26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample cc29c8d2f356… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample cc29c8d2f356…. Threat score 35/100. 0/6 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cc29c8d2f35603c016320b6510607571f62a1684ac273688d5dc417d5b615137","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","cc29c8d2f35603c016320b6510607571f62a1684ac273688d5dc417d5b615137"],"about":{"@type":"SoftwareApplication","name":"https://shared-cloud-manager.folio.io.vn/w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/INVIT=364440204111982654914037898403225251795987579778814986454152","applicationCategory":["url"],"identifier":"cc29c8d2f35603c016320b6510607571f62a1684ac273688d5dc417d5b615137","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":6},"behavioralIndicators":{"malicious":0,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8f3,Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6292:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:6292:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:6292:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6292:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5732:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5732:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:5732:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:5732:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4840:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:4840:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:4840:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4840:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4536:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:4536:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7292:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7292:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:7292:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:7292:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8564:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8564:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:8564:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:8564:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4956:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4956:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:4956:304:WilStaging_02"28:T429e,"GET /async/folae?async=_fmt:pb HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-protobuffer Date: Thu 29 Oct 2026 04:33:13 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 1007872326 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /async/ddljson?async=ntp:2 HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Thu 29 Oct 2026 04:33:13 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 1007872326 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>0709C280295D7D270A7B2264646C6A736F6E223A7B7D7D03....... "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 X-Client-Data: CJ2IywE= Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Thu 29 Oct 2026 04:33:13 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 1007872326 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Client-Data: CJ2IywE= Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/javascript; charset=UTF-8 Date: Thu 29 Oct 2026 04:33:13 GMT Server: gws Expires: -1 Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Pragma: no-cache Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Afws3dmgf8vrQqz5s3lIGg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Cache-Control: no-cache must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /async/newtab_promos HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Thu 29 Oct 2026 04:33:13 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 1007872326 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>C28708C280295D7D270A7B22757064617465223A7B7D7D03....... "GET /w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/INVIT=364440204111982654914037898403225251795987579778814986454152 HTTP/2 Host: shared-cloud-manager.folio.io.vn User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Sec-Fetch-User: ?1 Priority: u=0, i Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Ch-Ua: "Not(A:Brand";v="8", "Chromium";v="144", "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: document" Response ==> HTTP/2 200 OK Content-Type: text/html; charset=utf-8 Date: Thu, 29 Oct 2026 04:33:17 GMT Server: cloudflare Expires: 0 Cf-Ray: a51f7611ec2817f4-SJC X-Frame-Options: DENY Content-Encoding: zstd Permissions-Policy: camera=() microphone=() geolocation=() Cross-Origin-Opener-Policy: same-origin Cf-Cache-Status: DYNAMIC Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains Set-Cookie: ckpt=L8HQcm-FhdGFQbmRALLUoypIZmDmNeEQoHhIx-kc_QfViwj3eDsLebOFED_qLc_lS-6S_bNNHxMs0W7KMYo3aZN5jRYp0GFYg-Q6CykV2Jvk9nIFlwp_IBG3-wGD3l9jlIunndREy80qRhalhFNharfylWP-XzQ-jcaH4HSRq24WPYHh5Rkz0xSbeK7z4GsrqwMmr_sjXWoVn0135bD6yhIdEFXX0D_60Qr0xk9iH_EhQMcqLnlgJmGzEx9GjPx0nqsSsJ2QH7E9TAUQ; Path=/; Max-Age=300; HttpOnly; Secure; SameSite=Strict Content-Security-Policy: default-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; img-src 'self' data: https:; style-src 'unsafe-inline'; frame-src https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; script-src 'nonce-5d9ecf28c9396830d94d3f72a0a5377c' https://challenges.cloudflare.com X-Content-Type-Options: nosniff Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Referrer-Policy: no-referrer Server-Timing: cfEdge;dur=28 cfOrigin;dur=530 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=s9RB1M9snm5ZOmPtTe3Kes3Xf2%2FNUSyHI2CisDp%2B43XkYvMbpZSFYU%2F4U3eJdCskkotNUwDzeLi%2BPeycX2BzXUqsKHk1%2Bbsnrm4i7Uj8dEJlW8ukVB70yb1ZTI%2BiLJHcVk4htqdPRBxChomHx9fGGxqoQw%3D%3D"}]} Cache-Control: no-store no-cache must-revalidate private max-age=0 Alt-Svc: h3=":443"; ma=86400 with response body ==>BINARY_CONTENT....... "GET /turnstile/v0/api.js HTTP/2 Host: challenges.cloudflare.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Ch-Ua: "Not(A:Brand";v="8", "Chromium";v="144", "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept: */* Sec-Fetch-Dest: script" Response ==> HTTP/2 302 Found Date: Thu, 29 Oct 2026 04:33:18 GMT Access-Control-Allow-Origin: * Server: cloudflare Cf-Ray: a51f76179fa4e418-SJC Location: /turnstile/v0/g/c787ce48cf6b/api.js Cross-Origin-Resource-Policy: cross-origin Cache-Control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public Alt-Svc: h3=":443"; ma=86400 with no response body, "GET /turnstile/v0/g/c787ce48cf6b/api.js HTTP/2 Host: challenges.cloudflare.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Ch-Ua: "Not(A:Brand";v="8" "Chromium";v="144" "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Accept: */* Sec-Fetch-Dest: script" Response ==> HTTP/2 200 OK Content-Type: application/javascript; charset=UTF-8 Date: Thu, 29 Oct 2026 04:33:18 GMT Access-Control-Allow-Origin: * Server: cloudflare Cf-Ray: a51f7617e8b6e418-SJC X-Content-Type-Options: nosniff Content-Encoding: br Etag: W/"c787ce48cf6b-api" Cross-Origin-Resource-Policy: cross-origin Cache-Control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public Alt-Svc: h3=":443"; ma=86400 with response body ==>BINARY_CONTENT......., "GET /files/shared/dvO2O9KFVyYz7C4Ys6OpB1BTMHpAsAHYzK2dxrKQVDxQqdD6gkIKrBs-TSLAhFtLRlBKhTBhQ5VAnd9PrmQ828-aO8p1X4PafFibe6zf-PTw_P43vc40xePpnsNlgeHXF3RvtDm6SMs_WnGbFyXCga9HfSuFExkuelYsQgZ9fiaL3T0DKOLtE1oSuNp-YJ2sWZtL2iNGBYQ6IMZBbfgrt4BrwOf_j_MOoJ4VOXVhp0xVh5RoeJ4OWL46IBgrUA-81GNCFz1PVD-d-Ngw/view?v=7b00259103860fc9a2c883bafe069802a2fc9a246581979c&n=b64fb9fa-6bd9-7f31-6593-be65c9a5b96f HTTP/2 Host: shared-cloud-manager.folio.io.vn User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Accept-Language: en-US en;q=0.9 Cookie: ckpt=BvxFoZjvYI3gDxnizIytsIuStoJ9Ms63BHpjW_RUhlOq5Y7t_F45ECc7TEXOzSUsSTJwAkTvYhxBKlYAgDhtf7Hx01KScb9W_6p0_4n0GpNeExswE1TIFv4q5dpSSEorI0yPKGgPUMgx0gk2Fae5RG8P3dqxycgqSnLhEBYsD-CSdHoH7HBEmMSvVVQZnYE__Sh7z2eeTU_27plHsOd1GT64i1_TxOteQByRl6EeOZuHv_SiCIVq65L1i2IISwJshxssvK5TaPZe46c Priority: u=0 i Accept: text/html application/xhtml+xml application/xml;q=0.9 image/avif image/webp image/apng */*;q=0.8 application/signed-exchange;v=b3;q=0.7 Sec-Ch-Ua: "Not(A:Brand";v="8" "Chromium";v="144" "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Cache-Control: max-age=0 Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: document" Response ==> HTTP/2 200 OK Content-Type: text/html; charset=utf-8 Date: Thu, 29 Oct 2026 04:33:28 GMT Server: cloudflare Expires: 0 Cf-Ray: a51f765a4afb17f4-SJC X-Frame-Options: