26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 57:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 7196e1100732… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7196e1100732…. Malware family: Trojan.Generic. Threat score 100/100. 14/27 AV engines flagged this file. 11 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7196e1100732cd16d74ba8099bbccc87077a8ce3fe2c4862e2ec6bec76ed2992","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","7196e1100732cd16d74ba8099bbccc87077a8ce3fe2c4862e2ec6bec76ed2992"],"about":{"@type":"SoftwareApplication","name":"7196e1100732cd16d74ba8099bbccc87077a8ce3fe2c4862e2ec6bec76ed2992.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"7196e1100732cd16d74ba8099bbccc87077a8ce3fe2c4862e2ec6bec76ed2992","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tc1a,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007364.00000000.153622.02DE0000.00000004.mdmp, 00000000-00007364.00000000.153622.07540000.00000004.mdmp, 00000000-00007364.00000001.154601.02DE0000.00000004.mdmp, 00000000-00007364.00000001.154601.07540000.00000004.mdmp, 00000000-00007364.00000001.154601.08AD9000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007364.00000000.153622.02DE0000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00007364.00000000.153622.02DE0000.00000004.mdmp, 00000000-00007364.00000001.154601.02DE0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00007364.00000000.153622.02DE0000.00000004.mdmp, 00000000-00007364.00000001.154601.02DE0000.00000004.mdmp") Found string ":new($exception,"FormatHexFileAccessError", ([System.Management.Automation.ErrorCategory]::ReadError), $targetFilePath)" (Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found string "rorMessage -Category ([System.Management.Automation.ErrorCategory]::ParserError) -ErrorId "FormatHexFailureTypeNotSupported"" (Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found string "$errorCategory = [System.Management.Automation.ErrorCategory]::InvalidData" (Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::New($exception, $errorId, $errorCategory, $null)" (Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found string "$ast = [System.Management.Automation.Language.Parser]::ParseFile(($resolvedPath.ProviderPath), [ref] $null, [ref] $parseErrors)" (Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found string "$data = $ast.Find( { $args[0] -is [System.Management.Automation.Language.Hashtable" (Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found string "$errorCategory = [System.Management.Automation.ErrorCategory]::InvalidArgument" (Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::New($exception, $erN" (Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00007364.00000001.154601.02EC7000.00000004.mdmp, 00000000-00007364.00000001.154601.04770000.00000004.mdmp") Found string "policy.3.0.System.Management.Automation.resources" (Source: "00000000-00007364.00000001.154601.07418000.00000004.mdmp") Found string "olicy.3.0.System.Management.Automation.resources_en-US_31bf3856ad364e35" (Source: "00000000-00007364.00000001.154601.07418000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00007364.00000001.154601.07418000.00000004.mdmp")28:T47b,Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\7196e1100732cd16d74ba8099bbccc8707" (Indicator: "add-mppreference"; Source: "00000000-00006980-00000C46-17504450750"), Found reference string "Add-MpPreference -ExclusionPath "C:\7196e1100732cd16d74ba8099bbccc87077a8ce3fe2c4862e2ec6bec76ed2992.bin.exe"" (Indicator: "add-mppreference"; File: "powershell.exe"), Found reference string ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\7196e1100732cd16d74ba8099bbccc87077a8ce3fe2c4862e2ec6bec76ed2992.bin.exe"" (Indicator: "add-mppreference"; Source: "00000000-00007364.00000000.153622.02DE0000.00000004.mdmp 00000000-00007364.00000001.154601.02DE0000.00000004.mdmp"), Found reference string "HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\7196e1100732cd16d74ba8099bbccc87077a8ce3fe2c4862e2ec6bec76ed2992.bin.exe" (Indicator: "add-mppreference"; Source: "00000000-00007364.00000001.154601.02DE0000.00000004.mdmp 00000000-00007364.00000001.154601.08AD9000.00000004.mdmp")29:T7a4," HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Vary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Site X-Content-Type-Options: nosniff x-cup-server-proof: 3044022058e09eab12543a840235bef1a08bdafc6587036c738cea4ae3f8102f7f898bf702202a32b6529b3d6a16e5a47e5f22b250fd5d36220b1a30aed596a0097e9c7e7a3e:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ETag: W/"3044022058e09eab12543a840235bef1a08bdafc6587036c738cea4ae3f8102f7f898bf702202a32b6529b3d6a16e5a47e5f22b250fd5d36220b1a30aed596a0097e9c7e7a3e:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Cache-Control: no-cache no-store max-age=0 must-revalidate Pragma: no-cache Expires: Mon 01 Jan 1990 00:00:00 GMT Date: Mon 08 Jun 2026 13:00:53 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-site Content-Encoding: gzip Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN with response body ==>295D7D270A7B2263757272656E745F74696D655F6D696C6C6973223A313738303932333635333832382C227365727665725F6E6F6E6365223A332E3737303437....... "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1780924179&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiNjcxNjM3OTg2MDgyMzU5Njk3MyIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 151 Content-Type: application/json; charset=utf-8 Content-Security-Policy: base-uri 'self';block-all-mixed-content;default-src 'self';img-src 'self';object-src 'none';script-src 'none';style-src 'self';upgrade-insecure-requests; X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 58219C26123246FFBFFFC76CCEEC6C02 Ref B: SJC211051204009 Ref C: 2026-06-08T13:00:58Z Date: Mon 08 Jun 2026 13:00:58 GMT with response body ==>7B2261737369676E6D656E74436F6E74657874223A222B662B4675444A445A4758397049727263316B5031706C44636E665072543741774A6F2F2B5338446448....... "GET /lightning/api/v1/PageConfig?uiaVersion=1.1&trafficSource= HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive X-IsManagedDevice: false Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 51035 Content-Type: application/json; charset=utf-8 X-FALCON-REF: Ref A: 943BDF844BD54CB7A6F9F3D2F6240985 Ref B: SC-WUS2-9PTZQ_AKS-GEN12-81428366-VMSS000004_FABRICROUTER-AZUREGLOBALPRIVATE-7B6F57BCF4-HXKD7 Ref C: 2026-06-08T13:01:01Z X-Falcon-RouterStatusCode: SuccessfullyForwarded (200) X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 943BDF844BD54CB7A6F9F3D2F6240985 Ref B: BY1AA1072320029 Ref C: 2026-06-08T13:01:01Z Date: Mon 08 Jun 2026 13:01:01 GMT with response body ==>7B2273686F756C64496D706F7274223A747275652C22696D706F727450617373776F7264223A747275652C22696E697469616C55726C223A2268747470733A2F....... "GET /lightning/api/v1/PageConfig?uiaVersion=1.1&trafficSource= HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive X-IsManagedDevice: false Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 51035 Content-Type: application/json; charset=utf-8 X-FALCON-REF: Ref A: DB01EFB935104CBFB63DBB51CB7D3237 Ref B: SC-WUS2-9PTZQ_AKS-GEN11-81428366-VMSS000002_FABRICROUTER-AZUREGLOBALPRIVATE-7B6F57BCF4-XRQW5 Ref C: 2026-06-08T13:01:07Z X-Falcon-RouterStatusCode: SuccessfullyForwarded (200) X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: DB01EFB935104CBFB63DBB51CB7D3237 Ref B: BY1AA1072318034 Ref C: 2026-06-08T13:01:07Z Date: Mon 08 Jun 2026 13:01:06 GMT with response body ==>7B2273686F756C64496D706F7274223A747275652C22696D706F727450617373776F7264223A747275652C22696E697469616C55726C223A2268747470733A2F....... "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1780924331&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiNzA0NTcyOTcxOTkzNzQxNzI2NSIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 149 Content-Type: application/json; charset=utf-8 Content-Security-Policy: base-uri 'self';block-all-mixed-content;default-src 'self';img-src 'self';object-src 'none';script-src 'none';style-src 'self';upgrade-insecure-requests; X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 764096A35D6E4D2AA0C90D3FB5CA9439 Ref B: BY1AA1072319025 Ref C: 2026-06-08T13:01:07Z Date: Mon 08 Jun 2026 13:01:06 GMT with response body ==>7B2261737369676E6D656E74436F6E74657874223A225247326A2B472F777A5A6A41316B66546B50654656697872767A54657A7355426A455667466578504A37....... "GET /time/1/current?cup2key=9:hg5ZmqlMMMRSb9mSdkGD7YtK184jP7yYa4tqz8Wg86I&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1 Host: clients2.google.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Vary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Site X-Content-Type-Options: nosniff x-cup-server-proof: 3046022100c90c7e1ea362254c61703b4950e8cff3609c84e56648412719a868bf86a61db6022100f9f7702a1ed50539fe4135b24e6c0dd24de31a34af4cddb4716a306f7981a599:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ETag: W/"3046022100c90c7e1ea362254c61703b4950e8cff3609c84e56648412719a868bf86a61db6022100f9f7702a1ed50539fe4135b24e6c0dd24de31a34af4cddb4716a306f7981a599:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Cache-Control: no-cache no-store max-age=0 must-revalidate Pragma: no-cache Expires: Mon 01 Jan 1990 00:00:00 GMT Date: Mon 08 Jun 2026 13:01:13 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-site Content-Encoding: gzip Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN with response body ==>295D7D270A7B2263757272656E745F74696D655F6D696C6C6973223A313738303932333637333130312C227365727665725F6E6F6E6365223A362E3632383530....... "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1769953532&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiODIxMzI2MzUyNDU5MzY1OTc1MyIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 132 Content-Type: application/json; charset=utf-8 Content-Security-Policy: base-uri 'self';block-all-mixed-content;default-src 'self';img-src 'self';object-src 'none';script-src 'none';style-src 'self';upgrade-insecure-requests; X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 3367BC4B086B4104A8E73F4A839B50C2 Ref B: BY1AA1072316052 Ref C: 2026-06-08T13:02:25Z Date: Mon 08 Jun 2026 13:02:24 GMT with response body ==>7B2261737369676E6D656E74436F6E74657874223A223437444551706A38484253612B2F54496D572B354A4365755165526B6D354E4D704A575A473368537546....... "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: px.ads.linkedin.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"" Response ==> HTTP/1.1 200 OK Content-Length: 108 Content-Type: image/png Content-Encoding: gzip Vary: Accept-Encoding Set-Cookie: lidc="b=VGST08:s=V:r=V:a=V:p=V:g=3451:u=1:x=1:i=1780923751:t=1781010151:v=2:sig=AQEwGZnw9m0lmuDPYs2Vxbf2bBV9Wy_E"; Expires=Tue 09 Jun 2026 13:02:31 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure LinkedIn-Action: 1 X-Li-Fabric: prod-lva1 Report-To: {"group":"network-errors" "max_age":2592000 "endpoints":[{"url":"https://www.linkedin.com/li/rep"}] "include_subdomains":true} NEL: {"report_to":"network-errors" "max_age":1296000 "success_fraction":0.00066 "failure_fraction":1 "include_subdomains":true} X-Li-Pop: afd-prod-lva1-x X-Li-Proto: http/1.1 X-LI-UUID: AAZTvZ+YU47Iclul4trQSQ== X-Cache: CONFIG_NOCACHE Alt-Svc: h3=":443"; ma=86400 X-MSEdge-Ref: Ref A: A44BD27486154373A0B6321E038CEDBA Ref B: BY1AA1072315054 Ref C: 2026-06-08T13:02:31Z Date: Mon 08 Jun 2026 13:02:30 GMT with response body ==>C289504E470D0A1A0A0000000D494844520000000100000001010300000025C39B56C38A00000003504C5445000000C2A77A3DC39A0000000174524E530040C3....... "GET /entityextractiontemplates/api/v1/assets/find-assets?name=arbitration_priority_list&version=39.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: public max-age=3600 Content-Length: 271 Content-Type: application/json; charset=utf-8 X-Cache: TCP_HIT X-Frame-Options: sameorigin X-MSEdge-Ref: Ref A: 3F945E0F08E54392B0787A08ABB2060B Ref B: BY1AA1072316034 Ref C: 2026-06-08T13:02:37Z Date: Mon 08 Jun 2026 13:02:37 GMT with response body ==>5B7B226E616D65223A226172626974726174696F6E5F7072696F726974795F6C697374222C2275726C223A2268747470733A2F2F656467656173736574736572....... "GET /entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: public max-age=3600 Content-Length: 266 Content-Type: application/json; charset=utf-8 X-Cache: TCP_HIT X-Frame-Options: sameorigin X-MSEdge-Ref: Ref A: CCD9954876514D2F998705B06CC63FF0 Ref B: BY1AA1072316034 Ref C: 2026-06-08T13:02:37Z Date: Mon 08 Jun 2026 13:02:37 GMT with response body ==>5B7B226E616D65223A22656467655F6875625F617070735F6D616E69666573745F677A222C2275726C223A2268747470733A2F2F656467656173736574736572....... "GET /entityextractiontemplates/api/v1/assets/find-assets?name=domains_config_gz&version=3.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: public max-age=3600 Content-Length: 267 Content-Type: application/json; charset=utf-8 X-Cache: TCP_HIT X-Frame-Options: sameorigin X-MSEdge-Ref: Ref A: 7C2E2E80CA1E4E989DA1E65CD8570205 Ref B: BY1AA1072316034 Ref C: 2026-06-08T13:02:39Z Date: Mon 08 Jun 2026 13:02:39 GMT with response body ==>5B7B226E616D65223A22646F6D61696E735F636F6E6669675F677A222C2275726C223A2268747470733A2F2F656467656173736574736572766963652E617A75....... "GET /abusiveadblocking/api/v1/blocklist HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive If-None-Match: "5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B" Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd" Response ==> HTTP/1.1 304 Not Modified Cache-Control: public max-age=43200 Content-Type: application/json; charset=utf-8 Content-Encoding: gzip ETag: "5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B" Vary: Accept-Encoding X-Cache: TCP_HIT X-FALCON-REF: Ref A: C272DE241833454898C2E0A549033D7B Ref B: SC-WUS2-22BW6_AKS-GEN12-14445459-VMSS000001_FABRICROUTER-AZUREGLOBALPRIVATE-5F86685996-P42RL Ref C: 2026-06-08T07:08:24Z X-Falcon-RouterStatusCode: SuccessfullyForwarded (200) X-Mesh-Client-TTL: 72 Strict-Transport-Security: max-age=0 X-MSEdge-Ref: Ref A: 515037CE7746486DBAB7CAC7CCA2E9A7 Ref B: BY1AA1072316031 Ref C: 2026-06-08T13:02:41Z