34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 51:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4af,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample 24d18c38acc8… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample 24d18c38acc8…. Threat score 0/100. 0/6 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/24d18c38acc8e2d78db277df695f9b6cb96d35d5f0aede01783704a1e7a01cd7","keywords":["malware analysis","sandbox report","threat intelligence","24d18c38acc8e2d78db277df695f9b6cb96d35d5f0aede01783704a1e7a01cd7"],"about":{"@type":"SoftwareApplication","name":"https://clicks.customeremail.microsoftrewards.com/CL0/https://go.microsoft.com/fwlink/%3FLinkId=2383438\u0026lid=s8g2bmq5y78v/1/010001a1c190f402-dc30cb16-6aed-4db1-b4bc-0fd9fac669ee-000000/tEp41RVpLp6b1R3w1i7tizj6IXIHsYJodYSrSMZ80Cw=452","applicationCategory":["url"],"identifier":"24d18c38acc8e2d78db277df695f9b6cb96d35d5f0aede01783704a1e7a01cd7"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":6},"behavioralIndicators":{"malicious":0,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T8a5,Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4364:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:4364:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:4364:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4364:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8:120:WilError_03" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\mfx_d3d_mutex" Process chrome.exe created mutex with name "Local\SM0:8:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:8:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:8:120:WilError_03" Process chrome.exe created mutex with name "mfx_d3d_mutex" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5464:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5464:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:5464:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:5464:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1776:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:1776:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7032:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:7032:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8000:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:8000:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5836:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:5836:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8104:304:WilStaging_02"37:T1dd7,"GET /async/folae?async=_fmt:pb HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-protobuffer Date: Thu 12 Nov 2026 00:47:10 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 1017980103 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /async/ddljson?async=ntp:2 HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Thu 12 Nov 2026 00:47:10 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 1017980103 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Client-Data: CKGQywE= Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/javascript; charset=UTF-8 Date: Thu 12 Nov 2026 00:47:11 GMT Server: gws Expires: -1 Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Pragma: no-cache Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-6Hs7KxGPacAlgHkcmY8y-Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Cache-Control: no-cache must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 X-Client-Data: CKGQywE= Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Thu 12 Nov 2026 00:47:11 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 1017980103 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /async/newtab_promos HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Thu 12 Nov 2026 00:47:11 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 1017980103 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body "GET /CL0/https://go.microsoft.com/fwlink/%3FLinkId=2383438&lid=s8g2bmq5y78v/1/010001a1c190f402-dc30cb16-6aed-4db1-b4bc-0fd9fac669ee-000000/tEp41RVpLp6b1R3w1i7tizj6IXIHsYJodYSrSMZ80Cw=452 HTTP/2 Host: clicks.customeremail.microsoftrewards.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Sec-Fetch-User: ?1 Priority: u=0, i Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Ch-Ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: document" Response ==> HTTP/2 302 Found Date: Thu 12 Nov 2026 00:47:12 GMT X-Azure-Ref: 20261112T004712Z-165465c6c545sc48hC1MNZkap00000002mp00000000029qv Location: https://go.microsoft.com/fwlink/?LinkId=2383438&lid=s8g2bmq5y78v X-Cache: CONFIG_NOCACHE with no response body "GET /.well-known/web-app-origin-association HTTP/2 Host: chat.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/html Date: Thu 12 Nov 2026 00:48:56 GMT Server: sffe Expires: Thu 12 Nov 2026 00:48:56 GMT Vary: Accept-Encoding Content-Encoding: br Cross-Origin-Opener-Policy: same-origin; report-to="uxe-owners-acl" Last-Modified: Mon 06 Oct 2025 19:58:00 GMT X-Content-Type-Options: nosniff X-Xss-Protection: 0 Cross-Origin-Resource-Policy: cross-origin Report-To: {"group":"uxe-owners-acl" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl"}]} Accept-Ranges: bytes Cache-Control: private max-age=3000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT.......38:T84e5,"POST /collect HTTP/1.1 Host: k.clarity.ms Connection: keep-alive Content-Length: 828 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Accept: application/x-clarity-gzip sec-ch-ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Origin: https://rewards.bing.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://rewards.bing.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MUID=284A513A769F64672262493577C165F1" with payload::==> "½Tkn7¾AAW|íCB¶7~À?B@íRëÝå¤¬ØmÜ!7èÑzbVr`£ÿ¢K,1/rf¾ÎoÔÐÃ²¤Hry°0QSàÀt.-(ÐÜß®FÞ5÷i»Øá¢ëûp8y³Õ¾ÉÂv«¤rí(léÃ¨÷®uÑºî§¥óíÑlÊ§âüõ/'¦OôùõñÙÑñéÅÍûÙë÷'ycë£P¬Ä¢½KòâÎjzX\A\$KÇs(eï$Yî¢T*|à1..ÐBän9pÅRà²HA2)m$Ëh§ïíJGC®É3ô31Ä¸ItÙØÕ:R(©7_¢éu]}®âÚ´¦×Õ-x³]6nëÎlô"®LQûhjÌøäóK¼Ágt¾÷ðtæmÓèQ0òæÆvµÛòép°wäÆvzG¾dê-ô}cnÌâ££TæÌÈ?_ÍÎ4öÖSSÝº·ädí]kF\¥ÃE.õR{»?BçÀ¡ü+.1M[yÜ2KòJcr}9%W.ê{ûhÈÔ»üNN½îê½èaý×·?ÉÌøÊÔ&îTÚA|µv »:·$¶Qwôxê¿DBç 2¿}Fn«>Dm´Oç4ÛmR5ÚÛø´·}/Õsvc(©é®/±)×mÈ<²Ù C*6qâY`ÿ=¤ÿSF@I÷ ÖÝbûÉÅÃÉÁ1:ÿ:S §Î³ïÕ¯\¥èÀØM;°sGaP+¤áÍqìÍl;§îNxl¥6µE¥lï2¶xLÔßõµvþWTaHÖx[éÑ'ÝÊ4C*k¡áê ô¼ÔM0?/NN~2ãj< "¥MkÛ@ÿËrz³Þ¯Y¦4q(@èAè ÙDD²Ýµ)ýïEv|H¯e`æxßßh^^æº¹!h(m YyÐÛczÕyñíµzï÷<´yzÍyæ³Y&®h»ÍXÃ,BØ¦Ù6Ã»qóåyÃâ~©úáêçí÷å¥~xºù±¸ùöøëîþêöñîë¥ßwëEò/ºÞùXø=Õ æU¥±ðPÚ1´²F¥X1*¬tpÚã.Ð;uâÖÃzgügî¤¸öÌå?¼(.ÜIÇåg®,¦^ÂH.Ïsü¡Ó96»¾ÿïT£ÒÎJ(XTÔÆñBa69u1t«8¦ñ9OFèM¬ú&vù(Dõy2PÃksºÄ`hìRYãà&Tëºþó¶´²þ>" HTTP/1.1 204 No Content Server: nginx Date: Thu, 12 Nov 2026 00:47:20 GMT Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://rewards.bing.com Vary: Origin Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628 with no response body, "POST /collect HTTP/1.1 Host: k.clarity.ms Connection: keep-alive Content-Length: 344 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Accept: application/x-clarity-gzip sec-ch-ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Origin: https://rewards.bing.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://rewards.bing.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MUID=284A513A769F64672262493577C165F1" with payload::==> "uÑ_Kã@ðïr|:¶3÷Î?"jeaÙF£M¤,~wIw-6 Ãp~¹óJed&qä¸(û%AÀÞY8I´ÕâlùnÚ?O!Ðsõ¢uA°0»EO}¿éfÓi[¾.ÛûnR¬Ö»¦v¯e¹é¦¶©~Õ¬O¶_/ìo~_.>Ï7¿Î®æg?n_\ß^~æÕê~ÞÅG.êg}ñrÐfYæ,Ã3¢0Ô9úv[RÌã£GTÇ "uÔßkÛ0ðÿE}ú.Ñéî¤S¡µ)c°²R{yhZ¯ËÖI[ÊØÿ>ìØÞªeÐÇÖî~ºÊOÙ(ñ»yµ»v$Ï-Á=éüµªÃÍÂ\ªÜ/½{\>ëjî@ðíãîw»íñx\W/×õív4_¬ïF7ÕxûRUÛñC½YmvÍúý÷M½:¹Ð$\}9û4éÇ_O?~¼úv~qtvuþ¡_.nO¶væ«G}Möìfp×îx:MLÙG(ÛÕOa}ÆÈ@¥jèÔ² äB#ÀR¨i¯f*4kYÿÊ²B¬Ð`¤ÈJä2´+ÐP¨ùAÊoUþÖ·9gÕ6®)1R*4ùN5eäX¨N%BÁ;ÞµýÀA\2IÇ!¨èD¬SE±ée`eûzfE_°õ±³bYî×¶EQR³}A=(Z¡¡×( Ô;RU}«ÔRQÛV1£Y$½0T(S¯|@eÐp@cè¨q¯þm/"A³zT°o>æ£¶÷N©9Ûshsì§Úñúi¹üÿ+G¤ØNÌ0%òáÑz¬³Ù¯ßQ)" HTTP/1.1 204 No Content Server: nginx Date: Thu, 12 Nov 2026 00:47:28 GMT Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://rewards.bing.com Vary: Origin Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628 with no response body, "POST /collect HTTP/1.1 Host: k.clarity.ms Connection: keep-alive Content-Length: 626 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Accept: application/x-clarity-gzip sec-ch-ua: "Not:A-Brand";v="99" "Google Chrome";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Origin: https://rewards.bing.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://rewards.bing.com/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: MUID=284A513A769F64672262493577C165F1" with payload::==> "uÕ]kAàÿ2¹zÌù@(Í¥ÐÐP(½/bbPPúßË®®+£EußÇsfõOãAù0ÉÑxy` T`)&½ç|óBÿ¾ÄðÎ³Ç¿fóéÉå9óÕÁ·³/çÝõÕÓ¯'§¿ÿ¼¸<8û~ñ©»?y¸=Yä;Mí=å×0D¸ÇQ.bd»£!åüeØåªªsêrË6®sîr/ì¥Î5óÜô/RçÖåwê§¼Î)FÖ ÷@Pc ¼Ô´àÒrH½H=nDHõÀ ¢5(=PH=H[ÀöÞ"^á°¸Øà}À·ìYz û@Ù¶¥ÝN*(%C#Õ¹É:Ï¡õvÔfÃ)´ÞnÊÉ4ÁKq=m8;ÌêBi[Òö]å"«Ö RÏ@L[PNV·®B3?ç¹g2ÃwQW;¾DpÇ «CÛÈp[¨ÆH1¸¦ø¦4gßvZôTàV·04êu0Þ·z¦Ú[=H[äD¸å¤xÙJ?MÏ{÷K-vAû/¡h¦$¶ë#ÜýSh¾'yaD¥»Õ^?¾L&ÿÿPZKçöFÓÐ;"FÂ`hÝÐ²âðö "uÓ]kÛ0àÿ¢^½KtÎÑ9a¬MÂØEðEÒzmX¾ê$-eì¿8QJÁØz^IÇ²ôÛ5n0v¾zQ>LíÄÁ@Ù n§Ó·¦åûYrp±ýõ4÷îyþ¢©Áw{Ún×A¿ß6¯öaÓÎ½ûÕ¢¿ymõ¦¿nWÕv¶Z~ü¹jÃøöâÛÕQ~¾ý~ùuxùùîÇõÍÅÕÝõ§Ü>=7é§g}éÅÕp7ÉÁ) ÁLàÜ¶Ý5®ÆaI*UÕÀ`TÀä÷LZ÷P"h¥TCéÖyTªä9TÎzWM¡l×#kå²vaËì¡TÎ-bÇÒCR¹v¢'(Ícf\åuþ¥ò»8¾Ç!Ï-=û©AO¬PâSÊÎøp6Ä¦ö$yiwÄ"LÈL"<(¯þµvoËÝ|þÿX:fµ²®i_S¨àÁ06¬§Äþv¶¨®ë?