26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 3e0a071cde2a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3e0a071cde2a…. Malware family: Trojan.Generic. Threat score 100/100. 14/27 AV engines flagged this file. 13 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3e0a071cde2ad22ba0d3c7bb1f8a838e4e5f1661cbb582bfdba3dcd91e25e63a","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","3e0a071cde2ad22ba0d3c7bb1f8a838e4e5f1661cbb582bfdba3dcd91e25e63a"],"about":{"@type":"SoftwareApplication","name":"3e0a071cde2ad22ba0d3c7bb1f8a838e4e5f1661cbb582bfdba3dcd91e25e63a.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"3e0a071cde2ad22ba0d3c7bb1f8a838e4e5f1661cbb582bfdba3dcd91e25e63a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T502," HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Vary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Site X-Content-Type-Options: nosniff x-cup-server-proof: 3045022020c0a3d8de6f49d8ce99b52f3c9b0711a3de30b6cfce82cc6f878d9cc5149028022100ba827d512c7d9893c3b1824b85cbe038fb7ebfab3390c57d7cc7a7f497c27f61:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ETag: W/"3045022020c0a3d8de6f49d8ce99b52f3c9b0711a3de30b6cfce82cc6f878d9cc5149028022100ba827d512c7d9893c3b1824b85cbe038fb7ebfab3390c57d7cc7a7f497c27f61:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Cache-Control: no-cache no-store max-age=0 must-revalidate Pragma: no-cache Expires: Mon 01 Jan 1990 00:00:00 GMT Date: Mon 08 Jun 2026 08:58:54 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-site Content-Encoding: gzip Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN with response body ==>295D7D270A7B2263757272656E745F74696D655F6D696C6C6973223A313738303930393133343830342C227365727665725F6E6F6E6365223A2D322E33353939....... "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1780909157&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiOTE4ODg4MjI1MDYwMjIzMzE1MiIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 132 Content-Type: application/json; charset=utf-8 Content-Security-Policy: base-uri 'self';block-all-mixed-content;default-src 'self';img-src 'self';object-src 'none';script-src 'none';style-src 'self';upgrade-insecure-requests; X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 70FAB13AFD354A81B812C4102CCB6041 Ref B: SJC211051204037 Ref C: 2026-06-08T08:58:59Z Date: Mon 08 Jun 2026 08:58:59 GMT with response body ==>7B2261737369676E6D656E74436F6E74657874223A223437444551706A38484253612B2F54496D572B354A4365755165526B6D354E4D704A575A473368537546....... "GET /lightning/api/v1/PageConfig?uiaVersion=1.1&trafficSource= HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive X-IsManagedDevice: false Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 51035 Content-Type: application/json; charset=utf-8 X-FALCON-REF: Ref A: 3DB05F316F6C494B855E4B5D08CF9A39 Ref B: SC-WUS2-9PTZQ_AKS-GEN10-81428366-VMSS00000A_FABRICROUTER-AZUREGLOBALPRIVATE-7B6F57BCF4-V8DVR Ref C: 2026-06-08T08:59:00Z X-Falcon-RouterStatusCode: SuccessfullyForwarded (200) X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 3DB05F316F6C494B855E4B5D08CF9A39 Ref B: SJC211051201017 Ref C: 2026-06-08T08:59:00Z Date: Mon 08 Jun 2026 08:58:59 GMT with response body ==>7B2273686F756C64496D706F7274223A747275652C22696D706F727450617373776F7264223A747275652C22696E697469616C55726C223A2268747470733A2F....... "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1780909164&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiLTU1NjY1MDYyMDA2MTYxMjQxOTUiLCI2Ijoic3RhYmxlIiwiOSI6ImRlc2t0b3AifQ== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 132 Content-Type: application/json; charset=utf-8 Content-Security-Policy: base-uri 'self';block-all-mixed-content;default-src 'self';img-src 'self';object-src 'none';script-src 'none';style-src 'self';upgrade-insecure-requests; X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 14705DB3B72C48BEBDEE25BE5EAC1832 Ref B: BY1AA1072320054 Ref C: 2026-06-08T08:59:06Z Date: Mon 08 Jun 2026 08:59:05 GMT with response body ==>7B2261737369676E6D656E74436F6E74657874223A223437444551706A38484253612B2F54496D572B354A4365755165526B6D354E4D704A575A473368537546....... "GET /lightning/api/v1/PageConfig?uiaVersion=1.1&trafficSource= HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive X-IsManagedDevice: false Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 51035 Content-Type: application/json; charset=utf-8 X-FALCON-REF: Ref A: 8A15E0FE443F444790362C472B761F89 Ref B: SC-WUS2-22BW6_AKS-GEN20-14445459-VMSS000000_FABRICROUTER-AZUREGLOBALPRIVATE-5F86685996-LNGCQ Ref C: 2026-06-08T08:59:07Z X-Falcon-RouterStatusCode: SuccessfullyForwarded (200) X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 8A15E0FE443F444790362C472B761F89 Ref B: BY1AA1072317042 Ref C: 2026-06-08T08:59:07Z Date: Mon 08 Jun 2026 08:59:06 GMT with response body ==>7B2273686F756C64496D706F7274223A747275652C22696D706F727450617373776F7264223A747275652C22696E697469616C55726C223A2268747470733A2F....... "GET /time/1/current?cup2key=9:uwuIkTfHxelpOWA99yCkZ_hYVrYWm63UFFE_G_T4nA0&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1 Host: clients2.google.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Vary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Site X-Content-Type-Options: nosniff x-cup-server-proof: 3046022100aace1bb3eba5f2cd382c1411e51a46d86802e74ad23fb0065b3218b386eba02c022100be6156261d839c0446394aae86387cec500cd6f48d45e7421c23029257df7366:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ETag: W/"3046022100aace1bb3eba5f2cd382c1411e51a46d86802e74ad23fb0065b3218b386eba02c022100be6156261d839c0446394aae86387cec500cd6f48d45e7421c23029257df7366:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Cache-Control: no-cache no-store max-age=0 must-revalidate Pragma: no-cache Expires: Mon 01 Jan 1990 00:00:00 GMT Date: Mon 08 Jun 2026 08:59:14 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-site Content-Encoding: gzip Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN with response body ==>295D7D270A7B2263757272656E745F74696D655F6D696C6C6973223A313738303930393135343337302C227365727665725F6E6F6E6365223A312E3039343431....... "GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 08 Jun 2026 08:59:20 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=tQj4FuFdjQ6XsaDFGERL9Hp7216Qk9CMWbVy.0T9d_E-1780909160.2511163-1.0.1.1-yaDkZUK0Q0aGbbIDL7_pWMslfvF14YfTXBA5V.vzTVU_2EkQV.W2CUStKfFkq1usg3rfdaqb6wf3dCvpOI4lBppy6gUDXRaSlUic1YUWT73rTAT4hnrZMkChJsT_bHcH; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 08 Jun 2026 09:29:20 GMT Server: cloudflare CF-RAY: a086b32b9886171a-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-144.0.7559.133 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Mon 08 Jun 2026 08:58:55 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7098 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 7135 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY= Sec-Fetch-Site: none A-Im: x-bm,gzip Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-gzip Date: Mon 08 Jun 2026 08:58:55 GMT X-Country: us Content-Security-Policy: sandbox allow-downloads allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-scripts allow-storage-access-by-user-activation allow-top-navigation allow-top-navigation-by-user-activation allow-top-navigation-to-custom-protocols Im: gzip X-Content-Type-Options: nosniff X-Xss-Protection: 0 X-Seed-Signature: MEUCIQChvwqG+TpLu20olakYLiXERI2V0PF6AZN65ffL8Es5CwIgZTB5hn/ZYtEZflO1D9CuI/iGTK6PrCtR60M8O9rZqoA= X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy: same-origin X-Geo-Level-1: us-il Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/ohttp-keys Date: Mon 08 Jun 2026 08:12:05 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Cache-Control: public max-age=3600 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 2810 with no response body "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AJ5rDhE48-yl7Eg8F5OoYkXWLGbYw9IhhRwMkcdJ-JqmjJ0DAIm2F59fuZghjh6luCMawzj6 Date: Sun 07 Jun 2026 21:55:23 GMT Server: UploadServer Last-Modified: Tue 19 May 2026 19:10:52 GMT Expires: Mon 07 Jun 2027 21:55:23 GMT Etag: 686d4ec9_e4c2c956_6bb9e431_3e1e6e46_3e0d24d2 Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 39813 X-Goog-Hash: crc32c=ubY9Gw== with response body ==>BINARY_CONTENT....... "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Ms-Cv: Gnd3hinUsXMMGkQdE/z6RE Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Mon 08 Jun 2026 08:58:59 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7098 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 7139 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /b?rn=1780909162748&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B44CEA7D8446A12057FD9D5D9EA6B0C&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/2 Host: sb.scorecardresearch.