Date: Mon 08 Jun 2026 13:02:41 GMT with no response body "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY= Sec-Fetch-Site: none A-Im: x-bm,gzip Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> no response "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-144.0.7559.133 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Mon 08 Jun 2026 13:00:54 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7098 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 21654 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/ohttp-keys Date: Mon 08 Jun 2026 12:12:05 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Cache-Control: public max-age=3600 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 2930 with no response body "GET /async/folae?async=_fmt:pb HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-protobuffer Date: Mon 08 Jun 2026 13:00:55 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 926515626 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Ms-Cv: ZsIhsSJjk559HD53IoIxTC Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Mon 08 Jun 2026 13:00:58 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7098 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 21658 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Ms-Cv: dIKYGPZiV3uPVs3Tv9AnG+ Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Mon 08 Jun 2026 13:01:07 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7098 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 21667 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/ohttp-keys Date: Mon 08 Jun 2026 12:12:05 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Cache-Control: public max-age=3600 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 2948 with no response body "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY= Sec-Fetch-Site: none A-Im: x-bm,gzip Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-gzip Date: Mon 08 Jun 2026 13:01:13 GMT X-Country: us Content-Security-Policy: sandbox allow-downloads allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-scripts allow-storage-access-by-user-activation allow-top-navigation allow-top-navigation-by-user-activation allow-top-navigation-to-custom-protocols Im: gzip X-Content-Type-Options: nosniff X-Xss-Protection: 0 X-Seed-Signature: MEUCIF1Msoh2/dLSH3rtnXxlnDIs9YjZI+4TnDspLhOQsvtmAiEA6k+2HBnFkdT4AlMp7D6nnGAVsAVbV7xSAMNEY/BhhYQ= X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy: same-origin X-Geo-Level-1: us-il Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-144.0.7559.133 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Mon 08 Jun 2026 13:01:13 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7098 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 21673 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AJ5rDhE48-yl7Eg8F5OoYkXWLGbYw9IhhRwMkcdJ-JqmjJ0DAIm2F59fuZghjh6luCMawzj6 Date: Sun 07 Jun 2026 21:55:23 GMT Server: UploadServer Last-Modified: Tue 19 May 2026 19:10:52 GMT Expires: Mon 07 Jun 2027 21:55:23 GMT Etag: 686d4ec9_e4c2c956_6bb9e431_3e1e6e46_3e0d24d2 Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 54351 X-Goog-Hash: crc32c=ubY9Gw== with response body ==>BINARY_CONTENT....... "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Mon 08 Jun 2026 13:02:31 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940137-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 67262 X-Timer: S1780923752.776538 VS0 VE69 X-Cache: MISS X-Vcl-Time-Ms: 69 Cache-Control: no-cache no-store Accept-Ranges: bytes with response body ==>BINARY_CONTENT....... "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 307 Temporary Redirect Content-Type: text/html; charset=utf-8 Date: Mon 08 Jun 2026 13:02:32 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=4906192068099309451; SameSite=None; Path=/; Max-Age=7776000; Expires=Sun 06-Sep-2026 13:02:32 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: 6702b4cb-0b82-49b7-8f7d-96411e28e414 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 893.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/octet-stream Date: Mon 08 Jun 2026 13:02:38 GMT Last-Modified: Wed 08 Apr 2026 16:21:07 GMT X-Azure-Ref: 20260608T130238Z-17966d8966fjdbskhC1SJCqmqw0000000c30000000006gs6 X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Fd-Int-Roxy-Purgeid: 0 Vary: Accept-Encoding Content-Encoding: br X-Cache: TCP_HIT Cache-Control: public max-age=604800 X-Ms-Request-Id: 34051e5f-001e-004c-6c5a-f55af1000000 X-Ms-Blob-Type: BlockBlob with no response body3c:T3fde,"9iqmgvw,czcnew" - Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mn9iqmgvw,czc250905032048z0/^g(o-cejy" - Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00007364.00000000.153622.07540000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007364.00000001.154601.02DE0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0rsa1" - Source: "00000000-00007364.00000001.154601.02DE0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007364.00000001.154601.02DE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007364.00000001.154601.02DE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007364.00000001.154601.02EC7000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007364.00000001.154601.02EC7000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007364.00000001.154601.02EC7000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007364.00000001.154601.02EC7000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007364.00000001.154601.02EC7000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007364.00000001.154601.02EC7000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007364.00000001.154601.02EC7000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007364.00000001.154601.02EC7000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007364.00000001.154601.02EC7000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcnew" - Source: "00000000-00007364.00000001.154601.07540000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007364.00000001.154601.07595000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00007364.00000001.154601.07595000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007364.00000001.154601.07595000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!k2" - Source: "00000000-00007364.00000001.154601.0761D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-2n0170/0-0" - Source: "00000000-00007364.00000001.154601.08AD9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0washington1redmond1microsoft" - Source: "00000000-00007364.00000001.154601.08AD9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007364.00000001.154601.08AD9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00007364.00000001.154601.08B4B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0djhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007364.00000001.154601.08B6B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr0<0:4http://crl3.digicert.com/digicertcsrsa4096rootg5.crl0a-_97h" - Source: "00000000-00007812.00000001.155559.03390000.00000004.mdmp") Found URL "https://www.newtonsoft.com/json" - Source: "00000000-00007812.00000001.155559.03390000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007812.00000001.155559.6E491000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007812.00000001.155559.6E491000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007812.00000001.155559.6E491000.00000020.mdmp") Found URL "http://e7.i.lencr.org/0" - Source: "00000000-00007812.00000002.157480.03390000.00000004.mdmp") Found URL "http://e7.c.lencr.org/88.crl0u'gh" - Source: "00000000-00007812.00000002.157480.03390000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0http://x1.c.lencr.org/0uc+8)=zzd5n-h_h,n0f&sii" - Source: "00000000-00007812.00000002.157480.03390000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.d9%jr" - Source: "00000000-00007812.00000002.157480.03390000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertcsrsa4096rootg5.crt0e>0<0:4http://crl3.digicert.com/digicertcsrsa4096rootg5.crl0a-_97h" - Source: "00000000-00007812.00000002.157480.03390000.00000004.mdmp") Found URL "https://www.newtonsoft.com/json" - Source: "00000000-00007812.00000002.157480.03390000.00000004.mdmp") Found URL "https://github.com/jamesnk/newtonsoft.jsonen-us*newtonsoft.json.jsonreader+d__19newtonsoft.json.jsonreader+d__2d__5;newtonsoft.json.jsonreader+d__12bnewtonsoft.json.jsonreader+d__140newtonsoft.json.jsontextreader+d__38newtonsoft.json.jsontextreader+d__4:newtonsoft.json.jsontextreader+d__52newtonsoft.json.jsontextreader+d__74newtonsoft.json.jsontextreader+d__8>newtonsoft.json.jsontextreader+d__9@newtonsoft.json.jsontextreader+d__117newtonsoft.json.jsontextreader+d__124newtonsoft.json.jsontextreader+d__146newtonsoft.json.jsontextreader+d__157newtonsoft.json.jsontextreader+d__168newtonsoft.json.jsontextreader+d__176newtonsoft.json.jsontextreader+d__185newtonsoft.json.jsontextreader+d__19jnewtonsoft.json.jsontextreader+d__206newtonsoft.json.jsontextreader+d__21;newtonsoft.json.jsontextreader+d__259newtonsoft.json.jsontextreader+d__26fnewtonsoft.json.jsontextreader+d__27fnewtonsoft.json.jsontextreader+d__286newtonsoft.json.jsontextreader+d__298newtonsoft.json.jsontextreader+d__31?newtonsoft.json.jsontextreader+d__32@newtonsoft.json.jsontextreader+d__337newtonsoft.json.jsontextreader+d__345newtonsoft.json.jsontextreader+d__357newtonsoft.json.jsontextreader+d__36:newtonsoft.json.jsontextreader+d__37:newtonsoft.json.jsontextreader+d__38:newtonsoft.json.jsontextreader+d__408newtonsoft.json.jsontextreader+d__42dnewtonsoft.json.jsontextreader+d__43;newtonsoft.json.jsontextreader+d__45anewtonsoft.json.jsontextreader+d__47:newtonsoft.json.jsontextreader+d__499newtonsoft.json.jsontextreader+d__518newtonsoft.json.jsontextreader+d__539newtonsoft.json.jsontextreader+d__551newtonsoft.json.jsontextwriter+d__8>newtonsoft.json.jsontextwriter+d__96newtonsoft.json.jsontextwriter+d__13=newtonsoft.json.jsontextwriter+d__15d__24>newtonsoft.json.jsontextwriter+d__30>newtonsoft.json.jsontextwriter+d__32d__35=newtonsoft.json.jsontextwriter+d__38bnewtonsoft.json.jsontextwriter+d__40;newtonsoft.json.jsontextwriter+d__43d__547newtonsoft.json.jsontextwriter+d__607newtonsoft.json.jsontextwriter+d__647newtonsoft.json.jsontextwriter+d__787newtonsoft.json.jsontextwriter+d__977newtonsoft.json.jsontextwriter+d__99=newtonsoft.json.jsontextwriter+d__110:newtonsoft.json.jsontextwriter+d__115;newtonsoft.json.jsontextwriter+d__1212newtonsoft.json.jsonwriter+d__19newtonsoft.json.jsonwriter+d__201newtonsoft.json.jsonwriter+d__30d__31;newtonsoft.json.jsonwriter+d__32jnewtonsoft.json.jsonwriter+<g__awaitproperty" - Source: "00000000-00007812.00000002.157480.088C0000.00000004.mdmp") Found URL "https://www.newtonsoft.com/jsonschema" - Source: "00000000-00007812.00000002.157480.088C0000.00000004.mdmp") Found URL "https://www.nuget.org/packages/newtonsoft.json.bson" - Source: "00000000-00007812.00000002.157480.088C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertcsrsa4096rootg5.crt0e>0<0:4http://crl3.digicert.com/digicertcsrsa4096rootg5.crl0a-_97h" - Source: "00000000-00007812.00000002.157480.088C0000.00000004.mdmp") Found URL "https://www.newtonsoft.com/json" - Source: "00000000-00007812.00000002.157480.088C0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00007812.00000002.157480.088C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007812.00000002.157480.088C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00007812.00000002.157480.088C0000.00000004.mdmp") Found URL "http://e7.i.lencr.org/0" - Source: "00000000-00007812.00000002.157480.08990000.00000004.mdmp") Found URL "http://e7.c.lencr.org/88.crl0u'gh" - Source: "00000000-00007812.00000002.157480.08990000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0http://x1.c.lencr.org/0uc+8)=zzd5n-h_h,n0f&sii" - Source: "00000000-00007812.00000002.157480.08990000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0http://x1.c.lencr.org/0uc+8)=zzd5n-h_h,n0f&sii" - Source: "00000000-00007812.00000002.157480.089DF000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007812.00000002.157480.0A490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007812.00000002.157480.0A490000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007812.00000002.157480.0A490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007812.00000002.157480.0A490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007812.00000002.157480.0A490000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007812.00000002.157480.0A490000.00000004.mdmp") Found URL "http://www./w:oet.com/pki/crl/pr/x:tficcertrulispca_2/]:0g2.crlhhttp://cr/^:choft.com/pki/crl//c:uispca/d:9j-02.crl0]/i:qkahtt/j:wlmicrosoft.com/pk/o:rmmiccertrulispca_/p:-n02.crt0/v:3p/" - Source: "00000000-00007812.00000002.157480.0A490000.00000004.mdmp") Found URL "http://crl.mh/.com/pki/crl/prog/crosoftrootcert.b/h0f0d8http://www.micr" - Source: "00000000-00007812.00000002.157480.0A490000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007812.00000002.157480.6E9F1000.00000020.mdmp") Found URL "https://t.me/oldphantomoftheopera" - Source: "00000000-00007812.00000003.163001.00400000.00000040.mdmp") Found URL "https://www.phantomsoftwares.site/home" - Source: "00000000-00007812.00000003.163001.00400000.00000040.mdmp") Found URL "https://www.phantomsoftwares.site/homeploading" - Source: "00000000-00007812.00000003.163001.00400000.00000040.mdmp") Found URL "http://e7.i.lencr.org/0" - Source: "00000000-00007812.00000003.163001.03390000.00000004.mdmp") Found URL "http://e7.c.lencr.org/88.crl0u'gh" - Source: "00000000-00007812.00000003.163001.03390000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0http://x1.c.lencr.org/0uc+8)=zzd5n-h_h,n0f&sii" - Source: "00000000-00007812.00000003.163001.03390000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.d9%jr" - Source: "00000000-00007812.00000003.163001.03390000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertcsrsa4096rootg5.crt0e>0<0:4http://crl3.digicert.com/digicertcsrsa4096rootg5.crl0a-_97h" - Source: "00000000-00007812.00000003.163001.03390000.00000004.mdmp") Found URL "https://www.newtonsoft.com/json" - Source: "00000000-00007812.00000003.163001.03390000.00000004.mdmp") Found URL "http://e7.i.lencr.org/0" - Source: "00000000-00007812.00000003.163001.08990000.00000004.mdmp") Found URL "http://e7.c.lencr.org/88.crl0u'gh" - Source: "00000000-00007812.00000003.163001.08990000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0http://x1.c.lencr.org/0uc+8)=zzd5n-h_h,n0f&sii" - Source: "00000000-00007812.00000003.163001.08990000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0http://x1.c.lencr.org/0uc+8)=zzd5n-h_h,n0f&sii" - Source: "00000000-00007812.00000003.163001.089DF000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007812.00000003.163001.0A490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007812.00000003.163001.0A490000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007812.00000003.163001.0A490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007812.00000003.163001.0A490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007812.00000003.163001.0A490000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007812.00000003.163001.0A490000.00000004.mdmp") Found URL "http://www./w:oet.com/pki/crl/pr/x:tficcertrulispca_2/]:0g2.crlhhttp://cr/^:choft.com/pki/crl//c:uispca/d:9j-02.crl0]/i:qkahtt/j:wlmicrosoft.com/pk/o:rmmiccertrulispca_/p:-n02.crt0/v:3p/" - Source: "00000000-00007812.00000003.163001.0A490000.00000004.mdmp") Found URL "http://crl.mh/.com/pki/crl/prog/crosoftrootcert.b/h0f0d8http://www.micr" - Source: "00000000-00007812.00000003.163001.0A490000.00000004.mdmp")4e:T34ac,GET /time/1/current?cup2key=9:mD4orf9QmmN_4q2siDi_ix99zdb31Capli5AZksfUD0&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1 Host: clients2.google.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Accept-Encoding: gzip deflate GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1780924179&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiNjcxNjM3OTg2MDgyMzU5Njk3MyIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /lightning/api/v1/PageConfig?uiaVersion=1.1&trafficSource= HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive X-IsManagedDevice: false Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1780924331&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiNzA0NTcyOTcxOTkzNzQxNzI2NSIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /time/1/current?cup2key=9:hg5ZmqlMMMRSb9mSdkGD7YtK184jP7yYa4tqz8Wg86I&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1 Host: clients2.google.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Accept-Encoding: gzip deflate GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1769953532&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiODIxMzI2MzUyNDU5MzY1OTc1MyIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: px.ads.linkedin.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67" GET /entityextractiontemplates/api/v1/assets/find-assets?name=arbitration_priority_list&version=39.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /entityextractiontemplates/api/v1/assets/find-assets?name=domains_config_gz&version=3.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /abusiveadblocking/api/v1/blocklist HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive If-None-Match: "5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B" Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip deflate br zstd GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY= Sec-Fetch-Site: none A-Im: x-bm gzip Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-144.0.7559.133 Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /async/folae?async=_fmt:pb HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1 i Ms-Cv: ZsIhsSJjk559HD53IoIxTC Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1 i Ms-Cv: dIKYGPZiV3uPVs3Tv9AnG+ Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Priority: u=1 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty 4f:T7b12,Contains base62 string in header "e3b0c44298fc1c149afbf4c8996fb9242" in header "GET /time/1/current?cup2key=9:mD4orf9QmmN_4q2siDi_ix99zdb31Capli5AZksfUD0&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base62 string in header "eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiL" in header "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1780924179&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1Host: edge.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiNjcxNjM3OTg2MDgyMzU5Njk3MyIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "CI0IjoiNjcxNjM3OTg2MDgyMzU5Njk3My" in header "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1780924179&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1Host: edge.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiNjcxNjM3OTg2MDgyMzU5Njk3MyIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "IsIjYiOiJzdGFibGUiLCI5IjoiZGVza3R" in header "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1780924179&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1Host: edge.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiNjcxNjM3OTg2MDgyMzU5Njk3MyIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiL" in header "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1780924331&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1Host: edge.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiNzA0NTcyOTcxOTkzNzQxNzI2NSIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "CI0IjoiNzA0NTcyOTcxOTkzNzQxNzI2NS" in header "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1780924331&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1Host: edge.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiNzA0NTcyOTcxOTkzNzQxNzI2NSIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "IsIjYiOiJzdGFibGUiLCI5IjoiZGVza3R" in header "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1780924331&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1Host: edge.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiNzA0NTcyOTcxOTkzNzQxNzI2NSIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "hg5ZmqlMMMRSb9mSdkGD7YtK184jP7yYa" in header "GET /time/1/current?cup2key=9:hg5ZmqlMMMRSb9mSdkGD7YtK184jP7yYa4tqz8Wg86I&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base62 string in header "e3b0c44298fc1c149afbf4c8996fb9242" in header "GET /time/1/current?cup2key=9:hg5ZmqlMMMRSb9mSdkGD7YtK184jP7yYa4tqz8Wg86I&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base62 string in header "eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiL" in header "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1769953532&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1Host: edge.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiODIxMzI2MzUyNDU5MzY1OTc1MyIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "CI0IjoiODIxMzI2MzUyNDU5MzY1OTc1My" in header "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1769953532&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1Host: edge.