âI©üä" HTTP/1.1 204 No Content Server: nginx Date: Thu 12 Nov 2026 00:47:40 GMT Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://rewards.bing.com Vary: Origin Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628 with no response body "POST /collect HTTP/1.1 Host: k.clarity.ms Connection: keep-alive Content-Length: 664 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Accept: application/x-clarity-gzip sec-ch-ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Origin: https://rewards.bing.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://rewards.bing.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MUID=284A513A769F64672262493577C165F1" with payload::==> "uÕ]kAàÿ2½:¦3çs¦PD Xñ¢ä¢ÑXIÓ&i¥ÿ]&tfÃÉJ d÷yg3gfÿy8»q'F/fóÝuÄÄr²áAfOó~[äÁ6¿~.cp¿|Õ,@¸ÿ»ÝÝöìôt3ÿ}½ù¾Ì·7oëÕéö÷|~·=½Û¬WëÝb}ûòÇz³:ÿx.ðòäÓ÷í÷å×Î_¿ûüõíÇ7ß¾j÷ïçÛ|³Õ½,ÿÿ"iQ±ý)\Q$´ú0``¨¯aÐ8þýüw" HTTP/1.1 204 No Content Server: nginx Date: Thu, 12 Nov 2026 00:47:48 GMT Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://rewards.bing.com Vary: Origin Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628 with no response body, "POST /collect HTTP/1.1 Host: k.clarity.ms Connection: keep-alive Content-Length: 588 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Accept: application/x-clarity-gzip sec-ch-ua: "Not:A-Brand";v="99" "Google Chrome";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Origin: https://rewards.bing.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://rewards.bing.com/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: MUID=284A513A769F64672262493577C165F1" with payload::==> "uÔßkS1ðÿ%>}íó+'!êDc >>¬³nÅvm§ñÜ¶·6)ö~NsÏIò;LÃéu#e~9nn2rQFxÒÉótE·3yõý~ÂùO]Lb÷÷Íãúôäd5ýu³úºMfw£Ûåâdýk:}\<®åf¶|xõm¹Z]§sº|ñéíóýïËÏo>½yõåÝÅ·Wï^ïÏg_ÏÖ~GÅ}Îþ3nÂéõ5GáDpFKFÕÓ4Q]|ïì ×Öµwc[ë¹ì½8Æ¸sKIbãz'GÜ:õÎ2.iÏ"ÈÔ²8cfªLSØ¹g¶[<°aPY£;DZf©jnÕÛ7Ë½[¤ÖÝ¼LNGÎ¥u.GîÇNùÒ$¸YïÔrö¾qnKy¿[×x¡v¼Çm~µo¡©MÀ¥ÛÌ°¡m{Èó¶À¥0,¦6 ØvïöfMó8 Ä.\`±t;¬ ãÌ ùà]¡²¤´{uµN´¯ÖvU®ýfÖÖ¥wSÐp}ã{ISë¹w5¤Äýõâ%A35nQ"L¾;"ÚZ/XA)8víö3íîSÉBJ±9Éái÷ïái>ÿÿä´å²ëz]$`&`b}¬;RÓ©çÅàL%%Çã?yQP:" HTTP/1.1 204 No Content Server: nginx Date: Thu 12 Nov 2026 00:47:56 GMT Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://rewards.bing.com Vary: Origin Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628 with no response body "POST /collect HTTP/1.1 Host: k.clarity.ms Connection: keep-alive Content-Length: 731 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Accept: application/x-clarity-gzip sec-ch-ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Origin: https://rewards.bing.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://rewards.bing.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MUID=284A513A769F64672262493577C165F1" with payload::==> "uÖ_ÛFðï²yÜíüÙÙ#4¹PÐÃçÄMÚçíK¥ß½¬bÈHÅ`dý$y4³3Ò?i®nS¾°ÊÏ×Ó]6²ÉÒSYßèÃ½%Hõð÷çmN¾l¿Ý:B>éóéôx¼º¼/Ö÷.>ìwÇoÍãñòñ°ßíO÷ûí»ë77xCoýñê·qûíû¿_¿üõÝ¯ß<{õîõ/ãþíýÇë£}¢õîKù^íkZAºKW··ìU 1TÀ)A:6iËÀhÔ+°G¯6^@3F63`92wf-:2Vp\êÈ¹å£ëèbgçÛ»hDîíª?¼ Jtê.Í-:O.oÏÎH1;®·;÷ç6yËã,~g.9·Â½mqt\&ÏK^ºÏr_;â:Ë¯P6ë+ktïî4«¿PËøymÜÙÌ"±z5+FÖÎh`1vìµ© `¹¦J3õÊT±Ø6BÄ/°pçÕ#ëÄ¶ÀubÓB>¶lÕ "okGÆ¿Ë¾È«©¼óogÆ`JRhh¾0~!Û#*Y¶$;¶K¿{Y]ïdäB@èô{ÛÙÙ¹û;MÒñYÊ#ÿt1Y`q5p3H÷zñ4YÒåÔ$[þõu¤»ÙÎ/ äÍ'}]¯oWÇGGËÉ·ñòj5ºÞ\.ó£Õ·Éävut»\Ìëéâæç/åüäÃ)ÒÇ7¼ûí´ÿýñóÛßOÞþúéÏ÷Þ¼ûôþþÿÙôêdå×t1¿Ó'ótiÏÎÄ]ÀBJÖËûI:uI£FG`ÏÀØòÞ®¥¦eYÅw¨"²WC4õ»ÜÆ#\Q¾û«i$2MùvÉ#ud»½Ì`ç.Ö»íûÝw°Ó6ty5x]Ñóx¬£Åäòãã`WííD¯FÿºÝ·vHrÏ´~X-éôæ©ü¯1þ°ðséýó÷û1oºA(j{4Q³»éY%b{8õu,/±íuæþæQ·±g7êí½à¼Î2!5jr¼G»>uGÆ¬8o×gâÊ3æÒòB=/J¹å&wPj×{nJíúØsÏ -ç-WÐf$(ñ¹âeØ(ïÅg|Ç°¿@Pnë£¸å¼ÏYÅþãV´m>VÝpRh °(ýqÉ}Ä4SËQ{ÎÑrî#d+P÷Ûpõ³ÄÞý½¯0c½ny<×l×7ì+HÁ î-çûf8âÝCEÈÄÛüm¹â±åz{ÖË!N[Î¸l9âZû\ë¹ÂZ¨Z[îÝSq3~K;Ô£8o*T´9Cèk+ Ã6d`{AnÁÚ1«ÑuqÝ©µeÖèÎI'(`m/µluHogmÉ]%:ciöB@àÀwí8-¶]A$*îvSÝ½HTQQà,5¯¡Ý¼70¸ÕËâdýÝÅÍýlöú×F Å¢Ö¨\tóøc©dP ÇAÂÊæEÏ"¢×¹¬ÅAT#X:B>??ÿç_i\3" HTTP/1.1 204 No Content Server: nginx Date: Thu, 12 Nov 2026 00:48:16 GMT Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://rewards.bing.com Vary: Origin Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628 with no response body, "POST /collect HTTP/1.1 Host: k.clarity.ms Connection: keep-alive Content-Length: 871 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Accept: application/x-clarity-gzip sec-ch-ua: "Not:A-Brand";v="99" "Google Chrome";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Origin: https://rewards.bing.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://rewards.bing.com/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: MUID=284A513A769F64672262493577C165F1" with payload::==> "uÖ_kGðïryÚ3;×`JRhh>=XJ#É¡ô»=åîäÑ-k~ÜÍÞÎìÜ?Ýª»ºíð".Z®w¨¡VîIßW»òá>:è|÷÷ç5vÐ}YÕÍ²ìºÏÃãþêòr·úv·û¸¿XÞ?|ºø°Ý\î¿VûËÇÝv³=Üo~þk»Û\¿¹¡òöÅ¯~»>¿}ÿò÷ë¿¾ûóõ¯Þ½þeø~}ÿñzÊróE¿{|íÐÝuW··%¨@ûÃV!C×AwØ=ºÜj0ê*AA±HaBðXæú´Ý3°`T3é¬#påðPÀ\â21= 8Âë0T¦(#¸b2'°*èìü^ 0mulÌÔ8Åíx«ZÊÐôlÆ8¥£)7`¤æÍÆxAZrÜd`àA"h·D¾c¿[È(}A$`}½3¸æxLñVy#èY.U*p¤=*Ý @È,õ ¸?%3`!ÓÙD[)0ÖlìÀTæ2¶-+Iú$wò±éÀÚY2DkÏ ýDèªi*¤#0Ê èÐ²V 9Ïë¹öÛûÖOÂNQ~'Á`y?Tj+9ÜÈkÑr"¤¥ydªÓj{×¢ROD©Zy_5²Hûæ6=Ö&Ä\L#G¶êg`ÍÒìÐê8Ûü²§;MÃ[¬ÖÙÌ}{x.÷a63krNÒ=FÐN»|Z»×0SN²Í¹Ï¥ç!8ªàÄMÀæ@ðxT "uÛjG@ÿeüTê^ÕbË@LÁäAèÁ²7¶.öJ¶1!ÿzfgv·ÆA°H{ÎLWuWu·þ6ÃÙÅ'yòÓÕæñíÄàÕØ3aøbWß7[~w±ýûã0|¾ùj·Wàø3|||üôpvzºÝ|{»}ÿpru}÷áäÝýíéÃ·ÍæÓÃé§íýíýãõýÝÏÝoo¾<§s~õäç¿Ï¿¿zóì÷§Ï~}ýçO¿~ñËüýÍõû§ù¯n?Û÷È¯Ã%o³oÍ¸ÇË)@!àî00+A)ë"JïÓe¯î½?2ôÐèax5÷Fìµt`ÐÃCWÆtWè[?äûànã¡ÌØÏ~1ê+äÑLHÿëîËÍÍÿ0áìÊä^ÂERO'<4èe¸8}ÌéÞÿíy8Ahj³ï¬Òéâ@vyyùïÛ/î'¶" HTTP/1.1 204 No Content Server: nginx Date: Thu 12 Nov 2026 00:48:39 GMT Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://rewards.bing.com Vary: Origin Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628 with no response body "POST /collect HTTP/1.1 Host: k.clarity.ms Connection: keep-alive Content-Length: 1096 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Accept: application/x-clarity-gzip sec-ch-ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Origin: https://rewards.bing.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://rewards.bing.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MUID=284A513A769F64672262493577C165F1" with payload::==> "ÛjG@ÿeüTYÕ««&ÄB &Æ`ò`ô ÙkYD×]I¾ü{èÝ©fp¬¤=§fº»jºkþÃÓ÷.|Qå§ãåÍÑ$àTE*Ãp[¿-WüáÔêê¯Ïg8Àp}vWÎ ÀÍÏðùææjýôà`µür´ú¸^^,>\¬¿,Wë«ÕåùåÍéåÅÏ.WçÏ^¿¤üæÉ/~{9þýæÝóß=ÿõí¯^?yñöÕ/ã÷g§ýÏ¯Ë·êwÃ!GÃÓ÷ïA£Â â;ßÜmQWüËÅ7`Ð²æïGGåëâîrù©È×¯Ð!´xâ+Âpê×z½>ZÐñDo?þw¸Y'þápAÃëáêEëÑÙ©\dQ¤^,Ï{¸õ¹Ûÿ£]·Ç£É¨©¡27nV·ËakD6$ÌøÐ(ùÜø¡áÉ(Ú¼4¡Õf¡P$¶EòP¨<ØfWð{'ÁP&¡È%!ÏÂ¤LÏÂJJÜyëC!eC*ÅN¢ÀæóÈ=Ø1sé\8fÜÆLUSÔÌkçâ ÇÈBiÄqäm-òø;·Â¹pçÂy}¼I´ÒxÉÜ:×výÙø|âÒ¶ã6rÖ¬y?%ZëÌ<±á`à<~A¹´ó"Jæ<¶)Ò6Ó\³âPÌËØ´ê,ÞÇSjÓ|[§ÞËI[I«³vÞÖ8´tn@©Ùíßîûxõ<â!Ï½h{íShs´¶ÄîØÌ l_WvÝz.Ú8kµ/nÏÎÿ TÚÉê[y3ÀÀv§öb0ð¦EïØvD 9<<üç_ÛªÅË" HTTP/1.1 204 No Content Server: nginx Date: Thu 12 Nov 2026 00:48:51 GMT Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://rewards.bing.com Vary: Origin Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628 with no response body "POST /collect HTTP/1.1 Host: k.clarity.ms Connection: keep-alive Content-Length: 1081 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Accept: application/x-clarity-gzip sec-ch-ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Origin: https://rewards.bing.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://rewards.bing.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MUID=284A513A769F64672262493577C165F1" with payload::==> "uÝjÝFßE¹Úó·3;PJ¡¡¡Pz|'§©'¶Jß½¬t´²gUFö÷i5;3«]ý3¦Ç¯'<©'.?îÞL@!¨ )L_Êù÷Ã¿½¨L~ó÷K`ú|ùµ\O@óÏôáîîÓíãÓÓÃ·77ïnOÎ/>¾?y{}uzûípøt{úéæúêúîâúã]ß\=yùó«G¿=ûåùzýê§¿>yúóï¾xùèÙï/~ZÿyñîÉm}ÏçWËw¯_§3ÞL_¿Â@µÔjáN0ÝÝ|9LgÐ¸àk»2Ë\;7²¹ÑB ÇÌ½sö=¼òB@Îvn¸ÇYVîä¹lÜ÷xé¼Ê·=^µóØáÚÚdáA{ó½øU6¾ï\GîÚã³"ÀjÇz¿#`I¼`]¹8HáÌyé/¥È\õÈ+¨æøJYòãPÙæKÜ;×yóc-DúÊÍ¡f¾ôãÞz4?ßuÐf¸ñÊ+AÊ¼JçEñC;(ãsÚx"¹~Îå÷ÌuãEjæfx_xÌõ×àC^±sây%Îs~I+XÁy$AæS"Â²BÐÒo4<Â´(`ÌY¨eAÍ¡<±EÁr"hî"®*,§9B¹\Á<.PifÔº¦gAHØlCÈ`,¹\S²Åºk¸lìË[Þ3ï´c0/m³$4ÀR_6cÙ¸æ8IÎ·®Ùãq¥Õh+ßxÃ¶æRKï¯føffOÿZ{QÉàfxcCøÑ<×Ek7ªÑqÞFÝæRëÑJ¾`Á¾´k(mïªuCl~ëy6ÊêàÅA=EËq_lûJ;»älhY^Ì*mc³r-¾,BD(KßÃ-¡¹³!ÔB`Ç(ÜV`ËÍ£ÖO Ð\Ùè{<¡8pÇ{FÜ^zÜgfC¸é8î4¡À:ÔÄÕ6Ãu(«{ïîQK3ê=#um½WÙÈu±ÊAxXVe=7G{^ätXÕ.´W»çªXuìý%@ÃÛÚjí3Bô³ïü±1¼,hhEôÓom§Ï¡-´mÿÁqÓ.hëóAðM1Æ°Î"Üð¡#¯å®^!r±½õÑÊ"OÀ±ÔÎmûvþù3O¡b+ 8U³2ÔT clÛq%ºù¯_./ÿÿ×âÎwúâÎ±Õ°Â0 Pphñ´¥H¸Ib`ó!ÛmOb/TAùìììßÿôÙãÊ" HTTP/1.1 204 No Content Server: nginx Date: Thu, 12 Nov 2026 00:49:06 GMT Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://rewards.bing.com Vary: Origin Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628 with no response body, "POST /collect HTTP/1.1 Host: k.clarity.ms Connection: keep-alive Content-Length: 1181 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Accept: application/x-clarity-gzip sec-ch-ua: "Not:A-Brand";v="99" "Google Chrome";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Origin: https://rewards.bing.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://rewards.bing.com/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: MUID=284A513A769F64672262493577C165F1" with payload::==> "u×Ýk7ðÿeò4µç{¤@(Í¥ÐÐ}~kbjÇÉÙI¥ÿ{Ñî6§¹blÎÞ²4#ÍhÿvÓÃ×³.w÷o& ÂR½ieé]~ßíùíU`ýß®qéóõW»¹ç¯éÃýý§»ççûÝ·7ûwwgWß½½½9¿û¶Û}º;ÿ´¿½¹½¿ºýøó_·ûGÏÒS~ñà'¿=]?¿xõø÷G}ùç³ç¼|öËú÷ë«wîÊ{¾¼ùlß£|.`z3=|ý°bu bE,``ºßÙMÐaÀX 876L@Ê;È´qÉ#´`Î@«xP#Í#8¨HIËdê@¤rÂ+Å4Ö0(J.+à6BCl@As ¸jJiÀmT@)MRtqwÐ¾5 ¢ÜC6@û~ `ñHVÐBèº'¡pz®ósVpS·,ºÏÂ8¼Ä²åY!\AÇH®g&ê8¼R?tíÓ¸@ï PDÁPÍSèA.HÀ<@J,oÀuÌ£ä¬5³°¥eß@¶xOæhcºdÞØX¦ÉIE:[NîP°VJñ°txê¼'¨ÊA¤0cÖÂr$|läl³ZdY¸:XÚÝE¾G`Æ`2æ½(®£uFµÆRðSÈ.IQ;³Ú¢½e"¨fàqÍ ÕæTZÇÜü`Ä+À:·®ðxîL#P9ïÔ×¨m µÎI]Ak]4æ³XÙ¾\¥f@¹¿Sqî bLËô¥Í ä+·ÄI8qaôÞ8¸Ö|×bÞ¥ÈØY£wg®@ï,&5WTÆÐ}#ð¸«£ww¦@¬ ZgcôÎ|¢2\ûBh*}!ZÐ$ kÙo³%lºó1è÷vÐC(8qb¬¸Ý4(R$+m Æ3·+c(Ò~¨¶f3*±v?ØWax¬,H§\r_)¡C ¾\èÆËrèæÃËÑUP%þ¨2ß)ÕÆPáZi[5×´íåÐgÐÞdÆlJï.´¤I´G]ÐbI^6á 9?öÊbÁKÂÁEómiruÀ cfa?Ãù\^°æÛ³ ¶XÜm~.áPÕD¡Ì¿FÙÍ¿}ür}ýÿ?f«³µÅ.