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Date: Mon 08 Jun 2026 08:59:04 GMT X-Amz-Cf-Pop: MSP50-P1 Set-Cookie: XID=16Cb0b2d77b3646194c06581780909144; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Location: /b2?rn=1780909162748&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B44CEA7D8446A12057FD9D5D9EA6B0C&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null X-Cache: Miss from cloudfront Accept-Ch: UA Platform Arch Model Mobile X-Amz-Cf-Id: OfMEdK1A8hf5UpaldvAMs7Iwe6IZVGbaZtWda6JLYb5UOnRneWzdRg== Via: 1.1 a4084232b6b2e1896161a2ecce3f515c.cloudfront.net (CloudFront) with no response body "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Ms-Cv: kXHgSBdtLV2gzhysm4gEbD Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Mon 08 Jun 2026 08:59:06 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7098 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 7146 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /b?rn=1780909169330&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2D6D8D57BEAA678D27439A25BF6666E4&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/2 Host: sb.scorecardresearch.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Date: Mon 08 Jun 2026 08:59:10 GMT X-Amz-Cf-Pop: MSP50-P1 Set-Cookie: XID=1C4e0c267ff828390a2fbc31780909150; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Location: /b2?rn=1780909169330&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2D6D8D57BEAA678D27439A25BF6666E4&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null X-Cache: Miss from cloudfront Accept-Ch: UA Platform Arch Model Mobile X-Amz-Cf-Id: 7S4Yt9tId1hoGKoU7hMWFv6xuaUtpu2cP49qUhCuD9opMUj32__3vw== Via: 1.1 a832a4b62a3204613d34ee439d43821e.cloudfront.net (CloudFront) with no response body "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AJ5rDhE48-yl7Eg8F5OoYkXWLGbYw9IhhRwMkcdJ-JqmjJ0DAIm2F59fuZghjh6luCMawzj6 Date: Sun 07 Jun 2026 21:55:23 GMT Server: UploadServer Last-Modified: Tue 19 May 2026 19:10:52 GMT Expires: Mon 07 Jun 2027 21:55:23 GMT Etag: 686d4ec9_e4c2c956_6bb9e431_3e1e6e46_3e0d24d2 Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 39830 X-Goog-Hash: crc32c=ubY9Gw== with response body ==>BINARY_CONTENT....... "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-144.0.7559.133 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Mon 08 Jun 2026 08:59:14 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7098 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 7154 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY= Sec-Fetch-Site: none A-Im: x-bm,gzip Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-gzip Date: Mon 08 Jun 2026 08:59:14 GMT X-Country: us Content-Security-Policy: sandbox allow-downloads allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-scripts allow-storage-access-by-user-activation allow-top-navigation allow-top-navigation-by-user-activation allow-top-navigation-to-custom-protocols Im: gzip X-Content-Type-Options: nosniff X-Xss-Protection: 0 X-Seed-Signature: MEQCIHlEkcdagQN9PmeZqoeiKUP93Clc/pHl1CU1QiOku6v/AiAM9BbFxR7CQIPjeHP+72dVsixhvJhC6fzMTn1rQpMb5g== X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy: same-origin X-Geo-Level-1: us-il Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/ohttp-keys Date: Mon 08 Jun 2026 08:12:05 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Cache-Control: public max-age=3600 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 2829 with no response body2e:T136f," "504F5354202F4C6973744163636F756E74733F67707369613D3126736F757263653D4368726F6D69756D42726F77736572266A736F6E3D7374616E64617264266C61663D62363462696E20485454502F320A486F73743A206163636F756E74732E676F6F676C652E636F6D0A557365722D4167656E743A204D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2057696E36343B2078363429204170706C655765624B69742F3533372E333620284B48544D4C2C206C696B65204765636B6F29204368726F6D652F3134342E302E302E30205361666172692F3533372E33360A436F6E74656E742D547970653A206170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F6465640A5365632D46657463682D4D6F64653A206E6F2D636F72730A5365632D46657463682D536974653A206E6F6E650A4163636570742D4C616E67756167653A20656E2D55532C656E3B713D302E390A4F726967696E3A2068747470733A2F2F7777772E676F6F676C652E636F6D0A5072696F726974793A20753D342C20690A4163636570742D456E636F64696E673A20677A69702C206465666C6174652C2062722C207A7374640A5365632D46657463682D446573743A20656D7074790A" HTTP/2 