;Type.registerNamespace("
2025-01-09 20:32:09 UTC	4140	IN	Data Raw: 6e 74 28 29 3b 61 2e 5f 69 6e 69 74 69 61 6c 69 7a 65 53 6c 69 64 65 72 28 29 7d 2c 5f 65 6e 66 6f 72 63 65 54 65 78 74 42 6f 78 45 6c 65 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 74 68 69 73 2c 61 3d 7b 70 6f 73 69 74 69 6f 6e 3a 62 2e 67 65 74 5f 65 6c 65 6d 65 6e 74 28 29 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 2c 74 6f 70 3a 62 2e 67 65 74 5f 65 6c 65 6d 65 6e 74 28 29 2e 73 74 79 6c 65 2e 74 6f 70 2c 72 69 67 68 74 3a 62 2e 67 65 74 5f 65 6c 65 6d 65 6e 74 28 29 2e 73 74 79 6c 65 2e 72 69 67 68 74 2c 62 6f 74 74 6f 6d 3a 62 2e 67 65 74 5f 65 6c 65 6d 65 6e 74 28 29 2e 73 74 79 6c 65 2e 62 6f 74 74 6f 6d 2c 6c 65 66 74 3a 62 2e 67 65 74 5f 65 6c 65 6d 65 6e 74 28 29 2e 73 74 79 6c 65 2e 6c Data Ascii: nt();a._initializeSlider()},_enforceTextBoxElementPositioning:function(){var b=this,a={position:b.get_element().style.position,top:b.get_element().style.top,right:b.get_element().style.right,bottom:b.get_element().style.bottom,left:b.get_element().style.l
2025-01-09 20:32:09 UTC	1380	IN	Data Raw: 28 29 7b 76 61 72 20 61 3d 74 68 69 73 3b 61 2e 5f 73 65 6c 65 63 74 73 74 61 72 74 48 61 6e 64 6c 65 72 3d 46 75 6e 63 74 69 6f 6e 2e 63 72 65 61 74 65 44 65 6c 65 67 61 74 65 28 61 2c 61 2e 5f 6f 6e 53 65 6c 65 63 74 53 74 61 72 74 29 3b 61 2e 5f 6d 6f 75 73 65 75 70 48 61 6e 64 6c 65 72 3d 46 75 6e 63 74 69 6f 6e 2e 63 72 65 61 74 65 44 65 6c 65 67 61 74 65 28 61 2c 61 2e 5f 6f 6e 4d 6f 75 73 65 55 70 29 3b 61 2e 5f 6b 65 79 44 6f 77 6e 48 61 6e 64 6c 65 72 3d 46 75 6e 63 74 69 6f 6e 2e 63 72 65 61 74 65 44 65 6c 65 67 61 74 65 28 61 2c 61 2e 5f 6f 6e 4b 65 79 44 6f 77 6e 29 3b 24 61 64 64 48 61 6e 64 6c 65 72 28 64 6f 63 75 6d 65 6e 74 2c 22 6d 6f 75 73 65 75 70 22 2c 61 2e 5f 6d 6f 75 73 65 75 70 48 61 6e 64 6c 65 72 29 3b 24 61 64 64 48 61 6e 64 6c Data Ascii: (){var a=this;a._selectstartHandler=Function.createDelegate(a,a._onSelectStart);a._mouseupHandler=Function.createDelegate(a,a._onMouseUp);a._keyDownHandler=Function.createDelegate(a,a._onKeyDown);$addHandler(document,"mouseup",a._mouseupHandler);$addHandl
2025-01-09 20:32:09 UTC	7158	IN	Data Raw: 79 44 6f 77 6e 3a 66 75 6e 63 74 69 6f 6e 28 64 29 7b 69 66 28 74 68 69 73 2e 5f 65 6e 61 62 6c 65 4b 65 79 62 6f 61 72 64 29 7b 76 61 72 20 61 3d 6e 65 77 20 53 79 73 2e 55 49 2e 44 6f 6d 45 76 65 6e 74 28 64 29 3b 73 77 69 74 63 68 28 61 2e 6b 65 79 43 6f 64 65 7c 7c 61 2e 72 61 77 45 76 65 6e 74 2e 6b 65 79 43 6f 64 65 29 7b 63 61 73 65 20 53 79 73 2e 55 49 2e 4b 65 79 2e 75 70 3a 63 61 73 65 20 53 79 73 2e 55 49 2e 4b 65 79 2e 6c 65 66 74 3a 74 68 69 73 2e 5f 68 61 6e 64 6c 65 53 6c 69 64 65 28 62 29 3b 61 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 72 65 74 75 72 6e 3b 63 61 73 65 20 53 79 73 2e 55 49 2e 4b 65 79 2e 64 6f 77 6e 3a 63 61 73 65 20 53 79 73 2e 55 49 2e 4b 65 79 2e 72 69 67 68 74 3a 74 68 69 73 2e 5f 68 61 6e 64 6c 65 53 6c 69 Data Ascii: yDown:function(d){if(this._enableKeyboard){var a=new Sys.UI.DomEvent(d);switch(a.keyCode\|\|a.rawEvent.keyCode){case Sys.UI.Key.up:case Sys.UI.Key.left:this._handleSlide(b);a.preventDefault();return;case Sys.UI.Key.down:case Sys.UI.Key.right:this._handleSli

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:32:09 UTC	809	OUT	GET /images/Background.png HTTP/1.1 Host: sanctionssearch.ofac.treas.gov Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sanctionssearch.ofac.treas.gov/css/global.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