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiODIxMzI2MzUyNDU5MzY1OTc1MyIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "IsIjYiOiJzdGFibGUiLCI5IjoiZGVza3R" in header "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1769953532&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1Host: edge.microsoft.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiODIxMzI2MzUyNDU5MzY1OTc1MyIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "entityextractiontemplates/api/v1/" in header "GET /entityextractiontemplates/api/v1/assets/find-assets?name=arbitration_priority_list&version=39.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "entityextractiontemplates/api/v1/" in header "GET /entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "entityextractiontemplates/api/v1/" in header "GET /entityextractiontemplates/api/v1/assets/find-assets?name=domains_config_gz&version=3.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "5E25271B8190D943537AD3FDB50874FC1" in header "GET /abusiveadblocking/api/v1/blocklist HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveIf-None-Match: "5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B"Sec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstd" Contains base62 string in header "jmjflgjpcpepeafmmgdpfkogkghcpihaX" in header "POST /extensionwebstorebase/v1/crx HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveContent-Length: 942MS-CV: i8qydsp0BLUOx4b7m3T+1rX-Microsoft-Update-AppId: jmjflgjpcpepeafmmgdpfkogkghcpihaX-Microsoft-Update-Interactivity: bgX-Microsoft-Update-Service-Cohort: 1999X-Microsoft-Update-Updater: msedgecrx-145.0.3800.58Content-Type: application/jsonSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: CPn8ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDA" in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2Host: clientservices.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsIf-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY=Sec-Fetch-Site: noneA-Im: x-bm,gzipPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "3Dghbmnnjooekpmoecnnnilnnbdlolhkh" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "3Dnmmhkkegccagdldgiimedpiccmgmied" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "nmmhkkegccagdldgiimedpiccmgmiedaX" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLo" in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: safebrowsingohttpgateway.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneX-Ohttppublickey-Fst: truePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "3Dghbmnnjooekpmoecnnnilnnbdlolhkh" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ZsIhsSJjk559HD53IoIxTCAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "ghbmnnjooekpmoecnnnilnnbdlolhkhiX" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: ZsIhsSJjk559HD53IoIxTCAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "3Dghbmnnjooekpmoecnnnilnnbdlolhkh" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: dIKYGPZiV3uPVs3Tv9AnG+Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "ghbmnnjooekpmoecnnnilnnbdlolhkhiX" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: dIKYGPZiV3uPVs3Tv9AnG+Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "AcPRoer4aKzvumujugdaImkRO90DhvB1j" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "VZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njy" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "KFVYYoc3wd5iackYMogzXtBActnysgvTs" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoA" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "xlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "222166F75FD3671F181970045E3D66DC;" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "253D222166F75FD3671F181970045E3D6" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "AcPRoer4aKzvumujugdaImkRO90DhvB1j" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "VZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njy" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "KFVYYoc3wd5iackYMogzXtBActnysgvTs" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoA" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "xlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_" in header "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty"50:Te8f,Found HTTPS GET request to https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1780924179&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 Found HTTPS GET request to https://edge.microsoft.com/lightning/api/v1/PageConfig?uiaVersion=1.1&trafficSource= Found HTTPS GET request to https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1780924331&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 Found HTTPS GET request to https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1769953532&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 Found HTTPS GET request to https://px.ads.linkedin.com/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= Found HTTPS GET request to https://edge.microsoft.com/entityextractiontemplates/api/v1/assets/find-assets?name=arbitration_priority_list&version=39.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 Found HTTPS GET request to https://edge.microsoft.com/entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 Found HTTPS GET request to https://edge.microsoft.com/entityextractiontemplates/api/v1/assets/find-assets?name=domains_config_gz&version=3.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 Found HTTPS GET request to https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist Found HTTPS POST request to https://edge.microsoft.com/extensionwebstorebase/v1/crx Found HTTPS GET request to https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=144 Found HTTPS GET request to https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 Found HTTPS GET request to https://safebrowsingohttpgateway.googleapis.com/v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE Found HTTPS GET request to https://www.google.com/async/folae?async=_fmt:pb Found HTTPS POST request to https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin Found HTTPS GET request to https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc Found HTTPS GET request to https://clients2.googleusercontent.com/crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx Found HTTPS GET request to https://trc.taboola.com/sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= Found HTTPS GET request to https://m.adnxs.com/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D51:T9e4,"d__29" (Indicator: "base64"; Source: "00000000-00007364.00000001.154601.08D40000.00000004.mdmp") Found string "xmltextwriterbase64encoder" (Indicator: "base64"; Source: "00000000-00007364.00000001.154601.08D40000.00000004.mdmp") Found string "d__146" (Indicator: "base64"; Source: "00000000-00007364.00000001.154601.08D40000.00000004.mdmp") Found string "datatype_base64binary" (Indicator: "base64"; Source: "00000000-00007364.00000001.154601.08D40000.00000004.mdmp") Found string "d__200" (Indicator: "base64"; Source: "00000000-00007364.00000001.154601.08D40000.00000004.mdmp") Found string "base64decoder" (Indicator: "base64"; Source: "00000000-00007364.00000001.154601.08D40000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007364.00000001.154601.08D70000.00000004.mdmp, 00000000-00007364.00000001.154601.08EB0000.00000004.mdmp, 00000000-00007364.00000001.154601.08ED0000.00000004.mdmp, 00000000-00007364.00000001.154601.08EE0000.00000004.mdmp, 00000000-00007364.00000001.154601.08F00000.00000004.mdmp, 00000000-00007364.00000001.154601.08F40000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00007364.00000001.154601.08D70000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007364.00000001.154601.08D70000.00000004.mdmp, 00000000-00007364.00000001.154601.08EB0000.00000004.mdmp, 00000000-00007364.00000001.154601.08ED0000.00000004.mdmp, 00000000-00007364.00000001.154601.08F00000.00000004.mdmp, 00000000-00007364.00000001.154601.08F40000.00000004.mdmp") Found string "soapbase64binary" (Indicator: "base64"; Source: "00000000-00007364.00000001.154601.08D70000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "rijndael"; Source: "00000000-00007364.00000001.154601.08D70000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "Rijndaelmanaged"; Source: "00000000-00007364.00000001.154601.08D70000.00000004.mdmp")53:T645,Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00007364.00000001.154601.02DE0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00007364.00000001.154601.02DE0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00007364.00000001.154601.02DE0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00007364.00000001.154601.08D40000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00007364.00000001.154601.08D40000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00007364.00000001.154601.08D40000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00007364.00000001.154601.08D40000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00007364.00000001.154601.08D70000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00007364.00000001.154601.08D70000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00007364.00000001.154601.08F00000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00007364.00000001.154601.08F00000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00007364.00000001.154601.08F40000.00000004.mdmp")54:T824," "{"request":{"@os":"win","@updater":"msedgecrx","acceptformat":"crx3 download run xz zucc","apps":[{"appid":"jmjflgjpcpepeafmmgdpfkogkghcpiha","cohort":"rrf@0.02","enabled":true,"installdate":6971,"installedby":"other","lang":"en-US","ping":{"ping_freshness":"{9d9e62d6-5520-4108-87f1-23636880fd52}","rd":6971},"targetingattributes":{"AppCohort":"rrf@0.02","AppMajorVersion":"145","AppRollout":0.02,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false},"updatecheck":{},"version":"1.2.1"}],"arch":"x64","dedup":"cr","domainjoined":false,"hw":{"avx":1,"physmemory":8,"sse":1,"sse2":1,"sse3":1,"sse41":1,"sse42":1,"ssse3":1},"ismachine":1,"os":{"arch":"x86_64","platform":"Windows","version":"10.0.16299.248"},"prodversion":"145.0.3800.58","protocol":"4.0","requestid":"{218cf4af-8890-49d4-a52f-8f9f73084c84}","revocationviaomahaenabled":"0","sessionid":"{8955f9d6-6d02-41dc-88e9-a78c9c083800}","updaterversion":"145.0.3800.58"}}" HTTP/1.1 200 OK Cache-Control: no-store must-revalidate no-cache max-age=0 Pragma: no-cache Content-Length: 162 Content-Type: application/json Content-Encoding: gzip Expires: Mon 01 Jan 1990 00:00:00 GMT X-Frame-Options: sameorigin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: B84706CC821E4B1A828FDC77EDC628A4 Ref B: SJC211051205029 Ref C: 2026-06-08T13:02:53Z Date: Mon 08 Jun 2026 13:02:52 GMT with response body ==>295D7D270A7B22726573706F6E7365223A7B2270726F746F636F6C223A22342E30222C22736572766572223A2270726F64222C226461797374617274223A7B22....... "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2 Host: accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Origin: https://www.google.com Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "504F5354202F4C6973744163636F756E74733F67707369613D3126736F757263653D4368726F6D69756D42726F77736572266A736F6E3D7374616E64617264266C61663D62363462696E20485454502F320A486F73743A206163636F756E74732E676F6F676C652E636F6D0A557365722D4167656E743A204D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2057696E36343B2078363429204170706C655765624B69742F3533372E333620284B48544D4C2C206C696B65204765636B6F29204368726F6D652F3134342E302E302E30205361666172692F3533372E33360A436F6E74656E742D547970653A206170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F6465640A5365632D46657463682D4D6F64653A206E6F2D636F72730A5365632D46657463682D536974653A206E6F6E650A4163636570742D4C616E67756167653A20656E2D55532C656E3B713D302E390A4F726967696E3A2068747470733A2F2F7777772E676F6F676C652E636F6D0A5072696F726974793A20753D342C20690A4163636570742D456E636F64696E673A20677A69702C206465666C6174652C2062722C207A7374640A5365632D46657463682D446573743A20656D7074790A" HTTP/2 200 OK Content-Type: application/binary Date: Mon 08 Jun 2026 13:00:55 GMT Server: ESF Expires: Mon 01 Jan 1990 00:00:00 GMT Vary: Origin Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://www.google.com Reporting-Endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjUtHikmJw1ZBiOHxtB5Meyy0mIyDW1PNl0wVi84n-bNZALMTN0f5r1kU2gRuzDvgr6SblF8ZnpqTmlWSWVOZkFpckJifnl-aVFBenFpWlFsUbGRiZGZgaG-oZGMcXGAAAnwIfRA" Access-Control-Allow-Credentials: true Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data:;report-uri /_/IdentityListAccountsHttp/cspreport/fine-allowlist X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2 Host: accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Origin: https://www.google.com Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "504F5354202F4C6973744163636F756E74733F67707369613D3126736F757263653D4368726F6D69756D42726F77736572266A736F6E3D7374616E64617264266C61663D62363462696E20485454502F320A486F73743A206163636F756E74732E676F6F676C652E636F6D0A557365722D4167656E743A204D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2057696E36343B2078363429204170706C655765624B69742F3533372E333620284B48544D4C2C206C696B65204765636B6F29204368726F6D652F3134342E302E302E30205361666172692F3533372E33360A436F6E74656E742D547970653A206170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F6465640A5365632D46657463682D4D6F64653A206E6F2D636F72730A5365632D46657463682D536974653A206E6F6E650A4163636570742D4C616E67756167653A20656E2D55532C656E3B713D302E390A4F726967696E3A2068747470733A2F2F7777772E676F6F676C652E636F6D0A5072696F726974793A20753D342C20690A4163636570742D456E636F64696E673A20677A69702C206465666C6174652C2062722C207A7374640A5365632D46657463682D446573743A20656D7074790A" HTTP/2 200 OK Content-Type: application/binary Date: Mon 08 Jun 2026 13:01:13 GMT Server: ESF Expires: Mon 01 Jan 1990 00:00:00 GMT Vary: Origin Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://www.google.com Reporting-Endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjUtHikmLw0pBiOHxtB5Meyy0mIyDW1PNl0wVi84n-bNZALMTDMfPXrItsAieun2lkVNJNyi-Mz0xJzSvJLKnMySwuSUxOzi_NKykuTi0qSy2KNzIwMjMwNTbUMzCOLzAAAMjZH8g" Access-Control-Allow-Credentials: true Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body "POST /chromewebstore/v1.1/items/verify HTTP/2 Host: www.