200 OK Content-Type: application/binary Date: Mon 08 Jun 2026 08:58:55 GMT Server: ESF Expires: Mon 01 Jan 1990 00:00:00 GMT Vary: Origin Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://www.google.com Reporting-Endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjUtHikmJw0pBiOHxtB5Meyy0mIyDW1PNl0wVi84n-bNZALMTDcb5j1kU2gRWTGrczKekm5RfGZ6ak5pVkllTmZBaXJCYn55fmlRQXpxaVpRbFGxkYmRmYGhvqGRjHFxgAAKBsHws" Access-Control-Allow-Credentials: true Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data:;report-uri /_/IdentityListAccountsHttp/cspreport/fine-allowlist X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2 Host: accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Origin: https://www.google.com Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "504F5354202F4C6973744163636F756E74733F67707369613D3126736F757263653D4368726F6D69756D42726F77736572266A736F6E3D7374616E64617264266C61663D62363462696E20485454502F320A486F73743A206163636F756E74732E676F6F676C652E636F6D0A557365722D4167656E743A204D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2057696E36343B2078363429204170706C655765624B69742F3533372E333620284B48544D4C2C206C696B65204765636B6F29204368726F6D652F3134342E302E302E30205361666172692F3533372E33360A436F6E74656E742D547970653A206170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F6465640A5365632D46657463682D4D6F64653A206E6F2D636F72730A5365632D46657463682D536974653A206E6F6E650A4163636570742D4C616E67756167653A20656E2D55532C656E3B713D302E390A4F726967696E3A2068747470733A2F2F7777772E676F6F676C652E636F6D0A5072696F726974793A20753D342C20690A4163636570742D456E636F64696E673A20677A69702C206465666C6174652C2062722C207A7374640A5365632D46657463682D446573743A20656D7074790A" HTTP/2 200 OK Content-Type: application/binary Date: Mon 08 Jun 2026 08:59:14 GMT Server: ESF Expires: Mon 01 Jan 1990 00:00:00 GMT Vary: Origin Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://www.google.com Reporting-Endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjUtHikmII1JBiOHxtB5Meyy0mIyDW1PNl0wVi84n-bNZALMTD8ahj1kU2gR0fv3xmVNJNyi-Mz0xJzSvJLKnMySwuSUxOzi_NKykuTi0qSy2KNzIwMjMwNTbUMzCOLzAAAOIcIEo" Access-Control-Allow-Credentials: true Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data:;report-uri /_/IdentityListAccountsHttp/cspreport/fine-allowlist X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body41:T3c10,Process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="%TEMP%\\f1qe3ox1.klh"" (UID: 00000000-00006428) Process "chrome.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\f1qe3ox1.klh" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=1928,i,7408674002954970827,15948234916674421147,262144 --field-trial-handle=2180,i,8221098875937495522,6925706393843592932,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2132 /prefetch:2" (UID: 00000000-00002956) Process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="%TEMP%\\f1qe3ox1.klh" --no-pre-read-main-dll --metrics-shmem-handle=2240,i,7910049612071347,13425149185363501641,524288 --field-trial-handle=2180,i,8221098875937495522,6925706393843592932,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=3988 /prefetch:3" (UID: 00000000-00002128) Process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="%TEMP%\\f1qe3ox1.klh" --no-pre-read-main-dll --metrics-shmem-handle=2348,i,7610960713015035405,8289305232962776712,524288 --field-trial-handle=2180,i,8221098875937495522,6925706393843592932,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3968 /prefetch:8" (UID: 00000000-00007408) Process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\f1qe3ox1.klh" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2499329811 --metrics-shmem-handle=3084,i,1834696665090154923,14389617033982738161,2097152 --field-trial-handle=2180,i,8221098875937495522,6925706393843592932,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4184 /prefetch:1" (UID: 00000000-00005448) Process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\f1qe3ox1.klh" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2499639363 --metrics-shmem-handle=2788,i,1714132959338745752,14867268288370350947,2097152 --field-trial-handle=2180,i,8221098875937495522,6925706393843592932,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4232 /prefetch:1" (UID: 00000000-00002068) Process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\f1qe3ox1.klh" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2499936031 --metrics-shmem-handle=3284,i,7002786489059456383,10838105867266368293,2097152 --field-trial-handle=2180,i,8221098875937495522,6925706393843592932,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4216 /prefetch:1" (UID: 00000000-00000932) Process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\f1qe3ox1.klh" --extension-process --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2500247759 --metrics-shmem-handle=3304,i,15237645340973156718,1394711285230028576,2097152 --field-trial-handle=2180,i,8221098875937495522,6925706393843592932,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4272 /prefetch:2" (UID: 00000000-00001892) Process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\f1qe3ox1.klh" --extension-process --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2500510114 --metrics-shmem-handle=3840,i,11826340801036410901,10689896772427418715,2097152 --field-trial-handle=2180,i,8221098875937495522,6925706393843592932,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3280 /prefetch:2" (UID: 00000000-00007744) Process "chrome.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="%TEMP%\\f1qe3ox1.klh" --no-pre-read-main-dll --metrics-shmem-handle=3384,i,12819698943513200430,12696853946333257831,524288 --field-trial-handle=2180,i,8221098875937495522,6925706393843592932,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3124 /prefetch:8" (UID: 00000000-00002160) Process "msedge.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="%TEMP%\\ro40iobv.x4d"" (UID: 00000000-00003540) Process "msedge.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\ro40iobv.x4d" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --startup-read-main-dll --metrics-shmem-handle=1956,i,16380761353523088946,7568956934762028051,262144 --field-trial-handle=2364,i,2557535037747374424,3221402774315987184,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2360 /prefetch:2" (UID: 00000000-00006364) Process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="%TEMP%\\ro40iobv.x4d" --startup-read-main-dll --metrics-shmem-handle=2176,i,12024028749719451152,12499594135366575751,524288 --field-trial-handle=2364,i,2557535037747374424,3221402774315987184,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=264 /prefetch:3" (UID: 00000000-00006516) Process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="%TEMP%\\ro40iobv.x4d" --startup-read-main-dll --metrics-shmem-handle=2404,i,4744136723579570121,14310407437226654276,524288 --field-trial-handle=2364,i,2557535037747374424,3221402774315987184,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=4768 /prefetch:8" (UID: 00000000-00006352) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\ro40iobv.x4d" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2505070003 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3036,i,7740768356765241281,788145477473665523,2097152 --field-trial-handle=2364,i,2557535037747374424,3221402774315987184,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4732 /prefetch:1" (UID: 00000000-00000200) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\ro40iobv.x4d" --instant-process --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2505530140 --skip-read-main-dll --metrics-shmem-handle=3052,i,3119628016863207733,17072778560667364762,2097152 --field-trial-handle=2364,i,2557535037747374424,3221402774315987184,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4844 /prefetch:1" (UID: 00000000-00004216) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\ro40iobv.x4d" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2506214626 --skip-read-main-dll --metrics-shmem-handle=3256,i,13696497605024103056,268485035619312389,2097152 --field-trial-handle=2364,i,2557535037747374424,3221402774315987184,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5052 /prefetch:1" (UID: 00000000-00007804) Process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="%TEMP%\\ro40iobv.x4d" --skip-read-main-dll --metrics-shmem-handle=3352,i,17035131013004230877,17121178819509705191,524288 --field-trial-handle=2364,i,2557535037747374424,3221402774315987184,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5068 /prefetch:8" (UID: 00000000-00006796) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\ro40iobv.x4d" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2506981576 --skip-read-main-dll --metrics-shmem-handle=3420,i,9233127956635405836,813638000927109514,2097152 --field-trial-handle=2364,i,2557535037747374424,3221402774315987184,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5080 /prefetch:1" (UID: 00000000-00005064) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\ro40iobv.x4d" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2507526547 --skip-read-main-dll --metrics-shmem-handle=3364,i,8541778820314431666,5613973591215588982,2097152 --field-trial-handle=2364,i,2557535037747374424,3221402774315987184,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5116 /prefetch:2" (UID: 00000000-00006156) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\ro40iobv.x4d" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2508013866 --skip-read-main-dll --metrics-shmem-handle=3476,i,1812352424473505931,1882779427749194925,2097152 --field-trial-handle=2364,i,2557535037747374424,3221402774315987184,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5184 /prefetch:1" (UID: 00000000-00006804) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\ro40iobv.x4d" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2508409003 --skip-read-main-dll --metrics-shmem-handle=3508,i,155311463041361402,15938993906924244896,2097152 --field-trial-handle=2364,i,2557535037747374424,3221402774315987184,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5280 /prefetch:2" (UID: 00000000-00003180) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\ro40iobv.x4d" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2508827632 --skip-read-main-dll --metrics-shmem-handle=3528,i,13836108580876441120,9699460226915930677,2097152 --field-trial-handle=2364,i,2557535037747374424,3221402774315987184,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5276 /prefetch:1" (UID: 00000000-00004512) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\ro40iobv.x4d" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2509187451 --skip-read-main-dll --metrics-shmem-handle=3560,i,12637876505296502427,15727617687367639032,2097152 --field-trial-handle=2364,i,2557535037747374424,3221402774315987184,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=3472 /prefetch:2" (UID: 00000000-00003112) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\ro40iobv.x4d" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --time-ticks-at-unix-epoch=-1780906654380874 --launch-time-ticks=2509591486 --skip-read-main-dll --metrics-shmem-handle=3584,i,10413978234865945491,12862451478624162616,2097152 --field-trial-handle=2364,i,2557535037747374424,3221402774315987184,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5320 /prefetch:1" (UID: 00000000-00007080)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3e0a071cde2ad22ba0d3c7bb1f8a838e4e5f1661cbb582bfdba3dcd91e25e63a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790650109799,"unified_at":"2026-09-29T02:48:29.799Z","metadata":{"hashes":{"sha256":"3e0a071cde2ad22ba0d3c7bb1f8a838e4e5f1661cbb582bfdba3dcd91e25e63a","sha1":"64531a956caa5220740fb87b1955ee1a3f1a3910","md5":"9743f6e6eeeb7aec1ba0424b19d2fa6c","sha512":"4ba0ca3ca70b7e46cf5b1c88837b62731994fb1dd3a7496803f547bf5ef9ea50254e4b4531196b63970c9a5f994a53ce23107957826ce7c7d4f9cc293a2de593","ssdeep":"49152:/hfR7nOFPX8TvO3d9LTdb8nE1sni1xXQA:/BRyJX9vLG1niTX1","ssdeep_chunks":["49152:/hfR7nO","49152:hfR7nOF","49152:fR7nOFP","49152:R7nOFPX","49152:7nOFPX8","49152:nOFPX8T","49152:OFPX8Tv","49152:FPX8TvO","49152:PX8TvO3","49152:X8TvO3d","49152:8TvO3d9","49152:TvO3d9L","49152:vO3d9LT","49152:O3d9LTd","49152:3d9LTdb","49152:d9LTdb8","49152:9LTdb8n","49152:LTdb8nE","49152:Tdb8nE1","49152:db8nE1s","49152:b8nE1sn","49152:8nE1sni","49152:nE1sni1","49152:E1sni1x","49152:1sni1xX","49152:sni1xXQ","49152:ni1xXQA","98304:/hfR7nO","98304:hfR7nOF","98304:fR7nOFP","98304:R7nOFPX","98304:7nOFPX8","98304:nOFPX8T","98304:OFPX8Tv","98304:FPX8TvO","98304:PX8TvO3","98304:X8TvO3d","98304:8TvO3