Ó+¥·7}óûmH|iÕµU2s$àtqqñïà²8?" HTTP/1.1 204 No Content Server: nginx Date: Thu, 12 Nov 2026 00:49:21 GMT Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://rewards.bing.com Vary: Origin Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628 with no response body, "POST /collect HTTP/1.1 Host: k.clarity.ms Connection: keep-alive Content-Length: 927 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Accept: application/x-clarity-gzip sec-ch-ua: "Not:A-Brand";v="99" "Google Chrome";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Origin: https://rewards.bing.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://rewards.bing.com/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: MUID=284A513A769F64672262493577C165F1" with payload::==> "u[k7ÿË<äéÔÖ¹è\¦4q(@éñlSß²vBé/ikiÊ²Ëì|ßht9::O»éä|JG~düÃÕîérT@b÷4$éK¾ú¾ÛÓûk`²ý_nÒÓç¯ùöj4¦OOO'ÇÇûÝ·ËýÇ£«ë»Gïïo¿ívÇûûÛû§ëû»ÿ¼ßß¾9Ã3zûâ·W¿Õë·¿¿üõôåÏïþxýæÅ«w¯ª÷o®?>úGººý¿.`ºNÎÏ29¸BÓÓÓþËnºYEÈ À8qHVs7! é ä¼¤ll@J÷£' b`ïÁY J44 ¥ã+@¸Pã©\õ\eåñ08rÃs¨<ÃC+^æ©ãæ»úÎb{Km]7ÈããR±(X+V;gçëË4¼bÞ,U,ÞGÏÁ¢àC×LÎàý´)VÌå=¶çýÓã ±L\=5¶0UÌ1âpáoû¾ç5à$;p3áVÐdgÂWC"â^(ûdw8×¬ n@IA$2¹f¨¦r«f&Æo0-pÒ*$îcqÎ= ¤^à&¨ÛØxp£L¬±&`î×í ä¹ KÊ4ØvàsMo³ÇCIä È¦ Ôa¹ÅÇ0L¶õ¤bAò2a óMaÉÒE`VrnBaÙ6%tóvÞy-ATuSÀ&$ßXW!ò&ÆqkYß~Þ§M5¢-¶øßì¿Qã`oöÏ´ñÍ52k7¸ZÔg^ÃÔïõT¢òZplByö¦ÎõXâìà}vU_ðrtõ\+Ê}=À±&çUúzð©/68©áý»ä¿x8^¾Üà HÁûùNÏa|LÏþxk2J-5ã|{Õ<ÒÊKÍÄe{irþ£ø)ÂÝÿÿYde^äÒÁ¡Tl(CäÃºT Q²ÌÕÂ¼ÅÃ5))³éâââ¹I\P" HTTP/1.1 204 No Content Server: nginx Date: Thu 12 Nov 2026 00:49:38 GMT Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://rewards.bing.com Vary: Origin Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628 with no response body "POST /collect HTTP/1.1 Host: k.clarity.ms Connection: keep-alive Content-Length: 1350 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Accept: application/x-clarity-gzip sec-ch-ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Origin: https://rewards.bing.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://rewards.bing.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MUID=284A513A769F64672262493577C165F1" with payload::==> "YkGÇ¿Ë<ø©²êº«&Ä!cyz¬µ,¢sWïzFs¨{LÀ¤ôë®cê_Õ½ÿtÛîùa6±qþéd{wÜ: `*?,c@w¯'_·;úpt¾ûûÓEê »½xÐËRÿÕ}º»»Ù??8Øm?ïN÷ó«³ÍëËýçíöfp³»¾¼¾;¿¾úùãõîòÅÛ×øÞ=ûãÕo¯Ççw¾üýÅË_ßÿõæí³Wïßü2þýâüôÅ>ÎèäòV¿z%$E©SnO#À5DHO@fÆÉ>ìas÷Æb¦,EÂ8!HÁÒ B3¢!MÎÔdF!ÓqJáMÈZê+Ñf"3&@ãCúhUúÉÐ&LÏO&Ä8p¬ =ªRï£Ð<`´.K¥<-{}dPn6É}E>"@©òpº(G7¥:OÊl)bVªÊãd*)(ÖåDi&´>_*§¡zË¤D4(ª³`ÐúÈ®SÎ@+uB~?kp`$R^%~?¾B(úK&¥ÚQÅÙ¨\Çªøxz¾1jÝqTÇ¤V*PK?^Q=5V¦¤@¨_ªÂ2s´>§«RL@é'õ½Cõq¨@J7hÂdÎ«Àp@+@qÒT³Î¬>ÎÂ²C°5@M¯8´0O@Z¦»¢\©Ü«Q<^{À[`øìEÅ©Ïk$(3¡|ÒÒß`s\¬ÿ*¿]Ý_\|ÿ[ÏJÏ¦íÝórI@½`¤x"0h ìl3Å6\kIÁ2ô·½þ£árã Xú`ÉP´Tj±X(ý,zH]K¦âèèèßÿ²¹" HTTP/1.1 204 No Content Server: nginx Date: Thu, 12 Nov 2026 00:49:55 GMT Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://rewards.bing.com Vary: Origin Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628 with no response body, "POST /collect HTTP/1.1 Host: k.clarity.ms Connection: keep-alive Content-Length: 1578 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 sec-ch-ua: "Not:A-Brand";v="99" "Google Chrome";v="145" "Chromium";v="145" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: */* Origin: https://rewards.bing.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://rewards.bing.com/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: MUID=284A513A769F64672262493577C165F1" with payload::==> "{"e":["0.8.73-beta" 18 157935 3409 "u5byer2ci8" "7rkhl0" "qlv5mb" 1 1 1 0 "https://rewards.bing.com/sweeps/promotion?form=MD1D2P&OCID=MD1D2P&PUBL=BGRWEM&CREA=MD1D2P&lid=s8g2bmq5y78v"] "a":[[157500 12 283 260 683 "" "true"] [157519 12 283 302 768 "" "true"] [157542 12 284 364 890 "" "true"] [157552 12 288 385 934 "" "true"] [157574 12 288 417 996 "" "true"] [157588 12 288 428 1018 "" "true"] [157599 12 288 437 1036 "" "true"] [157625 12 288 450 1062 "" "true"] [157646 12 288 458 1078 "" "true"] [157667 12 288 463 1089 "" "true"] [157687 12 288 466 1096 "" "true"] [157708 12 288 469 1100 "" "true"] [157723 12 288 469 1101 "" "true"] [157743 12 288 471 1104 "" "true"] [157763 12 288 472 1105 "" "true"] [157784 12 288 472 1106 "" "true"] [157804 12 288 472 1107 "" "true"] [159859 12 288 456 1033 "" "true"] [159869 12 288 444 973 "" "true"] [159880 12 232 434 926 "" "true"] [159895 12 284 426 888 "" "true"] [159920 12 284 414 833 "" "true"] [159930 12 284 410 814 "" "true"] [159950 12 284 404 785 "" "true"] [159960 12 284 402 775 "" "true"] [159981 12 284 399 761 "" "true"] [160001 12 284 397 752 "" "true"] [160022 12 284 396 746 "" "true"] [160042 12 284 394 742 "" "true"] [160063 12 284 393 740 "" "true"] [160084 12 284 393 738 "" "true"] [160104 12 284 393 737 "" "true"] [160126 12 284 393 736 "" "true"] [160161 12 284 393 735 "" "true"] [161343 26 "pagehide" 0] [157935 4 1 1265 3040 1280 665 0 500 207 577 157566 141411 155484 207 577 155484 null null null null null null 208 577 155464 null] [161343 0 2 1350 3 0 4 3 5 2 25 40] [161343 36 6 [159892 16]]]}" HTTP/1.1 204 No Content Server: nginx Date: Thu 12 Nov 2026 00:49:59 GMT Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://rewards.bing.com Vary: Origin Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628 with no response body39:T88d,The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 2F:4E:03:F7:F5:9B:7C:D0:C5:47:D3:BB:90:C0:BD:78:56:C2:21:43; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: EA:BC:AB:CD:E0:C7:EA:5E:B3:51:4E:91:8E:95:E3:50:7D:C2:04:D4; see report for more information) The input sample is signed with a certificate issued by "CN=GeoTrust TLS RSA CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: C8:F6:E5:7D:37:2C:72:36:6B:7E:D6:EA:EE:A3:79:99:06:17:22:65; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 8B:3C:5B:9B:86:7D:4B:E4:6D:1C:B5:A0:1D:45:D6:7D:C8:E9:40:82; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 02, O=Microsoft Corporation, C=US" (SHA1: DD:5E:3A:B7:8F:05:3F:CD:30:F0:01:9C:0E:60:AC:19:76:C8:50:E7; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: F8:A4:08:B8:FB:EE:A0:77:B7:57:38:65:86:41:BE:77:15:47:20:EB; see report for more information)3a:T15da,POST request #1: URL: https://rewards.bing.com/csp-report Data size: 2155 bytes Body: {"csp-report":{"document-uri":"https://rewards.bing.com/sweeps/promotion?form=MD1D2P&OCID=MD1D2P&PUBL=BGRWEM&CREA=MD1D2P&lid=s8g2bmq5y78v" "referrer":"" "violated-directive":"require-trusted-types-for" "effective-directive":"require-trusted-types-for" "original-policy":"default-src 'self'; script-src 'nonce-NmVhYTU2MDAtNThhNC00ZWEzLTg0YjUtNmY0MzMxMDE2ZWI3' 'self' 'strict-dynamic' 'report-sample' https://wcpstatic.microsoft.com https://*.bing.com https://*.clarity.ms https://challenges.cloudflare POST request #2: URL: https://rewards.bing.com/csp-report Data size: 2153 bytes Body: {"csp-report":{"document-uri":"https://rewards.bing.com/sweeps/promotion?form=MD1D2P&OCID=MD1D2P&PUBL=BGRWEM&CREA=MD1D2P&lid=s8g2bmq5y78v","referrer":"","violated-directive":"require-trusted-types-for","effective-directive":"require-trusted-types-for","original-policy":"default-src 'self'; script-src 'nonce-NmVhYTU2MDAtNThhNC00ZWEzLTg0YjUtNmY0MzMxMDE2ZWI3' 'self' 'strict-dynamic' 'report-sample' https://wcpstatic.microsoft.com https://*.bing.com https://*.clarity.ms https://challenges.cloudflare POST request #3: URL: https://rewards.bing.com/csp-report Data size: 2165 bytes Body: {"csp-report":{"document-uri":"https://rewards.bing.com/sweeps/promotion?form=MD1D2P&OCID=MD1D2P&PUBL=BGRWEM&CREA=MD1D2P&lid=s8g2bmq5y78v" "referrer":"" "violated-directive":"require-trusted-types-for" "effective-directive":"require-trusted-types-for" "original-policy":"default-src 'self'; script-src 'nonce-NmVhYTU2MDAtNThhNC00ZWEzLTg0YjUtNmY0MzMxMDE2ZWI3' 'self' 'strict-dynamic' 'report-sample' https://wcpstatic.microsoft.com https://*.bing.com https://*.clarity.ms https://challenges.cloudflare POST request #4: URL: https://rewards.bing.com/csp-report Data size: 2153 bytes Body: {"csp-report":{"document-uri":"https://rewards.bing.com/sweeps/promotion?form=MD1D2P&OCID=MD1D2P&PUBL=BGRWEM&CREA=MD1D2P&lid=s8g2bmq5y78v","referrer":"","violated-directive":"require-trusted-types-for","effective-directive":"require-trusted-types-for","original-policy":"default-src 'self'; script-src 'nonce-NmVhYTU2MDAtNThhNC00ZWEzLTg0YjUtNmY0MzMxMDE2ZWI3' 'self' 'strict-dynamic' 'report-sample' https://wcpstatic.microsoft.com https://*.bing.com https://*.clarity.ms https://challenges.cloudflare POST request #5: URL: https://rewards.bing.com/csp-report Data size: 2129 bytes Body: {"csp-report":{"document-uri":"https://rewards.bing.com/sweeps/promotion?form=MD1D2P&OCID=MD1D2P&PUBL=BGRWEM&CREA=MD1D2P&lid=s8g2bmq5y78v" "referrer":"" "violated-directive":"require-trusted-types-for" "effective-directive":"require-trusted-types-for" "original-policy":"default-src 'self'; script-src 'nonce-NmVhYTU2MDAtNThhNC00ZWEzLTg0YjUtNmY0MzMxMDE2ZWI3' 'self' 'strict-dynamic' 'report-sample' https://wcpstatic.microsoft.com https://*.bing.com https://*.clarity.ms https://challenges.cloudflare POST request #6: URL: https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 Data size: 5825 bytes Body: {"name":"vnext_PageView","time":"2026-11-12T00:47:13.894Z","ver":"4.0","iKey":"o:94f8d95915164be4bdfaa069859dd53e","ext":{"sdk":{"ver":"1DS-Web-JS-4.4.1","seq":1,"installId":"89badd00-9af6-4252-85ef-49517106f459","epoch":"489789431"},"app":{"locale":"en","sesId":"i5VrWPh3xaolykbWretmE3"},"user":{"locale":"en-US","localId":"t:284A513A769F64672262493577C165F1"},"web":{"domain":"rewards.bing.com","screenRes":"1280X800","userConsent":false},"intweb":{},"utc":{"popSample":100},"loc":{"tz":"-08:00"}} POST request #7: URL: https://k.clarity.ms/collect Data size: 828 bytes Body: (binary data) POST request #8: URL: https://k.clarity.ms/collect Data size: 358 bytes Body: (binary data) POST request #9: URL: https://k.clarity.ms/collect Data size: 344 bytes Body: (binary data) POST request #10: URL: https://k.clarity.ms/collect Data size: 510 bytes Body: (binary data) POST request #11: URL: https://k.clarity.ms/collect Data size: 626 bytes Body: (binary data) POST request #12: URL: https://k.clarity.ms/collect Data size: 445 bytes Body: (binary data) POST request #13: URL: https://k.clarity.ms/collect Data size: 664 bytes Body: (binary data) POST request #14: URL: https://k.clarity.ms/collect Data size: 588 bytes Body: (binary data) POST request #15: URL: https://k.clarity.ms/collect Data size: 731 bytes Body: (binary data) POST request #16: URL: https://k.clarity.ms/collect Data size: 891 bytes Body: (binary data) POST request #17: URL: https://k.clarity.ms/collect Data size: 871 bytes Body: (binary data) POST request #18: URL: https://k.clarity.ms/collect Data size: 1005 bytes Body: (binary data) POST request #19: URL: https://k.clarity.ms/collect Data size: 1096 bytes Body: (binary data) POST request #20: URL: https://k.clarity.ms/collect Data size: 1081 bytes Body: (binary data) POST request #21: URL: https://k.clarity.ms/collect Data size: 1181 bytes Body: (binary data) POST request #22: URL: https://k.clarity.ms/collect Data size: 927 bytes Body: (binary data) POST request #23: URL: https://k.clarity.ms/collect Data size: 1350 bytes Body: (binary data)3b:T10f9,Extension fetched and executed 25 script(s) from external hosts at runtime. bing.com → https://rewards.bing.com/sweeps/promotion?form=MD1D2P&OCID=MD1D2P&PUBL=BGRWEM&CREA=MD1D2P&lid=s8g2bmq5y78v Size: 0.4 KB Hash: c3f4cef065ef1794 Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/4540encxcr8pp.js?dpl=20261111-5 Size: 1.9 KB Hash: 2b1982dc9869918d Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/0fnkxzv0_0yj_.js?dpl=20261111-5 Size: 29.2 KB Hash: acd7a3b51b9f7261 Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/1tfo5ygu8yd1m.js?dpl=20261111-5 Size: 40.1 KB Hash: 9f2fda841a589236 Context: default Lines: 2 lines → https://rewards.bing.com/_next/static/chunks/1w6t4uqsqkp2p.js?dpl=20261111-5 Size: 32.2 KB Hash: 0217f467a0fc540c Context: default Lines: 1 lines → https://rewards.bing.com/_next/static/chunks/2k7mpj6g-5eys.js?dpl=20261111-5 Size: 2.0 KB Hash: 2769c43cc0235c61 Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/turbopack-2c3mg3r-05n1w.js?dpl=20261111-5 Size: 11.0 KB Hash: b5f9b5199b99ab6c Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/3i0x596g2v_ed.js?dpl=20261111-5 Size: 1.2 KB Hash: 072f511bc0415bf5 Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/37lhqwnnusvla.js?dpl=20261111-5 Size: 39.3 KB Hash: 7276f6870249777d Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/0p_w-37l1s-5m.js?dpl=20261111-5 Size: 13.6 KB Hash: fe6fd430d79393ef Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/3mt0wtuvi-rix.js?dpl=20261111-5 Size: 27.2 KB Hash: f2048fa7427d0d43 Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/0sq_fkzfcvun_.js?dpl=20261111-5 Size: 31.0 KB Hash: 73f70018593c6924 Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/10bj8vic_hgef.js?dpl=20261111-5 Size: 33.8 KB Hash: bcef3e48f4019bc3 Context: default Lines: 6 lines → https://rewards.bing.com/_next/static/chunks/14c39x_memhll.js?dpl=20261111-5 Size: 22.8 KB Hash: b66e01fdb3962df6 Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/1_s99nruz96b1.js?dpl=20261111-5 Size: 68.8 KB Hash: a646203279628b20 Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/3f1hf1ytjhz-9.js?dpl=20261111-5 Size: 37.2 KB Hash: 445efac80a7fb252 Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/30tqqv162fah1.js?dpl=20261111-5 Size: 48.9 KB Hash: 55f449a35c11d3c7 Context: default Lines: 5 lines → https://rewards.bing.com/_next/static/chunks/0p8636o-43dcf.js?dpl=20261111-5 Size: 22.6 KB Hash: beb390de8b9d9f85 Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/3sgrilp694i9h.js?dpl=20261111-5 Size: 135.9 KB Hash: 10d1fe12b2b95ad7 Context: default Lines: 21 lines → https://rewards.bing.com/_next/static/chunks/2wzjet0i_wn9q.js?dpl=20261111-5 Size: 151.1 KB Hash: 276e420cf74edb36 Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/2exrxpxktctrg.js?dpl=20261111-5 Size: 228.5 KB Hash: f3e24335fd584bf7 Context: default Lines: 30 lines → https://rewards.bing.com/_next/static/chunks/2d6vs-vbhfntc.js?dpl=20261111-5 Size: 36.0 KB Hash: 71eb504941483d2d Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/12j5lcwg1frvy.js?dpl=20261111-5 Size: 23.4 KB Hash: e3e5e61ae386b32f Context: default Lines: unknown → https://rewards.bing.com/_next/static/chunks/29dwh9y5x1y4x.js?dpl=20261111-5 Size: 1.5 KB Hash: afdac91bb2e291a2 Context: default Lines: unknown microsoft.com → https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js Size: 51.5 KB Hash: dfe480ce6e9cb555 Context: default Lines: unknown3c:T7fa,--window-position=20,54 --window-size=1280,840 --disable-dev-shm-usage --disable-application-cache --disable-background-networking --disable-component-update --disable-sync --safebrowsing-disable-auto-update --disable-component-extensions-with-background-pages --remote-allow-origins=* --safebrowsing-disable-download-protection --disable-search-engine-choice-screen --disable-browser-side-navigation --disable-save-password-bubble --disable-single-click-autofill --allow-file-access-from-files --disable-prompt-on-repost --dns-prefetch-disable --disable-translate --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-device-discovery-notifications --disable-oopr-debug-crash-dump --disable-top-sites --ash-no-nudges --no-crash-upload --deny-permission-prompts "--simulate-outdated-no-au=\"Tue, 31 Dec 2099 23:59:59 GMT\"" --disable-ipc-flooding-protection --disable-password-generation --disable-domain-reliability --disable-breakpad --disable-features=OptimizationHints,OptimizationHintsFetching,Translate,ComponentUpdater,OptimizationTargetPrediction,OptimizationGuideModelDownloading,DownloadBubble,DownloadBubbleV2,InsecureDownloadWarnings,InterestFeedContentSuggestions,PrivacySandboxSettings4,SidePanelPinning,UserAgentClientHint,DisableLoadExtensionCommandLineSwitch,Bluetooth,WebBluetooth,UnifiedWebBluetooth,WebAuthentication,PasskeyAuth,OptimizationGuideOnDeviceModel,HttpsUpgrades,BackForwardCache,SpareRendererForSitePerProcess,AutofillServerCommunication --enable-unsafe-extension-debugging --no-pings --homepage=chrome://version/ --animation-duration-scale=0 --wm-window-animations-disabled --enable-privacy-sandbox-ads-apis --disable-background-timer-throttling --disable-popup-blocking --remote-debugging-host=127.0.0.1 --remote-debugging-port=9222 --user-data-dir=C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85 --lang=en-US --no-default-browser-check --no-first-run --no-service-autorun --password-store=basic --profile-directory=Default --log-level=03d:Tbac,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAIhklEQVR4XqWXe1BTdxbHmWp9AHmpceruX53u2roiKiDgo9aKK4o8JIgVLAUF7Vrq1IorLqKiISrI0xGtqDvdjo+1rrotilYF8iSBQBIeCYFAeCa8FHU7a7d2O9899waQl626Z+Y7ucO9ud/POb/zO7/g5PSCMV/2APOlnZgns2GurAVz5U1wl1swV2nGXFUt5qsNmKfWw6tMA69yNRZWFmHkO14pvEoewbPkITxk91nzebJ2FmCOvJHUAHdFHdyVtZhbWkUQlSyAb4UMS/R3sbTqFlbUfvtqID4lT+At/Te8pI/hSdl7yHrIvIPMW+Eua8YcGQNQBze5CXOU1XBXVVEFKuCh0VL2BGC4g2XVBVhhvIbVDRcgsp59cRBv6Q/wLuk3l/bBQ9qD+bIuArA7sidzN9bcAeCmqCYIPQFo4VmmhneFHAt1RSyAf90lrDZfQEjTaUR2HP51CJ+S/7CZL5B+zwJ4SZnyMwB2tgJs9lT62YwxKyNdMwBVVIVKzNeUw1vLVOC7foCLCGnMx1qrAyCyQ/x8CF/pj/AheUsHyk/rL71PAN0sgLvcsfZucjObPWM8W16DP8irMFvBAOioF7TUB3LqgdtYXnMN/qbzBHAa61szsdEmQbR9HzZ1J46G8Cl5CiZ7HylTgSdUgX+RHpMxs/Z2+rRR9gxAPZnWDhqP1BxlJUGUUSNSExoK4Fd7BYENpxHWnIXIdjGZJyGuN2EMADb7p2DXnwX4Hh7FDzHr2zbMKrCSmvDOjQYCsLDlH2k8IDeljnpBg0WVtwngG/jVMAD5CLOmI6JNgk2dCdjSsx3xfbHPIHxKfmLNB7KfeakFwoN3wEu4Dv6emxAk3caUpELSDUxNvI43jhTirX9UjjJ3ADBbUQrv8mIs1t2kbXgBAeZ8rG8WI6I1GTG2zxHX9Qnie6OGAjyFLwG4/fMB+El3wEm8A26yFLwDKvDFaggkZZgi0WCqpBTTxHJMO1iMaftv4Q1xIWbeNIxYAi3mlSrhq72Bpbqv4Vf1JdbU5SK4Ph0bWv6C6I7tiLVvxZ+6o7C9NwxOPrL/kvlPmHnBBueE7+C6VwFOSjm4qQbwjtaAn26EIMOIKaSpmUYIM6shPKaD8KgaQnExhMkFeOuqoxpuCh0NJRUBqLBAXYjFldew3HAOgXXZEFlS8IE1EZHNO7DZthUfd0VhW896OC269wSzrvRi8q5iOCdr4HJQD47ECG6aGbz0evAzGyDIsmBKjgVTSdNySTlmTM82YvqxCkyXyCHcdxNvF2poKioxT1kMD9Ut+JZdwbsVX2G5/hQCjRKEmvdiveVzfNQSh03tMYizReBjuwhOngWPwNlfjknJWjgfrIaLpA6uR+rBSbOAe8wCXkYj+FmNEGQ3EUQTpuY2EUQ9Zhw3YXpuHYRZegglKsxIuwc3KQNwjwBuYqHmPN7VnsP7lXkIMoohMicRwE5stG5FTGsMYtvCHQDv/L0HE/dWYtKBakwWm+AsqYfLYdLRhuEQmQ4IfnIp3txxfdQ2EqbKMPN6ETyVV+GtugTf0r9hqTYffhXpCKzeg+DaPVhn/hQfNsUgumUjC7ClIxROwuwGTEiuwsQUEyaJzZicamYhnPshXNMIJN0BwdsthcvqtFHmA/H2l7fhKb9IABexSH0GSzUZWK5NR4AhEcE1uyAyxSPCHImoxnBsahYhrjUYToIMC17fb8SEAyZMPGjGpEMOiMkjIfao4BKQBteQ488F8LzMAHwFH0UeFqsy8V5ZOlaWJ8JfuwtBhm0IrYlFuDEKH1rW4SNLEOKa/eE0PrkW4wng9QN1mJBSRxB1LMSkoRCpJrgEZ5F5Ljii088HkJ6Fl/wcAZwggGN4r/QQ/NS7CCAeQboYiGqi8YFpPVVBhKj6VYix+MFp3F4C2GciCNNoCGZJGIj4QrgEEYDoFDhh+c8HKM7BAlkeFimOkg7jfVUCVmgS4F++DWvKoxGij4LIEI4IUxAijKsRZV4Bp9f2GjEu2TgmxMR+COewk3BdewKcdWfgGn5uTADPkhPwLM6maZpOc0WMJYr9WKbcCT/VJ/BXRzsAKkQQ6YKxzhCASONKx3uO3LWjq/cxOhn1PIKdZOt+yKqjqw/tnX1o63yAVjvJdh+pF8vBF43+ceFZlE4AmfAuPoRF0v1YIt2JZYpP4aeMxcrSaASUbUCwNhQifRDCCGDwi4zpy0RTWy84z6mC970U+BSlYGHxbgJIIIBtBLAZf1RGIkAdijWaUISUBw3/LpPpy4SlpZsA/krLMTYEE4vvbceSks+wVBqL5bKNWCHfgFWK8LGfZ8o7NB7/+DNWXu+Ez2U7K8/zHYi/2zN4v97a5QCgKnDCzoz90peJFlrXkXFA8xA76Ffw7860QpBjhVt+y+A9U6N9EIBLTckV5YMT+sULgwgCM8APOPbseWt77xDrZ3FU3ceO399mN+L3NP8HorbBNhyAtiWXZgOXILihp8ANyRsFww3MBn9NFikTAkYBGc+esbR2D7F1xJHSPnb8HlY+wOarNryZ3jB4r9rcPjaA6AvwCIC39iQpD7yQE+AHHyflgh+UAz4DEZhFABkQrBoCUN/cNcQaOKx6AFcavxK5Y2l2FNB/Q7mNg/f1prb/EyBzeIVMTfbBl0sU99mDKFU2vC8e/vDz4HVlbQu7A14JgJZhmDkTtRbb4Mu3fNMJsXTsnhiI8upmdhxz1p0lgPwXBMgGb032aHMmquvbR3r8YmgMVhrLeXQoUdOFMcYOcy6dE2MCBOVCEJgztjkT+rq2kR6/GKW6RozbrcPkTdfAofOBG3oSXDJlPh3GJObvwSfAI/ORfqNCSyWtqGmBlhFdMyUuq7Kymar1TShlRKaqfu28bMZrSUYwh9j4pGpM+HMZnZZ34fJZCQQJUszYVYTfxH7968b98T+P3LEt9Qr17wAAAABJRU5ErkJggg==3e:T525,--type=gpu-process --disable-breakpad --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,13898179355976800974,15241174130371674818,262144 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708988185955192 --log-level=0 --mojo-platform-channel-handle=1900 /prefetch:23f:T4dd,--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --metrics-shmem-handle=2112,i,10294931192970848615,18156596808667499328,524288 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708989122997041 --log-level=0 --mojo-platform-channel-handle=2132 /prefetch:1140:T4de,--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --metrics-shmem-handle=2392,i,6273615298686909772,9146347965120237829,524288 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708990060038890 --log-level=0 --mojo-platform-channel-handle=2416 /prefetch:1341:T5c4,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1794439709891373 --launch-time-ticks=4717088141 --metrics-shmem-handle=3320,i,5389800471370179916,2788260513702235273,2097152 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708990997080739 --log-level=0 --mojo-platform-channel-handle=3328 /prefetch:142:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1794439709891373 --launch-time-ticks=4719019982 --metrics-shmem-handle=3496,i,6761543678000721086,10206535654736641495,2097152 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708991934122588 --log-level=0 --mojo-platform-channel-handle=3500 /prefetch:143:T4e9,--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --metrics-shmem-handle=4568,i,12977733213228232728,12676005090085886316,524288 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708992871164437 --log-level=0 --mojo-platform-channel-handle=4544 /prefetch:1444:T5de,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1794439709891373 --launch-time-ticks=4721006321 --metrics-shmem-handle=4616,i,8380373627536484582,1289866941873344086,2097152 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708993808206286 --log-level=0 --mojo-platform-channel-handle=4660 /prefetch:145:T5dc,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1794439709891373 --launch-time-ticks=4722480967 --metrics-shmem-handle=3600,i,1285882330148935158,64550371669696779,2097152 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708994745248135 --log-level=0 --mojo-platform-channel-handle=4736 /prefetch:146:T4de,--type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --metrics-shmem-handle=5244,i,11838573777330401585,10866291403693504953,524288 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708995682289984 --log-level=0 --mojo-platform-channel-handle=5224 /prefetch:1447:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1794439709891373 --launch-time-ticks=4730647104 --metrics-shmem-handle=5340,i,193657823295811568,15710680614304300479,2097152 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708997556373682 --log-level=0 --mojo-platform-channel-handle=5348 /prefetch:148:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1794439709891373 --launch-time-ticks=4731058405 --metrics-shmem-handle=5340,i,7366614172858257352,4323536277676555885,2097152 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708998493415531 --log-level=0 --mojo-platform-channel-handle=5524 /prefetch:149:T5e1,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1794439709891373 --launch-time-ticks=4731534545 --metrics-shmem-handle=5380,i,17328743628409003071,11152004377301250055,2097152 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708999430457380 --log-level=0 --mojo-platform-channel-handle=5588 /prefetch:14a:T5e0,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --time-ticks-at-unix-epoch=-1794439709891373 --launch-time-ticks=4731936986 --metrics-shmem-handle=5352,i,7530253753070548925,11816805424834750190,2097152 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709000367499229 --log-level=0 --mojo-platform-channel-handle=5380 /prefetch:14b:T5e1,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --time-ticks-at-unix-epoch=-1794439709891373 --launch-time-ticks=4732401372 --metrics-shmem-handle=5660,i,10126225498803913095,14939868958700106504,2097152 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709001304541078 --log-level=0 --mojo-platform-channel-handle=5652 /prefetch:14c:T5e1,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --time-ticks-at-unix-epoch=-1794439709891373 --launch-time-ticks=4732961474 --metrics-shmem-handle=4812,i,10064882317805658317,16144037946415680085,2097152 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709002241582927 --log-level=0 --mojo-platform-channel-handle=5252 /prefetch:14d:T5e0,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --time-ticks-at-unix-epoch=-1794439709891373 --launch-time-ticks=4733365489 --metrics-shmem-handle=5676,i,18250476337804529692,9573807103603053305,2097152 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709003178624776 --log-level=0 --mojo-platform-channel-handle=4812 /prefetch:14e:T5e0,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --time-ticks-at-unix-epoch=-1794439709891373 --launch-time-ticks=4823303320 --metrics-shmem-handle=5132,i,12075086767548126349,1299184581385122521,2097152 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709004115666625 --log-level=0 --mojo-platform-channel-handle=5096 /prefetch:14f:T5e0,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --time-ticks-at-unix-epoch=-1794439709891373 --launch-time-ticks=4824060509 --metrics-shmem-handle=5092,i,2201711929509996406,15258793515280018779,2097152 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709005052708474 --log-level=0 --mojo-platform-channel-handle=5680 /prefetch:150:T5c3,--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22621.1194 --disable-breakpad --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpnhywp_85" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5680,i,17055990951376938961,17300528495575596716,262144 --field-trial-handle=1912,i,14831085592739294496,12644491681877190356,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709005989750323 --log-level=0 --mojo-platform-channel-handle=3900 /prefetch:1030:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"24d18c38acc8e2d78db277df695f9b6cb96d35d5f0aede01783704a1e7a01cd7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794444683543,"unified_at":"2026-11-12T00:51:23.543Z","metadata":{"hashes":{"sha256":"24d18c38acc8e2d78db277df695f9b6cb96d35d5f0aede01783704a1e7a01cd7","sha1":"615bc877352ac132f5e5c101916332a27e7fd054","md5":"3505f2f95f32b6c31ef30e9bc8990f41","sha512":"a0aebb8e0205537ed1738da2ce2c1e2351a55fb597f6ad918ab2df31db699a369e9426751a06837cdea4f440c3c41715bc7ad1103f59db4f26795cba9435d73f","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"https://clicks.customeremail.microsoftrewards.com/CL0/https://go.microsoft.com/fwlink/%3FLinkId=2383438&lid=s8g2bmq5y78v/1/010001a1c190f402-dc30cb16-6aed-4db1-b4bc-0fd9fac669ee-000000/tEp41RVpLp6b1R3w1i7tizj6IXIHsYJodYSrSMZ80Cw=452","file_type":["url"],"file_type_id":"url","file_size":0,"is_container_sample":false,"url_analysis":true},"submissions":{"first_seen":1794444387000,"last_seen":1794444387000,"last_multi_scan":1794444387000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":["url_encoding"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":6},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":16},"sandbox_signatures":{"informative_count":22,"suspicious_count":2,"malicious_count":0,"total":24},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"bforeai":{"name":"BforeAI","success":true,"verdict":"clean","status":"clean","progress":100,"data_source":"BforeAI","permalink":"https://bfore.ai/","extra_fields":[{"name":"percent","value":0}]},"cleandns":{"name":"CleanDNS","success":true,"verdict":"undetected","status":"no-result","progress":100,"data_source":"CleanDNS","permalink":"https://www.cleandns.com/","extra_fields":[{"name":"domain","value":"clicks.customeremail.microsoftrewards.com"},{"name":"percent","value":0},{"name":"reports_count","value":0}]},"criminalip":{"name":"Criminal IP","success":true,"verdict":"clean","status":"clean","progress":100,"data_source":"Criminal