DENY Content-Encoding: zstd Permissions-Policy: camera=(), microphone=(), geolocation=() Cross-Origin-Opener-Policy: same-origin Cf-Cache-Status: DYNAMIC Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains Set-Cookie: ckptgo=cA6Hau91kkrbvFPSzJsY0I0rH_Hhu-WG5HSofg_sZXB-OwqRNRL-9gYfuP5soAJRGt5co8HmsOfWUDoEmaWLtb6XKx5PdiVOxPdADXB-RwWWPR-_OLrhKlJjE7-CJTOl6RKNpTP6X9d-SM8GYpKszP0Ltxb6vlEWhY5lawIflAARbqpPzwXLmLfgVM3yOOwEFycm-VNI2Gg4fdzKQJh39fVHHRNCHjkGYoH40cBY4whjIr1ayt_Rru9mBhapOebh7WyZLnTme8K9wtQ; Path=/auth/microsoft; Domain=folio.io.vn; Max-Age=600; HttpOnly; Secure; SameSite=Lax Content-Security-Policy: default-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; img-src 'self' data: https:; style-src 'unsafe-inline'; frame-src https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; script-src 'nonce-24b0725a4b1acea60568b741f55e841c' https://challenges.cloudflare.com X-Content-Type-Options: nosniff Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Referrer-Policy: no-referrer Server-Timing: cfEdge;dur=6,cfOrigin;dur=204 Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=emsoNPdujUki73bvI3qwQ%2FHXlacXSgc%2BI34fDMqUYPy7Evei4WtjuQPpsftmbaDihBi0wpKVs055qZ%2BRt0%2BTdGcQqHctScIkT9MsX0m9O70s99EbWrU1v8X85In6XVPJ0vIh1L%2Bd3fG2%2BavA6%2FZ7fCkA6Q%3D%3D"}]} Cache-Control: no-store, no-cache, must-revalidate, private, max-age=0 Alt-Svc: h3=":443"; ma=86400 with response body ==>BINARY_CONTENT......., "GET /wikipedia/commons/thumb/e/e7/Microsoft_OneDrive_Icon_%282025_-_present%29.svg/960px-Microsoft_OneDrive_Icon_%282025_-_present%29.svg.png?utm_source=commons.wikimedia.org&utm_campaign=index&utm_content=thumbnail HTTP/2 Host: thumb.wikimedia.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Ch-Ua: "Not(A:Brand";v="8" "Chromium";v="144" "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Priority: u=1 i Accept-Encoding: gzip deflate br zstd Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/webp Date: Wed, 28 Oct 2026 19:52:32 GMT Server: ATS/9.2.16 X-Client-Ip: 64.124.12.162 X-Ratelimit-Remaining: 599998 Last-Modified: Sat, 17 Oct 2026 04:17:09 GMT Reporting-Endpoints: csp_endpoint="https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json" Set-Cookie: WMF-Uniq=Zq3OFbq1HoiGbaDWVdWkfwQIAAAAAFvdKHP8Qz1hjL96XCA0mac5O0gI4ZaVE8XT;Domain=thumb.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Fri, 29 Oct 2027 00:00:00 GMT Content-Disposition: inline;filename*=UTF-8''Microsoft_OneDrive_Icon_%282025_-_present%29.svg.webp Nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0} Report-To: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } Server-Timing: cache;desc="hit-front", host;desc="cp2045",co_id;desc="2147954586" X-Request-Id: ebfae693-12fa-4c99-ae03-135e509ae0df X-Ratelimit-Limit: 600000, 600000;w=60 X-Ratelimit-Reset: 34 Strict-Transport-Security: max-age=106384710; includeSubDomains; preload Access-Control-Expose-Headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Cache-Status: hit-front Etag: 9d5c791ee6754f5b1ba35796f745d097 Content-Security-Policy-Report-Only: default-src 'none'; script-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico https://thumb.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico https://thumb.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'none'; worker-src 'none'; manifest-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json; report-to csp_endpoint X-Cache: cp2045 hit, cp2045 hit/229 Timing-Allow-Origin: * Accept-Ranges: bytes Age: 31257 with response body ==>BINARY_CONTENT......., "GET /.well-known/web-app-origin-association HTTP/2 Host: chat.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/html Date: Thu, 29 Oct 2026 04:34:32 GMT Server: sffe Expires: Thu, 29 Oct 2026 04:34:32 GMT Vary: Accept-Encoding Content-Encoding: br Cross-Origin-Opener-Policy: same-origin; report-to="uxe-owners-acl" Last-Modified: Mon, 06 Oct 2025 19:58:00 GMT X-Content-Type-Options: nosniff X-Xss-Protection: 0 Cross-Origin-Resource-Policy: cross-origin Report-To: {"group":"uxe-owners-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl"}]} Accept-Ranges: bytes Cache-Control: private, max-age=3000 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT.......29:T65c,The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: E9:C8:38:6D:60:3B:EA:10:28:83:F2:6E:8F:7E:11:1D:28:96:69:50; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 35:FF:B4:CB:62:62:2A:26:BF:CA:7B:D8:97:AC:D4:34:DC:A0:E7:AC; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 30:38:F4:D9:19:7E:B4:1D:D0:55:D1:0A:8F:DB:AF:10:3F:D2:50:97; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: B7:30:D8:4E:DD:CC:41:E5:2B:2B:0D:DB:D0:54:4F:25:D8:2D:A3:B0; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 14:89:39:70:76:C5:8E:F1:BF:B2:DA:05:C9:0F:52:1A:51:0B:85:8A; see report for more information)2a:T10cf,Found http requests in header "GET /async/folae?async=_fmt:pb" Found http requests in header "GET /async/ddljson?async=ntp:2" Found http requests in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0" Found http requests in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE" Found http requests in header "GET /async/newtab_promos" Found http requests in header "GET /w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/INVIT=364440204111982654914037898403225251795987579778814986454152" Found http requests in header "GET /turnstile/v0/api.js" Found http requests in header "GET /beacon.min.js/vce701823e78c4301a35b7e07294d87301792088814092" Found http requests in header "GET /turnstile/v0/g/c787ce48cf6b/api.js" Found http requests in header "GET /cdn-cgi/challenge-platform/h/g/turnstile/f/av0/rch/rumod/0x4AAAAAAFbs5vUs-OBVcJ4C/light/fbE/new/normal?lang=auto" Found http requests in header "POST /cdn-cgi/rum?" Found http requests in header "POST /cdn-cgi/challenge-platform/h/g/fo/2544198922:1793246418:0s2MsVefCOD3alPX-DDml8pJAB7jQFyms85SEEHKLvE/a51f761a0ef2f005/3Lidd95hBNkE08iwkD132rAVc1oaGX3WsDxYSgpFq7k-1793248398-1.2.1.1-ikEEuwOdpcYkuFesoc0h8vhE_qUdhlurlGUHF3cNsSexpdqlWoJYc42arS2eeB9O" Found http requests in header "GET /cdn-cgi/challenge-platform/h/g/pat/a51f761a0ef2f005/1793248399796/c1c826949d37c5d0c983dac9f14c40dca34d2fef65c31d16008d62d8f3c920ca/drrKjrkOjjw8jbCJ2fuwt3Xpmi3Gr3GNLIXxpHFsNoM-1793248399-1.3.1.1-T6vhssu5xdCAIOjf6bGKbVySKWEuU.7tKZtna5lhUe111NSrcl_PJ3EfmWTrlriKK7YGEqpQmGcNVYzKJC_lJaR3JZ.4uk481RORno_ap_QVbM1IPO4aGmOieMlDxXSob.vrj4w31nt5rT0T7HZ.vMQkh.kxqPcTKbJn3qjOPymA6erNB3VDAF3k1Cl8Vy7N.VYvAw0q_4NPcZiQ3vN6CKA.v_c58qyNTc_Qd3oxrnAMYyz5eYPMojebIGT194owDDFSRp2O45tJIooHw0oB7ZsFnLKa.xUgHsjhgcdI_n6wUscIxqdN2jJN0Ta1XAJtFkwsAKV3WlbulJ4xzyMWfOA.vKsbUXb25olS361cMl7XEoQ7cauUN7eoX2LWdYjAthU6.YHLP.auO6BjJU66u74IDC6ebZ5cMs37nt8S6s0FNWyksGS6iP5sOL24LmI.lYFRSqlRwRq3IDE4fdPZu6DmaVEdFuxcmnvj2PSU89BhLKJP_oOFAnbE3y9dzHN_uKQUZkiih.oJKcKjf_s0oJ73tMkTVRGv6_jHrHmdL8hOGgEV24GWN7uJpav_l1MUgPeu4IDrovPTyq5ZOvkQ2pXKPMcvkuksoLq5C1mDkmI7Eu_xDjV3ZlQ44eDmZinYmMfqj3OuPNDu0y9rCbZMAXAxWMI1vqpM.PwrgkukEvR679Ch6EZL68pU6PhgBjhISU75jGaCVktufDRbZxupVBTtwTbEBoBQV0Cu7g19t6C25J6qf4pHg3TTD4wXajKe7pfP_HAvqgNGNW6GgtS8IcryhdVAeQBVGhxXETQJeYuId2.DC_RjgYMt4_kNkD8A" Found http requests in header "GET /cdn-cgi/challenge-platform/h/g/ci/a51f761a0ef2f005/1793248399796/U84R402PGEyRqdbKiXVl0XctpXr6bP_KRO0snptJOLw-1793248399-1.3.1.1-qoqzOrZxP1_bjYwpyBo0FxfXDdPjabh2Eb7fLzqGCGAYcl1oxXRTwzg3mnSq3dsZfSryTHZLnJLuwqbSUxVgwhewf9m6EVuFALlKg50aPRu_e27agQg7RBiuv287i8njUVGU0QpyTB_DS_uKZa6viTx.nvI0cBYkqPU6p2jp7EkxeWPYJs7Nze3CYVh.QZ.Zmb7sfZFqhgmikZEzQSp7xY0kORKI1EaUfycn0qGonuRnlCcnPi1ndUq1dftWI.RNuk0dx89qgY3d7zI8TWl5G4qYH3LV7QQ9dS6rhBnIyZkHiKS1CZp_0HC9FVOdUJo_jj64Juu5oqXFyFnP0uMF7hxyl92Q1Lu8aW7UW9Wp7cAYZ2pQocGf16.UmKFW0fSOiCol7ZPi8lfE95fa9XNFmE32AzUKfzeBjKicYEvqo7nrGPdRxEO3OHIJSXWg.KdkpLZUhiCJ3zhLZSRXL7qmPkY4gU9EZV1ss.xa3HfkM2FkDdPgEJf2xAvbH_n7FQbHo3jlhi49OuYYc6lC.JUngY3zuT4VLUKKKa9N64nto4Bbk9GzxrI52CsJ3qfvv4wpdwXalEgQWYsunsmfqSHv9ZXim5WMkGlwiGE2JAm0E.MYoGZojHlqlLA.RlGJi76v4lE00JZNJSyioo1c4ZrPsstGgDMNThJTkFc29ftbNkq1rf9yKK6VtWJj529CfP1NPKMgRPOn45Qe2_uEraYWy_QvuOpbaE38DCAHI2RzBqs" Found http requests in header "POST /w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/INVIT=364440204111982654914037898403225251795987579778814986454152" Found http requests in header "GET /files/shared/dvO2O9KFVyYz7C4Ys6OpB1BTMHpAsAHYzK2dxrKQVDxQqdD6gkIKrBs-TSLAhFtLRlBKhTBhQ5VAnd9PrmQ828-aO8p1X4PafFibe6zf-PTw_P43vc40xePpnsNlgeHXF3RvtDm6SMs_WnGbFyXCga9HfSuFExkuelYsQgZ9fiaL3T0DKOLtE1oSuNp-YJ2sWZtL2iNGBYQ6IMZBbfgrt4BrwOf_j_MOoJ4VOXVhp0xVh5RoeJ4OWL46IBgrUA-81GNCFz1PVD-d-Ngw/view?v=7b00259103860fc9a2c883bafe069802a2fc9a246581979c&n=b64fb9fa-6bd9-7f31-6593-be65c9a5b96f" Found