2025-01-09 20:32:09 UTC	332	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:32:09 GMT Content-Type: image/png Content-Length: 11123 Connection: close Last-Modified: Wed, 25 Nov 2020 04:55:22 GMT Accept-Ranges: bytes ETag: "059f2ee7c2d61:0" X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains
2025-01-09 20:32:09 UTC	5207	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 b0 00 00 05 ab 08 06 00 00 00 24 47 4a 23 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 0d d7 00 00 0d d7 01 42 28 9b 78 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 9b ee 3c 1a 00 00 20 00 49 44 41 54 78 9c ec dd 4b 6e db 56 18 80 51 5e da ee 63 39 dd 4c 27 9d 76 d6 f5 74 d6 15 74 13 5d 42 b6 d2 91 10 04 a9 d8 41 14 5b 62 e4 f8 11 5b fa 14 9f 33 48 74 49 d1 66 90 38 80 3f 5c f3 1f 9b f7 9b 9b 69 9a 7e 9d a6 e9 f7 69 9a 7e 99 00 00 00 00 e0 fc de 4d d3 f4 d7 34 4d 7f 8f cd fb cd 6f d3 34 fd 79 e6 1b 02 00 00 00 80 63 fe 18 9b f7 9b 7f 26 3b af 00 00 00 00 68 7a 37 36 ef 37 ff 9e fb 2e 00 00 00 00 e0 3e f3 b9 6f 00 Data Ascii: PNGIHDR$GJ#sBIT\|dpHYsB(xtEXtSoftwarewww.inkscape.org< IDATxKnVQ^c9L'vtt]BA[b[3HtIf8?\i~i~M4Mo4yc&;hz767.>o
2025-01-09 20:32:09 UTC	4140	IN	Data Raw: 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 a4 09 58 00 00 00 00 Data Ascii: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
2025-01-09 20:32:09 UTC	1776	IN	Data Raw: b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 00 00 48 13 b0 00 00 Data Ascii: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:32:09 UTC	654	OUT	GET /WebResource.axd?d=Ffy_MXmL-37QvvzdQkWz4etD9G5iSAnzWAM-R_TwamjRIKnMqQAicBA9pg7-Az8QOy66qpJM9Dsui5ACYqihYleqYak1&t=638628063619783110 HTTP/1.1 Host: sanctionssearch.ofac.treas.gov Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
2025-01-09 20:32:10 UTC	392	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:32:09 GMT Content-Type: application/x-javascript Content-Length: 23063 Connection: close Cache-Control: public Expires: Thu, 08 Jan 2026 16:51:32 GMT Last-Modified: Wed, 25 Sep 2024 00:26:01 GMT X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains
2025-01-09 20:32:10 UTC	1007	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 50 6f 73 74 42 61 63 6b 4f 70 74 69 6f 6e 73 28 65 76 65 6e 74 54 61 72 67 65 74 2c 20 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 2c 20 76 61 6c 69 64 61 74 69 6f 6e 2c 20 76 61 6c 69 64 61 74 69 6f 6e 47 72 6f 75 70 2c 20 61 63 74 69 6f 6e 55 72 6c 2c 20 74 72 61 63 6b 46 6f 63 75 73 2c 20 63 6c 69 65 6e 74 53 75 62 6d 69 74 29 20 7b 0d 0a 20 20 20 20 74 68 69 73 2e 65 76 65 6e 74 54 61 72 67 65 74 20 3d 20 65 76 65 6e 74 54 61 72 67 65 74 3b 0d 0a 20 20 20 20 74 68 69 73 2e 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 20 3d 20 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 3b 0d 0a 20 20 20 20 74 68 69 73 2e 76 61 6c 69 64 61 74 69 6f 6e 20 3d 20 76 61 6c 69 64 61 74 69 6f 6e 3b 0d 0a 20 20 20 20 74 68 69 73 2e 76 61 6c Data Ascii: function WebForm_PostBackOptions(eventTarget, eventArgument, validation, validationGroup, actionUrl, trackFocus, clientSubmit) { this.eventTarget = eventTarget; this.eventArgument = eventArgument; this.validation = validation; this.val