IP","permalink":"https://www.criminalip.io/","report_link":"https://www.criminalip.io/domain/report?scan_id=76714318","extra_fields":[{"name":"credential_input","value":"safe"},{"name":"phishing_record_count","value":0},{"name":"suspicious_html_element_count","value":4},{"name":"is_invalid_ssl","value":false},{"name":"suspicious_file_count","value":0},{"name":"phishing_probability","value":0},{"name":"critical_abuse_record_count","value":0},{"name":"dga_score","value":0},{"name":"is_suspicious_cookie","value":false},{"name":"is_fake_domain","value":false},{"name":"is_mitm_attack","value":false},{"name":"is_url_analysis","value":true},{"name":"dangerous_abuse_record_count","value":0},{"name":"percent","value":30}]},"scamadviser":{"name":"ScamAdviser","success":true,"verdict":"clean","status":"clean","progress":100,"data_source":"ScamAdviser","permalink":"https://www.scamadviser.com/?utm_source=hybridanalysis","report_link":"https://www.scamadviser.com/check-website/clicks.customeremail.microsoftrewards.com?utm_source=hybridanalysis","extra_fields":[{"name":"domain","value":"clicks.customeremail.microsoftrewards.com"},{"name":"percent","value":0}]},"urlscanio":{"name":"urlscan.io","success":true,"verdict":"undetected","status":"no-classification","progress":100,"data_source":"urlscan.io","permalink":"https://urlscan.io/","report_link":"https://urlscan.io/result/01a1cd38-6970-7139-8b94-d52d5d42c115/","extra_fields":[{"name":"percent","value":0}]},"vipre":{"name":"Vipre","success":true,"verdict":"undetected","status":"no-result","progress":100,"data_source":"Vipre","permalink":"https://vipre.com/","extra_fields":[{"name":"percent","value":0}]}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Detected User Agent or request patterns of known vulnerability scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"informative","value":"Detected URL or domain pattern embedded within URL path"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"Remote JavaScript loaded at runtime during browser detonation"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Automated endpoint polling detected during URL detonation"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"suspicious","value":"Contacts Mail Related Domain Names"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Detection of obfuscated or encoded content in URLs"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"chrome.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.clarity.ms\"\n \"k.clarity.ms\"\n \"www.google.com\"\n \"clicks.customeremail.microsoftrewards.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"142.251.211.110:80\"\n \"142.251.155.119:443\"\n \"142.251.16.84:443\"\n \"142.251.150.120:443\"\n \"142.251.211.202:443\"\n \"142.251.151.7:443\"\n \"4.153.187.221:443\"\n \"172.175.38.6:443\"\n \"142.250.72.14:443\"\n \"142.251.111.188:5228\"\n \"142.251.211.110:443\"\n \"142.251.179.19:443\"\n \"142.251.153.120:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$36","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"General","name":"GETs files from a web server","description":"$37","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-8622","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"General","name":"POSTs data to a web server","description":"$38","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-8621","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"accounts.google.com\"\n \"android.clients.google.com\"\n \"c.clarity.ms\"\n \"chat.google.com\"\n \"clicks.customeremail.microsoftrewards.com\"\n \"clients1.google.com\"\n \"clients2.google.com\"\n \"k.clarity.ms\"\n \"mail.google.com\"\n \"mtalk.google.com\"\n \"ogads-pa.clients6.google.com\"\n \"play.google.com\"\n \"scripts.clarity.ms\"\n \"ssl.gstatic.com\"\n \"www.clarity.ms\"\n \"www.google.com\"\n \"www.gstatic.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$39","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /tag/u5byer2ci8?ref=npm\"\n Found http requests in header \"POST /collect\"\n Found http requests in header \"GET /async/folae?async=_fmt:pb\"\n Found http requests in header \"GET /async/ddljson?async=ntp:2\"\n Found http requests in header \"GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE\"\n Found http requests in header \"GET /async/newtab_ogb?hl=en-US&async=fixed:0\"\n Found http requests in header \"GET /async/newtab_promos\"\n Found http requests in header \"GET /CL0/https://go.microsoft.com/fwlink/%3FLinkId=2383438&lid=s8g2bmq5y78v/1/010001a1c190f402-dc30cb16-6aed-4db1-b4bc-0fd9fac669ee-000000/tEp41RVpLp6b1R3w1i7tizj6IXIHsYJodYSrSMZ80Cw=452\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 142.251.211.110 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"Network Related","name":"Detected URL or domain pattern embedded within URL path","description":"Discovered embedded domains:\n-> go.microsoft.com\n\nSource URL: https://clicks.customeremail.microsoftrewards.com/CL0/https://go.microsoft.com/fwlink/%3FLinkId=2383438&lid=s8g2bmq5y78v/1/010001a1c190f402-dc30cb16-6aed-4db1-b4bc-0fd9fac669ee-000000/tEp41RVpLp6b1R3w1i7tizj6IXIHsYJodYSrSMZ80Cw=452","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":8,"id":"network-8607","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"Network Related","name":"Detected User Agent or request patterns of known vulnerability scanning tools","description":"Vulnerability scan URL pattern \"/.well-known/\" requested from \"chat.google.com\"","origin":"Network Traffic","mitre_attack_id":"T1595.002","relevance":1,"id":"network-115","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"Network Related","name":"Detection of obfuscated or encoded content in URLs","description":"Original URL:\nhttps://clicks.customeremail.microsoftrewards.com/CL0/https://go.microsoft.com/fwlink/%3FLinkId=2383438&lid=s8g2bmq5y78v/1/010001a1c190f402-dc30cb16-6aed-4db1-b4bc-0fd9fac669ee-000000/tEp41RVpLp6b1R3w1i7tizj6IXIHsYJodYSrSMZ80Cw=452\n\nDecoded URL:\nhttps://clicks.customeremail.microsoftrewards.com/CL0/https://go.microsoft.com/fwlink/?LinkId=2383438&lid=s8g2bmq5y78v/1/010001a1c190f402-dc30cb16-6aed-4db1-b4bc-0fd9fac669ee-000000/tEp41RVpLp6b1R3w1i7tizj6IXIHsYJodYSrSMZ80Cw=452\n","origin":"Network Traffic","mitre_attack_id":"T1027","relevance":8,"id":"network-8615","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://clicks.customeremail.microsoftrewards.com\"\n Pattern match: \"https://rewards.bing.comsec-fetch-site\"\n Heuristic match: \"clicks.customeremail.microsoftrewards.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"android.clients.google.com\" has high entropy\n Contacted domain: \"ogads-pa.clients6.google.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"accounts.google.com\" (83 days old)\n Short term registered certificate: \"android.clients.google.com\" (83 days old)\n Short term registered certificate: \"chat.google.com\" (83 days old)\n Short term registered certificate: \"clients1.google.com\" (83 days old)\n Short term registered certificate: \"clients2.google.com\" (83 days old)\n Short term registered certificate: \"mail.google.com\" (83 days old)\n Short term registered certificate: \"mtalk.google.com\" (83 days old)\n Short term registered certificate: \"ogads-pa.clients6.google.com\" (83 days old)\n Short term registered certificate: \"play.google.com\" (83 days old)\n Short term registered certificate: \"ssl.gstatic.com\" (83 days old)\n Short term registered certificate: \"www.google.com\" (83 days old)\n Short term registered certificate: \"www.gstatic.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"Pattern Matching","name":"Browser-observed domain contacts (CDP)","description":"Domains contacted (15):\n www.gstatic.com\n ogads-pa.clients6.google.com\n clicks.customeremail.microsoftrewards.com\n play.google.com\n go.microsoft.com\n aka.ms\n rewards.bing.com\n bing.com\n wcpstatic.microsoft.com\n www.clarity.ms\n scripts.clarity.ms\n c.clarity.ms\n browser.events.data.microsoft.com\n c.bing.com\n k.clarity.ms","origin":"Unknown","relevance":10,"id":"cdp-8615","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"Pattern Matching","name":"Frame navigation activity","description":"navigated → https://rewards.bing.com/sweeps/promotion?form=MD1D2P&OCID=MD1D2P&PUBL=BGRWEM&CREA=MD1D2P&lid=s8g2bmq5y78v","origin":"Unknown","relevance":10,"id":"cdp-8614","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"Pattern Matching","name":"Network POST request activity profile","description":"$3a","origin":"Unknown","relevance":10,"id":"cdp-8613","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"Pattern Matching","name":"Remote JavaScript loaded at runtime during browser detonation","description":"$3b","origin":"Unknown","mitre_attack_id":"T1059.007","relevance":10,"id":"cdp-8603","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"file/memory contains long string with (Indicator: \"--remote-debugging-port=\"; File: \"chrome.exe\")\n file/memory contains long string with (Indicator: \"--user-data-dir\"; File: \"chrome.