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Content-Type: application/json Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "{"hash":"7ZeNG1SP1ecxjw0hep9K0CDsE6ucCCPiJm/t2bHNxaM=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}" HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Mon 08 Jun 2026 13:02:38 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff Vary: Referer Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT.......1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"7196e1100732cd16d74ba8099bbccc87077a8ce3fe2c4862e2ec6bec76ed2992","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791164920474,"unified_at":"2026-10-05T01:48:40.474Z","metadata":{"hashes":{"sha256":"7196e1100732cd16d74ba8099bbccc87077a8ce3fe2c4862e2ec6bec76ed2992","sha1":"b501410f784bb1607e590a34d6a8dc7bdec781ec","md5":"7f51ce02e779a26853855ab396d9935e","sha512":"c43afdc94de55154f8744808cdd2daa73680fbbfbd83d0c02b6dee3623c82b3a0e384f6b062089183586b05d5949b5b3f25efb289e02489abd02fdf72ec87a48","ssdeep":"24576:SNIBM0dvhyQ79MRgZUEq428xoVxig+z9py+K4CBJNXm4mALyNfEsZP:kIiihr79yuUuoyg+5c+SXNXm4XyNMsZ","ssdeep_chunks":["24576:SNIBM0d","24576:NIBM0dv","24576:IBM0dvh","24576:BM0dvhy","24576:M0dvhyQ","24576:0dvhyQ7","24576:dvhyQ79","24576:vhyQ79M","24576:hyQ79MR","24576:yQ79MRg","24576:Q79MRgZ","24576:79MRgZU","24576:9MRgZUE","24576:MRgZUEq","24576:RgZUEq4","24576:gZUEq42","24576:ZUEq428","24576:UEq428x","24576:Eq428xo","24576:q428xoV","24576:428xoVx","24576:28xoVxi","24576:8xoVxig","24576:xoVxig+","24576:oVxig+z","24576:Vxig+z9","24576:xig+z9p","24576:ig+z9py","24576:g+z9py+","24576:+z9py+K","24576:z9py+K4","24576:9py+K4C","24576:py+K4CB","24576:y+K4CBJ","24576:+K4CBJN","24576:K4CBJNX","24576:4CBJNXm","24576:CBJNXm4","24576:BJNXm4m","24576:JNXm4mA","24576:NXm4mAL","24576:Xm4mALy","24576:m4mALyN","24576:4mALyNf","24576:mALyNfE","24576:ALyNfEs","24576:LyNfEsZ","24576:yNfEsZP","49152:SNIBM0d","49152:NIBM0dv","49152:IBM0dvh","49152:BM0dvhy","49152:M0dvhyQ","49152:0dvhyQ7","49152:dvhyQ79","49152:vhyQ79M","49152:hyQ79MR","49152:yQ79MRg","49152:Q79MRgZ","49152:79MRgZU","49152:9MRgZUE","49152:MRgZUEq","49152:RgZUEq4","49152:gZUEq42","49152:ZUEq428","49152:UEq428x","49152:Eq428xo","49152:q428xoV","49152:428xoVx","49152:28xoVxi","49152:8xoVxig","49152:xoVxig+","49152:oVxig+z","49152:Vxig+z9","49152:xig+z9p","49152:ig+z9py","49152:g+z9py+","49152:+z9py+K","49152:z9py+K4","49152:9py+K4C","49152:py+K4CB","49152:y+K4CBJ","49152:+K4CBJN","49152:K4CBJNX","49152:4CBJNXm","49152:CBJNXm4","49152:BJNXm4m","49152:JNXm4mA","49152:NXm4mAL","49152:Xm4mALy","49152:m4mALyN","49152:4mALyNf","49152:mALyNfE","49152:ALyNfEs","49152:LyNfEsZ","49152:yNfEsZP","24576:kIiihr7","24576:Iiihr79","24576:iihr79y","24576:ihr79yu","24576:hr79yuU","24576:r79yuUu","24576:79yuUuo","24576:9yuUuoy","24576:yuUuoyg","24576:uUuoyg+","24576:Uuoyg+5","24576:uoyg+5c","24576:oyg+5c+","24576:yg+5c+S","24576:g+5c+SX","24576:+5c+SXN","24576:5c+SXNX","24576:c+SXNXm","24576:+SXNXm4","24576:SXNXm4X","24576:XNXm4Xy","24576:NXm4XyN","24576:Xm4XyNM","24576:m4XyNMs","24576:4XyNMsZ"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"7196e1100732cd16d74ba8099bbccc87077a8ce3fe2c4862e2ec6bec76ed2992.bin","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1520640,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1780911453000,"last_seen":1780923607000,"last_multi_scan":1780923607000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","keylogger","cryptocurrencytheft","agenttesla","credentialharvesting","phantomstealer","informationstealer","evasive","infostealer"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":99},"sandbox_signatures":{"informative_count":210,"suspicious_count":16,"malicious_count":11,"total":237},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Injuke","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.80113875","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_MSIL_PurelogStealer_SCR_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.80113875 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AQDZ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0069033f1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.KXT.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Creates multiple processes"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Able to access control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"malicious","value":"Modifies file/console tracing settings (often used to hide footprints on system)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to gather system information (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Accesses software policy settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access Powershell profile file"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"File Transfer Protocols","attack_id":"T1071.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/002","identifiers":[{"type":"malicious","value":"Sends network traffic on the official file transfer ports"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Non-Standard Encoding","attack_id":"T1132.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/002","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Logged FTP Commands"},{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$27","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"System.IO.Compression.ZipFile\" (Source: \"00000000-00007364.00000001.154601.00181000.00000020.mdmp\")\n Found string \"system.io.compression\" (Source: \"00000000-00007364.00000001.154601.08EB0000.00000004.mdmp, 00000000-00007364.00000001.154601.08F40000.00000004.mdmp\")\n Found string \"compressiontracingswitchlevel\" (Source: \"00000000-00007364.00000001.154601.08EB0000.00000004.mdmp\")\n Found string \"compressiontracingswitch\" (Source: \"00000000-00007364.00000001.154601.08EB0000.00000004.mdmp\")\n Found string \"compressionmode\" (Source: \"00000000-00007364.00000001.154601.08F40000.00000004.mdmp\")\n Found string \"decompressionmethods\" (Source: \"00000000-00007364.00000001.154601.08F40000.00000004.mdmp\")\n Found string \"compressionlevel\" (Source: \"00000000-00007364.00000001.154601.08F40000.00000004.mdmp\")\n Found string \"compressionstrategy\" (Source: \"00000000-00007364.00000001.154601.08F40000.00000004.mdmp\")\n Found string \"compressionmethod\" (Source: \"00000000-00007364.00000001.154601.08F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Windows.Forms.Control\" and MemberReference \"Hide\" in \"7196e1100732cd16d74ba8099bbccc87077a8ce3fe2c4862e2ec6bec76ed2992.bin\"\n Observed Namespace \"System.Windows.Forms.Control\" and MemberReference \"Hide\" in \"VpaAUK.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"6a26bcd7583c8b1f810a3ff9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"