2025-01-09 20:32:10 UTC	4140	IN	Data Raw: 6f 63 75 73 29 20 21 3d 20 22 75 6e 64 65 66 69 6e 65 64 22 29 20 26 26 20 28 6c 61 73 74 46 6f 63 75 73 20 21 3d 20 6e 75 6c 6c 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 74 79 70 65 6f 66 28 64 6f 63 75 6d 65 6e 74 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 29 20 3d 3d 20 22 75 6e 64 65 66 69 6e 65 64 22 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 61 73 74 46 6f 63 75 73 2e 76 61 6c 75 65 20 3d 20 6f 70 74 69 6f 6e 73 2e 65 76 65 6e 74 54 61 72 67 65 74 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 6c 73 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 61 63 74 69 76 65 20 3d 20 Data Ascii: ocus) != "undefined") && (lastFocus != null)) { if (typeof(document.activeElement) == "undefined") { lastFocus.value = options.eventTarget; } else { var active =
2025-01-09 20:32:10 UTC	1380	IN	Data Raw: 72 20 63 61 6c 6c 62 61 63 6b 46 72 61 6d 65 49 44 20 3d 20 22 5f 5f 43 41 4c 4c 42 41 43 4b 46 52 41 4d 45 22 20 2b 20 63 61 6c 6c 62 61 63 6b 49 6e 64 65 78 3b 0d 0a 20 20 20 20 76 61 72 20 78 6d 6c 52 65 71 75 65 73 74 46 72 61 6d 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 61 6d 65 73 5b 63 61 6c 6c 62 61 63 6b 46 72 61 6d 65 49 44 5d 3b 0d 0a 20 20 20 20 69 66 20 28 21 78 6d 6c 52 65 71 75 65 73 74 46 72 61 6d 65 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 78 6d 6c 52 65 71 75 65 73 74 46 72 61 6d 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 49 46 52 41 4d 45 22 29 3b 0d 0a 20 20 20 20 20 20 20 20 78 6d 6c 52 65 71 75 65 73 74 46 72 61 6d 65 2e 77 69 64 74 68 20 3d 20 22 31 22 3b 0d 0a 20 20 20 20 20 20 20 20 78 6d Data Ascii: r callbackFrameID = "__CALLBACKFRAME" + callbackIndex; var xmlRequestFrame = document.frames[callbackFrameID]; if (!xmlRequestFrame) { xmlRequestFrame = document.createElement("IFRAME"); xmlRequestFrame.width = "1"; xm
2025-01-09 20:32:10 UTC	1380	IN	Data Raw: 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 63 6f 75 6e 74 20 3d 20 5f 5f 74 68 65 46 6f 72 6d 50 6f 73 74 43 6f 6c 6c 65 63 74 69 6f 6e 2e 6c 65 6e 67 74 68 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 65 6c 65 6d 65 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 3d 20 30 3b 20 69 20 3c 20 63 6f 75 6e 74 3b 20 69 2b 2b 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 6c 65 6d 65 6e 74 20 3d 20 5f 5f 74 68 65 46 6f 72 6d 50 6f 73 74 43 6f 6c 6c 65 63 74 69 6f 6e 5b 69 5d 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 65 6c 65 6d 65 6e 74 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 66 69 65 6c 64 45 6c 65 6d 65 6e 74 Data Ascii: var count = __theFormPostCollection.length; var element; for (var i = 0; i < count; i++) { element = __theFormPostCollection[i]; if (element) { var fieldElement
2025-01-09 20:32:10 UTC	1380	IN	Data Raw: 6f 6e 46 69 65 6c 64 45 6c 65 6d 65 6e 74 20 3d 20 78 6d 6c 52 65 71 75 65 73 74 46 72 61 6d 65 2e 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 49 4e 50 55 54 22 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 6c 6c 62 61 63 6b 56 61 6c 69 64 61 74 69 6f 6e 46 69 65 6c 64 45 6c 65 6d 65 6e 74 2e 74 79 70 65 20 3d 20 22 68 69 64 64 65 6e 22 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 6c 6c 62 61 63 6b 56 61 6c 69 64 61 74 69 6f 6e 46 69 65 6c 64 45 6c 65 6d 65 6e 74 2e 6e 61 6d 65 20 3d 20 22 5f 5f 45 56 45 4e 54 56 41 4c 49 44 41 54 49 4f 4e 22 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 6c 6c 62 61 63 6b 56 61 6c 69 64 61 74 69 6f 6e 46 69 65 6c 64 45 6c 65 6d 65 6e 74 2e Data Ascii: onFieldElement = xmlRequestFrame.document.createElement("INPUT"); callbackValidationFieldElement.type = "hidden"; callbackValidationFieldElement.name = "__EVENTVALIDATION"; callbackValidationFieldElement.