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"suspicious","category":"Network Related","name":"Automated endpoint polling detected during URL detonation","description":"Endpoint polled 15+ times: bing.com/th (possible C2 panel heartbeat)\nEndpoint polled 15+ times: k.clarity.ms/collect (possible C2 panel heartbeat)","origin":"Unknown","mitre_attack_id":"T1071.001","relevance":8,"id":"cdp-8606","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contacts Mail Related Domain Names","description":"\"clicks.customeremail.microsoftrewards.com\" is probably a mail server","origin":"Network Traffic","mitre_attack_id":"T1071.003","relevance":10,"id":"network-18","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 17 domains and 17 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]}]},"activity":{"stats":{"process_count":21,"spawned_processes_count":21,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":54,"imported_dlls_count":84,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":14,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":13,"dns_resolutions_count":17,"contacted_urls_count":12,"http_requests_count":12},"behavior_tags":["url_encoding"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6af50c634c66ca7a43080b5d","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["USA"],"submit_name":"24d18c38acc8e2d78db277df695f9b6cb96d35d5f0aede01783704a1e7a01cd7.url","analysis_start_time":"2026-11-12T00:46:27+00:00","indicators_count":{"informative":22,"suspicious":2,"malicious":0},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"142.251.211.110","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"address":"142.251.155.119","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"address":"142.251.16.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"address":"142.251.150.120","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"address":"142.251.211.202","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"address":"142.251.151.7","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"address":"4.153.187.221","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"address":"172.175.38.6","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"address":"142.250.72.14","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"address":"142.251.111.188","port":5228,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"address":"142.251.211.110","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"address":"142.251.179.19","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"address":"142.251.153.120","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]}],"dns_resolutions":[{"domain":"accounts.google.com","address":"142.251.16.84","ttl":162,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"ns1.google.com","registrar_creation_date":"1997-09-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"android.clients.google.com","address":"142.251.211.110","ttl":155,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"ns1.google.com","registrar_creation_date":"1997-09-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"c.clarity.ms","address":"150.171.110.7","ttl":516,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"chat.google.com","address":"142.251.211.110","ttl":190,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"clicks.customeremail.microsoftrewards.com","address":"150.171.110.7","ttl":3210,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"clients1.google.com","address":"142.251.211.110","ttl":262,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"clients2.google.com","address":"142.251.211.110","ttl":215,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"ns1.google.com","registrar_creation_date":"1997-09-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"k.clarity.ms","address":"172.175.38.6","ttl":2970,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"mail.google.com","address":"142.251.179.19","ttl":190,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"mtalk.google.com","address":"142.251.111.188","ttl":244,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"ogads-pa.clients6.google.com","address":"142.251.211.202","ttl":161,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"play.google.com","address":"142.251.151.7","ttl":28,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"scripts.clarity.ms","address":"150.171.110.7","ttl":550,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"ssl.gstatic.com","address":"142.251.150.120","ttl":281,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"www.clarity.ms","address":"4.153.187.221","ttl":262,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"www.google.com","address":"142.251.155.119","ttl":162,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"domain":"www.gstatic.com","address":"142.251.150.120","ttl":214,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]}],"http_requests":[{"host":"www.clarity.ms","host_ip":"4.153.187.221:443","url":"/tag/u5byer2ci8?ref=npm","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /tag/u5byer2ci8?ref=npm HTTP/1.1\nHost: www.clarity.ms\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Google Chrome\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: cross-site\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: script\nSec-Fetch-Storage-Access: active\nReferer: https://rewards.bing.com/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"host":"k.clarity.ms","host_ip":"172.175.38.6:443","url":"/collect","method":"POST","response_code":"204","response_phrase":"No Content","header":"POST /collect HTTP/1.1\nHost: k.clarity.ms\nConnection: keep-alive\nContent-Length: 828\nsec-ch-ua-platform: \"Windows\"\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nAccept: application/x-clarity-gzip\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Google Chrome\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nOrigin: https://rewards.bing.com\nSec-Fetch-Site: cross-site\nSec-Fetch-Mode: cors\nSec-Fetch-Dest: empty\nSec-Fetch-Storage-Access: active\nReferer: https://rewards.bing.com/\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9\nCookie: MUID=284A513A769F64672262493577C165F1","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"host":"www.google.com","host_ip":"142.251.155.119:443","url":"/async/folae?async=_fmt:pb","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /async/folae?async=_fmt:pb HTTP/2\nHost: www.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"host":"www.google.com","host_ip":"142.251.155.119:443","url":"/async/ddljson?async=ntp:2","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /async/ddljson?async=ntp:2 HTTP/2\nHost: www.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"host":"www.google.com","host_ip":"142.251.155.119:443","url":"/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2\nHost: www.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nX-Client-Data: CKGQywE=\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"host":"www.google.com","host_ip":"142.251.155.119:443","url":"/async/newtab_ogb?hl=en-US&async=fixed:0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2\nHost: www.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nX-Client-Data: CKGQywE=\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"host":"www.google.com","host_ip":"142.251.155.119:443","url":"/async/newtab_promos","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /async/newtab_promos HTTP/2\nHost: www.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"host":"clicks.customeremail.microsoftrewards.com","host_ip":"150.171.110.7:443","url":"/CL0/https://go.microsoft.com/fwlink/%3FLinkId=2383438&lid=s8g2bmq5y78v/1/010001a1c190f402-dc30cb16-6aed-4db1-b4bc-0fd9fac669ee-000000/tEp41RVpLp6b1R3w1i7tizj6IXIHsYJodYSrSMZ80Cw=452","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /CL0/https://go.microsoft.com/fwlink/%3FLinkId=2383438&lid=s8g2bmq5y78v/1/010001a1c190f402-dc30cb16-6aed-4db1-b4bc-0fd9fac669ee-000000/tEp41RVpLp6b1R3w1i7tizj6IXIHsYJodYSrSMZ80Cw=452 HTTP/2\nHost: clicks.customeremail.microsoftrewards.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: navigate\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nSec-Fetch-User: ?1\nPriority: u=0, i\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Google Chrome\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: document","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"host":"c.clarity.ms","host_ip":"150.171.110.7:443","url":"/c.gif","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /c.gif HTTP/2\nHost: c.clarity.ms\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://rewards.bing.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Google Chrome\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"host":"scripts.clarity.ms","host_ip":"150.171.110.7:443","url":"/0.8.73-beta/clarity.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /0.8.73-beta/clarity.js HTTP/2\nHost: scripts.clarity.ms\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://rewards.bing.com/\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Google Chrome\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nAccept: */*\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"host":"c.clarity.ms","host_ip":"150.171.110.7:443","url":"/c.gif?ctsa=mr&CtsSyncId=952B193900624CD292E8726F3E17BE07&MUID=284A513A769F64672262493577C165F1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /c.gif?ctsa=mr&CtsSyncId=952B193900624CD292E8726F3E17BE07&MUID=284A513A769F64672262493577C165F1 HTTP/2\nHost: c.clarity.ms\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://rewards.bing.