d9","98304:TvO3d9L","98304:vO3d9LT","98304:O3d9LTd","98304:3d9LTdb","98304:d9LTdb8","98304:9LTdb8n","98304:LTdb8nE","98304:Tdb8nE1","98304:db8nE1s","98304:b8nE1sn","98304:8nE1sni","98304:nE1sni1","98304:E1sni1x","98304:1sni1xX","98304:sni1xXQ","98304:ni1xXQA","49152:/BRyJX9","49152:BRyJX9v","49152:RyJX9vL","49152:yJX9vLG","49152:JX9vLG1","49152:X9vLG1n","49152:9vLG1ni","49152:vLG1niT","49152:LG1niTX","49152:G1niTX1"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"3e0a071cde2ad22ba0d3c7bb1f8a838e4e5f1661cbb582bfdba3dcd91e25e63a.bin","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1586688,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1779888740000,"last_seen":1780909096000,"last_multi_scan":1780909096000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["sourcecodeleaked","misakanetwork","botnet","criminal","malicious"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":59},"sandbox_signatures":{"informative_count":108,"suspicious_count":18,"malicious_count":13,"total":139},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.MalwareX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/MSIL.SnakeLogger","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.80191177","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.80191177 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AQGP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Malware.Win32.Gen.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 00584baa1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"PWS-FEFR!9743F6E6EEEB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.MUC1.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Windows system process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"suspicious","value":"Attempts to disable browser security sandbox"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","identifiers":[{"type":"suspicious","value":"Detected system process execution without parameters (likely process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Attempts to identify external IP address"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"PCAP contains base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"malicious","value":"Sends network traffic on a typical mail related ports"},{"type":"suspicious","value":"Contacts Mail Related Domain Names"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\">{@7^8\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$3d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"clientservices.googleapis.com\" has high entropy\n Contacted domain: \"safebrowsingohttpgateway.googleapis.com\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$3e","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"accounts.google.com\" (83 days old)\n Short term registered certificate: \"clients2.google.com\" (83 days old)\n Short term registered certificate: \"clients2.googleusercontent.com\" (83 days old)\n Short term registered certificate: \"clientservices.googleapis.com\" (83 days old)\n Short term registered certificate: \"safebrowsingohttpgateway.googleapis.com\" (83 days old)\n Short term registered certificate: \"www.google.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"142.251.157.119\" on port \"443\"\n HTTPS traffic to \"142.251.219.14\" on port \"443\"\n HTTPS traffic to \"142.251.218.110\" on port \"443\"\n HTTPS traffic to \"142.251.186.84\" on port \"443\"\n HTTPS traffic to \"142.251.218.74\" on port \"443\"\n HTTPS traffic to \"142.251.218.97\" on port \"443\"\n HTTPS traffic to \"18.160.102.123\" on port \"443\"\n HTTPS traffic to \"51.116.246.105\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\f1qe3ox1.klh\"\" (Indicator: \"--user-data-dir\"; File: \"chrome.exe\")\n file/memory contains long string with (Indicator: \"--user-data-dir\"; File: \"chrome.exe\")\n Found string \"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\ro40iobv.x4d\"\" (Indicator: \"--user-data-dir\"; File: \"msedge.exe\")\n file/memory contains long string with (Indicator: \"--user-data-dir\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.OracleClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\" (Indicator: \"System.Data.OracleClient\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a268427fa33132ae70696e1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"