2025-01-09 20:32:10 UTC	10864	IN	Data Raw: 74 42 79 49 64 28 63 61 6c 6c 62 61 63 6b 46 72 61 6d 65 49 44 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 78 6d 6c 52 65 71 75 65 73 74 46 72 61 6d 65 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 6d 6c 52 65 71 75 65 73 74 46 72 61 6d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 78 6d 6c 52 65 71 75 65 73 74 46 72 61 6d 65 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 57 65 62 46 6f 72 6d 5f 45 78 65 63 75 74 65 43 61 6c 6c 62 61 63 6b 28 63 61 6c 6c 62 61 63 6b 4f 62 6a 65 63 74 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 7d 0d 0a 7d 0d 0a 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 45 78 65 63 75 74 65 43 61 6c 6c 62 61 Data Ascii: tById(callbackFrameID); if (xmlRequestFrame) { xmlRequestFrame.parentNode.removeChild(xmlRequestFrame); } WebForm_ExecuteCallback(callbackObject); } }}function WebForm_ExecuteCallba
2025-01-09 20:32:10 UTC	1380	IN	Data Raw: 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 65 6c 65 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 74 61 67 4e 61 6d 65 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 65 6c 65 6d 65 6e 74 2e 61 6c 6c 20 26 26 20 65 6c 65 6d 65 6e 74 2e 61 6c 6c 2e 74 61 67 73 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 65 6c 65 6d 65 6e 74 2e 61 6c 6c 2e 74 61 67 73 28 74 61 67 4e 61 6d 65 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 0d 0a 7d 0d 0a 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 47 65 74 45 Data Ascii: ment.getElementsByTagName) { return element.getElementsByTagName(tagName); } if (element.all && element.all.tags) { return element.all.tags(tagName); } } return null;}function WebForm_GetE
2025-01-09 20:32:10 UTC	1532	IN	Data Raw: 20 20 20 20 65 6c 73 65 20 69 66 20 28 65 6c 65 6d 65 6e 74 2e 6c 65 66 74 20 26 26 20 65 6c 65 6d 65 6e 74 2e 74 6f 70 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 73 75 6c 74 2e 78 20 3d 20 65 6c 65 6d 65 6e 74 2e 6c 65 66 74 3b 0d 0a 20 20 20 20 20 20 20 20 72 65 73 75 6c 74 2e 79 20 3d 20 65 6c 65 6d 65 6e 74 2e 74 6f 70 3b 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 65 6c 73 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 65 6c 65 6d 65 6e 74 2e 78 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 73 75 6c 74 2e 78 20 3d 20 65 6c 65 6d 65 6e 74 2e 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 65 6c 65 6d 65 6e 74 2e 79 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 73 75 6c 74 2e 79 20 3d 20 65 6c 65 Data Ascii: else if (element.left && element.top) { result.x = element.left; result.y = element.top; } else { if (element.x) { result.x = element.x; } if (element.y) { result.y = ele

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:32:10 UTC	1122	OUT	GET /WebResource.axd?d=tD8q9yfA70B22Chsc5X1mCS43V0itVSWBub2aYAsIsXPnXIHSgEQqgrV6xNx5E5eCQUaHIRijSKwPnzx56gchzz2C-Z0OJDunO5GH8-2C-YZpvHMXoBW-twpAUvKAuqPY7PXWA2&t=637418578420000000 HTTP/1.1 Host: sanctionssearch.ofac.treas.gov Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sanctionssearch.ofac.treas.gov/WebResource.axd?d=iYXJJpU9my9xzhYp_OtAutrOkLPdguC-zMsLLBgxNdyJFKYEfeu4j-lm2zWq_LQPrz5Pd7C0AyOo0YqPeqA0n7EyTg5oPbzMwN7_yNEsfX0ticwfmtYaQelHMfpxan7vuW1JUA2&t=637418434420000000 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ASP.NET_SessionId=45vhuq1gus4r5bnqskqfafnu; BIGipServerEzM5bUtMV5dP4OkrzH904A=!7bNr9aJSZmT0aZG+T0s9tzEcVdNrwES9tCUJBYfTqHBZXgRuYX3CN8Fw7VrOJ3wzVe+3Zdv+IeBIQw==
2025-01-09 20:32:10 UTC	372	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:32:10 GMT Content-Type: img/gif Content-Length: 53 Connection: close Cache-Control: public Expires: Fri, 09 Jan 2026 02:38:37 GMT Last-Modified: Wed, 25 Nov 2020 00:37:22 GMT X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains
2025-01-09 20:32:10 UTC	53	IN	Data Raw: 47 49 46 38 39 61 01 00 16 00 91 00 00 b3 b6 b3 f0 ed e0 ff ff ff 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 16 00 00 02 06 94 7f 10 81 2d 05 00 3b Data Ascii: GIF89a!,-;