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: MUID=39AA5435CC716B1C34DE4C3AC87165F6\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Google Chrome\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"host":"chat.google.com","host_ip":"142.251.211.110:443","url":"/.well-known/web-app-origin-association","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /.well-known/web-app-origin-association HTTP/2\nHost: chat.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}],"processes":[{"pid":1756,"ppid":0,"name":"chrome.exe","command_line":"$3c","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","uid":"00000000-00001756","icon":"$3d"},{"pid":4364,"ppid":1756,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\tmpnhywp_85 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\tmpnhywp_85\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=145.0.7632.75 --initial-client-data=0x164,0x168,0x16c,0x134,0x170,0x7ffaa3f200a8,0x7ffaa3f200b4,0x7ffaa3f200c0","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00004364"},{"pid":8,"ppid":1756,"name":"chrome.exe","command_line":"$3e","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00000008"},{"pid":5464,"ppid":1756,"name":"chrome.exe","command_line":"$3f","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00005464"},{"pid":1776,"ppid":1756,"name":"chrome.exe","command_line":"$40","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00001776"},{"pid":7032,"ppid":1756,"name":"chrome.exe","command_line":"$41","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00007032"},{"pid":8000,"ppid":1756,"name":"chrome.exe","command_line":"$42","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00008000"},{"pid":5836,"ppid":1756,"name":"chrome.exe","command_line":"$43","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00005836"},{"pid":8104,"ppid":1756,"name":"chrome.exe","command_line":"$44","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00008104"},{"pid":7400,"ppid":1756,"name":"chrome.exe","command_line":"$45","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00007400"},{"pid":4652,"ppid":1756,"name":"chrome.exe","command_line":"$46","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00004652"},{"pid":5436,"ppid":1756,"name":"chrome.exe","command_line":"$47","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00005436"},{"pid":7064,"ppid":1756,"name":"chrome.exe","command_line":"$48","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00007064"},{"pid":7188,"ppid":1756,"name":"chrome.exe","command_line":"$49","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00007188"},{"pid":1932,"ppid":1756,"name":"chrome.exe","command_line":"$4a","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00001932"},{"pid":3092,"ppid":1756,"name":"chrome.exe","command_line":"$4b","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00003092"},{"pid":2064,"ppid":1756,"name":"chrome.exe","command_line":"$4c","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00002064"},{"pid":5476,"ppid":1756,"name":"chrome.exe","command_line":"$4d","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00005476"},{"pid":3084,"ppid":1756,"name":"chrome.exe","command_line":"$4e","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00003084"},{"pid":1264,"ppid":1756,"name":"chrome.exe","command_line":"$4f","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00001264"},{"pid":452,"ppid":1756,"name":"chrome.exe","command_line":"$50","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001756","uid":"00000000-00000452"}],"all_imported_dlls":["gdi32full.dll","msvcp_win.dll","dxil.dll","rasadhlp.dll","fastprox.dll","shell32.dll","combase.dll","D3DSCache.dll","cfgmgr32.dll","clbcatq.dll","cryptbase.dll","dcomp.dll","mswsock.dll","ntmarta.dll","kernel32.dll","vk_swiftshader.dll","dxcompiler.dll","oleaut32.dll","nlansp_c.dll","bcryptprimitives.dll","sechost.dll","DWrite.dll","IPHLPAPI.DLL","WinTypes.dll","twinapi.appcore.dll","ntdll.dll","imm32.dll","libGLESv2.dll","libEGL.dll","d3d10warp.dll","nsi.dll","ISK8KJh8.dll","dxilconv.dll","advapi32.dll","win32u.dll","DXCore.dll","ResourcePolicyClient.dll","mfplat.dll","d3dcompiler_47.dll","dwmapi.dll","FWPUCLNT.DLL","kernel.appcore.dll","apphelp.dll","shlwapi.dll","msctf.dll","dhcpcsvc6.dll","dnsapi.dll","wbemcomn.dll","profapi.dll","version.dll","ucrtbase.dll","npmproxy.dll","D3D12Core.dll","msvcrt.dll","SHCore.dll","gdi32.dll","uxtheme.dll","ws2_32.dll","winmm.dll","amsi.dll","directml.dll","d3d11.dll","dhcpcsvc.dll","wbemsvc.dll","D3D12.dll","user32.dll","mf.dll","AcLayers.dll","crypt32.dll","dxgi.dll","directxdatabasehelper.dll","RTWorkQ.dll","mfcore.dll","wbemprox.dll","userenv.dll","KernelBase.dll","dpapi.dll","windows.storage.dll","rpcrt4.dll","chrome.dll","ole32.dll","netprofm.dll","MpOAV.dll","chrome_elf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"pipe\\crashpad_1756_ZPXSJETRXBHEULVQ","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"path":"pipe\\LOCAL\\mojo.7032.5364.9631773212127593727","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"path":"pipe\\LOCAL\\mojo.8000.860.9508245035850728948","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"path":"pipe\\LOCAL\\mojo.7400.3408.12255872898711046756","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"path":"pipe\\LOCAL\\mojo.5436.800.6176330806721729073","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"path":"pipe\\LOCAL\\mojo.7064.3944.11697984369923760289","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"path":"pipe\\LOCAL\\mojo.7188.1568.1122856659803073301","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"path":"pipe\\LOCAL\\mojo.1932.4708.5540117642492507323","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"path":"pipe\\LOCAL\\mojo.3092.6608.14376732279293254303","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"path":"pipe\\LOCAL\\mojo.2064.5440.207468109351648250","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"path":"pipe\\LOCAL\\mojo.3084.80.10872082182162283900","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"path":"pipe\\LOCAL\\mojo.1264.4268.17725303730975890714","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:4364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"Local\\SM0:4364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"Local\\SM0:8:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:8:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:8:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"Local\\SM0:5464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:5464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1776:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:1776:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7032:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:7032:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8000:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:8000:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:5836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:8104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7400:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:7400:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4652:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4652:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"Local\\SM0:4652:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:4652:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:5436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:7064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:7188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1932:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:1932:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:3092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:2064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3084:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:3084:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1264:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:1264:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:452:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:452:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:452:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"Local\\SM0:452:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:452:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]},{"name":"SM0:452:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af50c634c66ca7a43080b5d"}]}]}},"report_ids":{"sandbox_job_ids":["6af50c634c66ca7a43080b5d"]}}}]]}] 2c:[["$","title","0",{"children":"Sample 24d18c38acc8… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 24d18c38acc8…. Threat score 0/100. 0/6 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/24d18c38acc8e2d78db277df695f9b6cb96d35d5f0aede01783704a1e7a01cd7"}],["$","meta","4",{"property":"og:title","content":"Sample 24d18c38acc8… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 24d18c38acc8…. Threat score 0/100. 0/6 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/24d18c38acc8e2d78db277df695f9b6cb96d35d5f0aede01783704a1e7a01cd7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 24d18c38acc8… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 24d18c38acc8…. Threat score 0/100. 0/6 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L51","11",{}]] 32:null