http requests in header "GET /wikipedia/commons/thumb/e/e7/Microsoft_OneDrive_Icon_%282025_-_present%29.svg/960px-Microsoft_OneDrive_Icon_%282025_-_present%29.svg.png?utm_source=commons.wikimedia.org&utm_campaign=index&utm_content=thumbnail" Found http requests in header "GET /.well-known/web-app-origin-association"2b:T8f8,Heuristic match: "permarcussen@post.dk" Pattern match: "https://shared-cloud-manager.folio.io.vn/w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/invit=364440204111982654914037898403225251795987579778814986454152" Pattern match: "https://shared-cloud-manager.folio.io.vn" Pattern match: "https://clients2.google.com/cr/report" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "www.google.com" Heuristic match: "shared-cloud-manager.folio.io.vn" Heuristic match: "challenges.cloudflare.com" Heuristic match: "static.cloudflareinsights.com" Pattern match: "beacon.min.js/vce701823e78c4301a35b7e07294d87301792088814092" Pattern match: "https://shared-cloud-manager.folio.io.vn/w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/invit=364440204111982654914037898403225251795987579778814986454152,versions:{fl:2024.11.0,js:2026.10." Pattern match: "https://shared-cloud-manager.folio.io.vn/w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/invit=364440204111982654914037898403225251795987579778814986454152,versions:{js:2026.10.1,fl:2024.11." Heuristic match: "thumb.wikimedia.org" Pattern match: "29.svg/960px-microsoft_onedrive_icon_%282025_-_present%29.svg.png?utm_source=commons.wikimedia.org&utm_campaign=index&utm_content=thumbnail" Pattern match: "https://shared-cloud-manager.folio.io.vn/files/shared/dvo2o9kfvyyz7c4ys6opb1btmhpasahyzk2dxrkqvdxqqdd6gkikrbs-tslahftlrlbkhtbhq5vand9prmq828-ao8p1x4paffibe6zf-ptw_p43vc40xeppnsnlgehxf3rvtdm6sms_wngbfyxcga9hfsufexkuelysqgz9fial3t0dkolte1osunp-yj2swztl2ingby" Heuristic match: "chat.google.com" Heuristic match: "accounts.google.com" Heuristic match: "android.clients.google.com" Heuristic match: "brunhild.challenges.cloudflare.com" Heuristic match: "clients1.google.com" Heuristic match: "clients2.google.com" Heuristic match: "mail.google.com" Heuristic match: "mtalk.google.com" Heuristic match: "ogads-pa.clients6.google.com" Heuristic match: "play.google.com" Heuristic match: "ssl.gstatic.com" Heuristic match: "stun.cloudflare.com" Heuristic match: "stun.l.google.com" Heuristic match: "stun1.l.google.com" Pattern match: "www.gstatic.com"2c:T48f,Short term registered certificate: "accounts.google.com" (83 days old) Short term registered certificate: "android.clients.google.com" (83 days old) Short term registered certificate: "challenges.cloudflare.com" (90 days old) Short term registered certificate: "chat.google.com" (83 days old) Short term registered certificate: "clients1.google.com" (83 days old) Short term registered certificate: "clients2.google.com" (83 days old) Short term registered certificate: "mail.google.com" (83 days old) Short term registered certificate: "mtalk.google.com" (83 days old) Short term registered certificate: "ogads-pa.clients6.google.com" (83 days old) Short term registered certificate: "play.google.com" (83 days old) Short term registered certificate: "shared-cloud-manager.folio.io.vn" (89 days old) Short term registered certificate: "ssl.gstatic.com" (83 days old) Short term registered certificate: "static.cloudflareinsights.com" (90 days old) Short term registered certificate: "thumb.wikimedia.org" (89 days old) Short term registered certificate: "www.google.com" (83 days old) Short term registered certificate: "www.gstatic.com" (83 days old)2d:T5ca,navigated → https://shared-cloud-manager.folio.io.vn/w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/INVIT=364440204111982654914037898403225251795987579778814986454152 initialFrameNavigation → https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/f/av0/rch/rumod/0x4AAAAAAFbs5vUs-OBVcJ4C/light/fbE/new/normal?lang=auto navigated → https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/f/av0/rch/rumod/0x4AAAAAAFbs5vUs-OBVcJ4C/light/fbE/new/normal?lang=auto form POST → https://shared-cloud-manager.folio.io.vn/w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/INVIT=364440204111982654914037898403225251795987579778814986454152 form POST → https://shared-cloud-manager.folio.io.vn/w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/INVIT=364440204111982654914037898403225251795987579778814986454152 (scheduled) navigated → https://shared-cloud-manager.folio.io.vn/files/shared/dvO2O9KFVyYz7C4Ys6OpB1BTMHpAsAHYzK2dxrKQVDxQqdD6gkIKrBs-TSLAhFtLRlBKhTBhQ5VAnd9PrmQ828-aO8p1X4PafFibe6zf-PTw_P43vc40xePpnsNlgeHXF3RvtDm6SMs_WnGbFyXCga9HfSuFExkuelYsQgZ9fiaL3T0DKOLtE1oSuNp-YJ2sWZtL2iNGBYQ6IMZBbfgrt4BrwOf_j_MOoJ4VOXVhp0xVh5RoeJ4OWL46IBgrUA-81GNCFz1PVD-d-Ngw/view?v=7b00259103860fc9a2c883bafe069802a2fc9a246581979c&n=b64fb9fa-6bd9-7f31-6593-be65c9a5b96f2e:T7dd,POST request #1: URL: https://shared-cloud-manager.folio.io.vn/cdn-cgi/rum? Data size: 1021 bytes Body: {"startTime":1793248393414 "pageloadId":"c738d0fb-f39d-4de8-98e9-d8901fdec2e3" "eventType":1 "nt":"navigate" "location":"https://shared-cloud-manager.folio.io.vn/w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/INVIT=364440204111982654914037898403225251795987579778814986454152" "versions":{"fl":"2024.11.0" "js":"2026.10.1" "timings":2} "bi":{"be":"Blink" "bev":"144" "bv":"144" "ov":"10"} "memory":{"totalJSHeapSize":2485175 "usedJSHeapSize":1 POST request #2: URL: https://shared-cloud-manager.folio.io.vn/w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/INVIT=3644402041119826549140378984032252517959875797788 Data size: 883 bytes Body: csrf=977ba756f99dd5029e0809d9bcf26f44&skin=1&cf-turnstile-response=1.fVDH4soKtFuw_mZ3cuV35-fx2xdb85TMGf2utOGYVyfODl_3CeWafD756ZjyV2f4tvTPln_Z-1SeyAYXO9tQENg32oLfKOsTeQcDk8yWvAqaNEbksCkHhYGdGjLAmDeBIeQDT5nTL5tSClRKzMvB4iCrZJhlBYCK_gNCmWkGdJLNsc76S-mJfnaXj4sDyiW-aQrHSFTuVtGkCL2tpJ2V1siYMjoFvO_miClkOIH80Md8m34K6pdGlu6TXfuFAy1BlSFcFXRG-UHp6PQ-agRlZlztltvmZ_qFJdsV96wuraZMleE91WJrF1TRvoLqdCIoGea3YXgKrixuLUinEAf6zyAjYgnbEFuO1w1kWvbMHrHSPn5G703QmCgQpJ7Gc3PgVOb13dhDSb3GBxg24BDc2Xtjshs6zaqQyxj77MtPzEUwkEs POST request #3: URL: https://shared-cloud-manager.folio.io.vn/cdn-cgi/rum? Data size: 1191 bytes Body: {"startTime":1793248404440 "pageloadId":"82a888b9-7a35-4bf7-bdd3-8d69195296a5" "eventType":1 "nt":"navigate" "location":"https://shared-cloud-manager.folio.io.vn/files/shared/dvO2O9KFVyYz7C4Ys6OpB1BTMHpAsAHYzK2dxrKQVDxQqdD6gkIKrBs-TSLAhFtLRlBKhTBhQ5VAnd9PrmQ828-aO8p1X4PafFibe6zf-PTw_P43vc40xePpnsNlgeHXF3RvtDm6SMs_WnGbFyXCga9HfSuFExkuelYsQgZ9fiaL3T0DKOLtE1oSuNp-YJ2sWZtL2iNGBYQ6IMZBbfgrt4BrwOf_j_MOoJ4VOXVhp0xVh5RoeJ4OWL46IBgrUA-81GNCFz1PVD-d-Ngw/view" "versions":{"fl":"2024.11.0" "js":"2026.10.1" 2f:T46c,POST /cdn-cgi/challenge-platform/h/g/fo/2544198922:1793246418:0s2MsVefCOD3alPX-DDml8pJAB7jQFyms85SEEHKLvE/a51f761a0ef2f005/3Lidd95hBNkE08iwkD132rAVc1oaGX3WsDxYSgpFq7k-1793248398-1.2.1.1-ikEEuwOdpcYkuFesoc0h8vhE_qUdhlurlGUHF3cNsSexpdqlWoJYc42arS2eeB9O HTTP/2 Host: challenges.cloudflare.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Sec-Fetch-Mode: cors Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/f/av0/rch/rumod/0x4AAAAAAFbs5vUs-OBVcJ4C/light/fbE/new/normal?lang=auto Sec-Fetch-Site: same-origin Accept-Language: en-US,en;q=0.9 Origin: https://challenges.cloudflare.com Priority: u=1, i Accept: */* Sec-Ch-Ua: "Not(A:Brand";v="8", "Chromium";v="144", "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Cf-Chl-Ra: 0 Cf-Chl: 3Lidd95hBNkE08iwkD132rAVc1oaGX3WsDxYSgpFq7k-1793248398-1.2.1.1-ikEEuwOdpcYkuFesoc0h8vhE_qUdhlurlGUHF3cNsSexpdqlWoJYc42arS2eeB9O Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty30:T400,/cdn-cgi/challenge-platform/h/g/pat/a51f761a0ef2f005/1793248399796/c1c826949d37c5d0c983dac9f14c40dca34d2fef65c31d16008d62d8f3c920ca/drrKjrkOjjw8jbCJ2fuwt3Xpmi3Gr3GNLIXxpHFsNoM-1793248399-1.3.1.1-T6vhssu5xdCAIOjf6bGKbVySKWEuU.7tKZtna5lhUe111NSrcl_PJ3EfmWTrlriKK7YGEqpQmGcNVYzKJC_lJaR3JZ.4uk481RORno_ap_QVbM1IPO4aGmOieMlDxXSob.vrj4w31nt5rT0T7HZ.vMQkh.kxqPcTKbJn3qjOPymA6erNB3VDAF3k1Cl8Vy7N.VYvAw0q_4NPcZiQ3vN6CKA.v_c58qyNTc_Qd3oxrnAMYyz5eYPMojebIGT194owDDFSRp2O45tJIooHw0oB7ZsFnLKa.xUgHsjhgcdI_n6wUscIxqdN2jJN0Ta1XAJtFkwsAKV3WlbulJ4xzyMWfOA.vKsbUXb25olS361cMl7XEoQ7cauUN7eoX2LWdYjAthU6.YHLP.auO6BjJU66u74IDC6ebZ5cMs37nt8S6s0FNWyksGS6iP5sOL24LmI.lYFRSqlRwRq3IDE4fdPZu6DmaVEdFuxcmnvj2PSU89BhLKJP_oOFAnbE3y9dzHN_uKQUZkiih.oJKcKjf_s0oJ73tMkTVRGv6_jHrHmdL8hOGgEV24GWN7uJpav_l1MUgPeu4IDrovPTyq5ZOvkQ2pXKPMcvkuksoLq5C1mDkmI7Eu_xDjV3ZlQ44eDmZinYmMfqj3OuPNDu0y9rCbZMAXAxWMI1vqpM.PwrgkukEvR679Ch6EZL68pU6PhgBjhISU75jGaCVktufDRbZxupVBTtwTbEBoBQV0Cu7g19t6C25J6qf4pHg3TTD4wXajKe7pfP_HAvqgNGNW6GgtS8IcryhdVAeQBVGhxXETQJeYuId2.DC_RjgYMt4 ...31:T591,GET /cdn-cgi/challenge-platform/h/g/pat/a51f761a0ef2f005/1793248399796/c1c826949d37c5d0c983dac9f14c40dca34d2fef65c31d16008d62d8f3c920ca/drrKjrkOjjw8jbCJ2fuwt3Xpmi3Gr3GNLIXxpHFsNoM-1793248399-1.3.1.1-T6vhssu5xdCAIOjf6bGKbVySKWEuU.7tKZtna5lhUe111NSrcl_PJ3EfmWTrlriKK7YGEqpQmGcNVYzKJC_lJaR3JZ.4uk481RORno_ap_QVbM1IPO4aGmOieMlDxXSob.vrj4w31nt5rT0T7HZ.vMQkh.kxqPcTKbJn3qjOPymA6erNB3VDAF3k1Cl8Vy7N.VYvAw0q_4NPcZiQ3vN6CKA.v_c58qyNTc_Qd3oxrnAMYyz5eYPMojebIGT194owDDFSRp2O45tJIooHw0oB7ZsFnLKa.xUgHsjhgcdI_n6wUscIxqdN2jJN0Ta1XAJtFkwsAKV3WlbulJ4xzyMWfOA.vKsbUXb25olS361cMl7XEoQ7cauUN7eoX2LWdYjAthU6.YHLP.auO6BjJU66u74IDC6ebZ5cMs37nt8S6s0FNWyksGS6iP5sOL24LmI.lYFRSqlRwRq3IDE4fdPZu6DmaVEdFuxcmnvj2PSU89BhLKJP_oOFAnbE3y9dzHN_uKQUZkiih.oJKcKjf_s0oJ73tMkTVRGv6_jHrHmdL8hOGgEV24GWN7uJpav_l1MUgPeu4IDrovPTyq5ZOvkQ2pXKPMcvkuksoLq5C1mDkmI7Eu_xDjV3ZlQ44eDmZinYmMfqj3OuPNDu0y9rCbZMAXAxWMI1vqpM.PwrgkukEvR679Ch6EZL68pU6PhgBjhISU75jGaCVktufDRbZxupVBTtwTbEBoBQV0Cu7g19t6C25J6qf4pHg3TTD4wXajKe7pfP_HAvqgNGNW6GgtS8IcryhdVAeQBVGhxXETQJeYuId2.DC_RjgYMt4_kNkD8A HTTP/2 Host: challenges.cloudflare.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: same-origin Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Accept: */* Sec-Fetch-Dest: empty32:T637,GET /cdn-cgi/challenge-platform/h/g/ci/a51f761a0ef2f005/1793248399796/U84R402PGEyRqdbKiXVl0XctpXr6bP_KRO0snptJOLw-1793248399-1.3.1.1-qoqzOrZxP1_bjYwpyBo0FxfXDdPjabh2Eb7fLzqGCGAYcl1oxXRTwzg3mnSq3dsZfSryTHZLnJLuwqbSUxVgwhewf9m6EVuFALlKg50aPRu_e27agQg7RBiuv287i8njUVGU0QpyTB_DS_uKZa6viTx.nvI0cBYkqPU6p2jp7EkxeWPYJs7Nze3CYVh.QZ.Zmb7sfZFqhgmikZEzQSp7xY0kORKI1EaUfycn0qGonuRnlCcnPi1ndUq1dftWI.RNuk0dx89qgY3d7zI8TWl5G4qYH3LV7QQ9dS6rhBnIyZkHiKS1CZp_0HC9FVOdUJo_jj64Juu5oqXFyFnP0uMF7hxyl92Q1Lu8aW7UW9Wp7cAYZ2pQocGf16.UmKFW0fSOiCol7ZPi8lfE95fa9XNFmE32AzUKfzeBjKicYEvqo7nrGPdRxEO3OHIJSXWg.KdkpLZUhiCJ3zhLZSRXL7qmPkY4gU9EZV1ss.xa3HfkM2FkDdPgEJf2xAvbH_n7FQbHo3jlhi49OuYYc6lC.JUngY3zuT4VLUKKKa9N64nto4Bbk9GzxrI52CsJ3qfvv4wpdwXalEgQWYsunsmfqSHv9ZXim5WMkGlwiGE2JAm0E.MYoGZojHlqlLA.RlGJi76v4lE00JZNJSyioo1c4ZrPsstGgDMNThJTkFc29ftbNkq1rf9yKK6VtWJj529CfP1NPKMgRPOn45Qe2_uEraYWy_QvuOpbaE38DCAHI2RzBqs HTTP/2 Host: challenges.cloudflare.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/f/av0/rch/rumod/0x4AAAAAAFbs5vUs-OBVcJ4C/light/fbE/new/normal?lang=auto Sec-Fetch-Site: same-origin Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not(A:Brand";v="8", "Chromium";v="144", "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image33:T535,GET /files/shared/dvO2O9KFVyYz7C4Ys6OpB1BTMHpAsAHYzK2dxrKQVDxQqdD6gkIKrBs-TSLAhFtLRlBKhTBhQ5VAnd9PrmQ828-aO8p1X4PafFibe6zf-PTw_P43vc40xePpnsNlgeHXF3RvtDm6SMs_WnGbFyXCga9HfSuFExkuelYsQgZ9fiaL3T0DKOLtE1oSuNp-YJ2sWZtL2iNGBYQ6IMZBbfgrt4BrwOf_j_MOoJ4VOXVhp0xVh5RoeJ4OWL46IBgrUA-81GNCFz1PVD-d-Ngw/view?v=7b00259103860fc9a2c883bafe069802a2fc9a246581979c&n=b64fb9fa-6bd9-7f31-6593-be65c9a5b96f HTTP/2 Host: shared-cloud-manager.folio.io.vn User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Accept-Language: en-US,en;q=0.9 Cookie: ckpt=BvxFoZjvYI3gDxnizIytsIuStoJ9Ms63BHpjW_RUhlOq5Y7t_F45ECc7TEXOzSUsSTJwAkTvYhxBKlYAgDhtf7Hx01KScb9W_6p0_4n0GpNeExswE1TIFv4q5dpSSEorI0yPKGgPUMgx0gk2Fae5RG8P3dqxycgqSnLhEBYsD-CSdHoH7HBEmMSvVVQZnYE__Sh7z2eeTU_27plHsOd1GT64i1_TxOteQByRl6EeOZuHv_SiCIVq65L1i2IISwJshxssvK5TaPZe46c Priority: u=0, i Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Ch-Ua: "Not(A:Brand";v="8", "Chromium";v="144", "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Cache-Control: max-age=0 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: document34:T7fa,--window-position=20,54 --window-size=1280,840 --disable-dev-shm-usage --disable-application-cache --disable-background-networking --disable-component-update --disable-sync --safebrowsing-disable-auto-update --disable-component-extensions-with-background-pages --remote-allow-origins=* --safebrowsing-disable-download-protection --disable-search-engine-choice-screen --disable-browser-side-navigation --disable-save-password-bubble --disable-single-click-autofill --allow-file-access-from-files --disable-prompt-on-repost --dns-prefetch-disable --disable-translate --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-device-discovery-notifications --disable-oopr-debug-crash-dump --disable-top-sites --ash-no-nudges --no-crash-upload --deny-permission-prompts "--simulate-outdated-no-au=\"Tue, 31 Dec 2099 23:59:59 GMT\"" --disable-ipc-flooding-protection --disable-password-generation --disable-domain-reliability --disable-breakpad --disable-features=OptimizationHints,OptimizationHintsFetching,Translate,ComponentUpdater,OptimizationTargetPrediction,OptimizationGuideModelDownloading,DownloadBubble,DownloadBubbleV2,InsecureDownloadWarnings,InterestFeedContentSuggestions,PrivacySandboxSettings4,SidePanelPinning,UserAgentClientHint,DisableLoadExtensionCommandLineSwitch,Bluetooth,WebBluetooth,UnifiedWebBluetooth,WebAuthentication,PasskeyAuth,OptimizationGuideOnDeviceModel,HttpsUpgrades,BackForwardCache,SpareRendererForSitePerProcess,AutofillServerCommunication --enable-unsafe-extension-debugging --no-pings --homepage=chrome://version/ --animation-duration-scale=0 --wm-window-animations-disabled --enable-privacy-sandbox-ads-apis --disable-background-timer-throttling --disable-popup-blocking --remote-debugging-host=127.0.0.1 --remote-debugging-port=9222 --user-data-dir=C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c --lang=en-US --no-default-browser-check --no-first-run --no-service-autorun --password-store=basic --profile-directory=Default --log-level=035:Tc1c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAI2klEQVR4XqWWeVBUVxbGqWhcWJpuFSvOf1OpcuKI7LK4xQARgyzSgBEVAcE9TlQccQBXxCCrWOCCMmVU0CCKAQFl7YWmG5odGhqaxQ1UTIwrblP1zbmvbZXFiuPcqq9eV/fr9/3Oueec+/T0PnJZin+HpegOLMS9MBdfh7mkC2YSDcwr1DCXtcBS3gBzeT1sFArYVMvhUFuKoc/4pGVT/hBWZX/ASvwbZ24hvsUBzJB0kjpgJm2DWUULzCsbCaIWNlUK2NeIMaeuCHMbCuHckvtpIHblA7AVPYON6BGsKXorcT+Z3ybzGzAT92CGmAG0wVTSihkVTTCTNcJCXgMrhZKiJ4CGIsxvyoOz6hIWdmRA2H3y40FsRc9hW/ZUay56ACtRPyzFdwmgTxs9mZty5loAU2kTQdQTgBLWVXLY1kjgUFfKAbi0ncN36gx4dB7HstsH/hzCrvwFF/lM0RMOwEbE0s8A+rgMcNFT6qczY04q+swAGikLtbBUVMNWyTJw7Q1AJjw707C4mwBuRRNE1Ich7EUvYUeyFenS/5Ay8BsB3OMAzCTavTeVqLnomfF0STP+LmnEdCkDqKNaUFIdSDCn/iocmy/BpfUsARzHkhsJWN4bjYDenQi6FzYcwq78FezKnhMAy8AAZeAx6REZs73vo2svRc8A2sm05a3xUM2oqCWIKirEYsxryINTywW4dRyHd08iZSCKzMMRfD90BAAythO9Arf/HMATrvqn5d7EtLxuUhe+utJBABou/UONdTKtqKNaUGBW7VUC+BVOzQwgDd7dsfC7GY2gO6FY3b8JGx4Ev4OwK3/Nmeuin3ruOkz2FsE4NAf8HfkQhF/FhPAC0hVMDMvBFz8V4Mvs2mHmWgDWiiLYVpdhdl0+tWEGXNVpWNITBb8bkQjs3YKQuxuwsd//HYBt2UvYE4Dp5d/BDy+CUVgReJEiGO+WgR8lhyC6ChOiFZgYXYlJURJM2luGSbsK8UVUAabmNwzZAiUsKitgr7yCeXVZcGo8hUVtyfBoj8XS6/9CwO1NCO5bg3X3/LHpvjf07MT/IfPXmJrRC/3QazCMkMJoTzV4+xtgHNMMfqwKgngVJpAmJqhgktAEk7g6mMTIYRJVBpPIPHx5UZsNU2kdDSUZAcgwU16A2bWX4NiQDre2JAg1e/B9dxiW9WzGqt41WHvXH+v6l0DPoXgA0y7cx/htZdCPVMBgbz2MolXgHVTDOLYd/IQOCBI1mHBIg4mkScmkQ2pMTlJhclwNJkdLYLIzH38rUNBUrIBFRRmsZIWwr7qAuTWn4Vh/FG6qaHipI7BEswUrr4cg6FYgQnr9sLZPCD3rvD9gtKsa4yKV0N/bBIPoNhj+1A6jgxrw4jQwju8EP7ETgqQugujCxOQugmjHlMOtmJzcBpPEekzaL8OUgyUwFTGAEgLIh4PiLOYq0/FNbSrcVVEQqsMJYCuWd69B4I1ABN/01QJ8db4fYyNqMW53E8ZHtUI/uh0GB0gxHYMhErQQ/MhK/HVzzrA2MtkvxtScUlhXXISt7BzsK3/GPGUanGpi4da0Ax4tO+Cj/gErugIRcH05B7D6thf0TJI6MCayEWP3tGJclBrj96s5CP03EIYHCSRWC2G8XQSDhTHDzHVr6qlCWEsyCSATs+QnME8RD0dlLFwbwuDRvA3C1o3wUy+Df6cvgnqECLnhAT1BvAaf71JhzO5WjN2rxrh9WojxQyF2yGDgehCGnoc/CGD1CwM4DTtpKmbLEvB1VSwWVIfBRbkN7g3r4dUcDF+VP1ZofLBS446QbhfojY5swWgC+Hx3G8bsaSOINg5i3PsQ+1th4JFI5skwEh7/IIC16CRsJOkEkEIAcfi6ch+c5NsIYCPc6wIhbA7A961LKAtC+LcvRKDGCXqjIghgZytBtA6HYFvCIDYWwMCdAIRHYeSd9kEAq9IkzBSnYpY0hnQA38hC4awIhUv1eiyqDoBnvT+EDb7wa3WHn+o7+KudofdZhAqjIlUjQox9A6HvfQSGi1Ng5HMCBj4jn+vW5SmwLkuiaRpLcyUKc6S7ML9iK5xkG+AiD9AC1AghrPOAT4MrlrUs0D6nRFoFBb1GySsrIZPJIJVKIRFLIBaJUF5ejtLSUpQUl6C4qAjXrl7DxV8LwBcOh7AujSWABHqP2IdZol2YI9qK+dIf4FQRjAWVAXCtWgoPpReE9e6UBdd3/2fmr1+//mgV5OfDyHc4AFu2JXtgR3Io204AoQSwngBW4duKZXCVe3HyrHYf/F8WOXvw8+fP0dJ5F99uyYLDuoxhGhgY4O67kpdHAP+m7UgfEYKt2SWbMKf8R8wTBcNRtBzOkqVYKPUd+X6Wdh0AU3PnHThvPg/7tacHiQG8evUKubm5WgDfdBh6nxj5of/LYns+FMDpHxmwW31qkJ49e8YBXM65/BaAR0XJ80qDkdexjwYRuMWD7xr37n5WcDqAZk0fHDedgW1I+mAFp+Pp06d4+fIlci5dGgxAbcmj2cBbfIxgjoLnmToMhueWBP6iRDKOh2BRAgR0ffsjq3YdwOqYXMwMPjFcq07gyZMnHMDF7OyRAYTHYEwAxouPkFJh7JkCvsdhUjL47ofAZxBuiQQQB8HC9wBYqzGA+w/oFTzo+Bsd45Rd2sSJfX78+DFevHiB7Kys/xMgYXCGWJ8zgO7b92EVcPStsksbubSzyLOKG/Do0SMOIOv8L1wHfBIAbcMgc7bYkNFtgeuWn2G5MgW+4ZlvzVnkzPzhw4ccwPnMc9w4NqKJyPNJ+0iARBgvShpuzhabcAyAPVzW2A2LFYcRtO8CV/XvQzAxyMyMDBrLqXQoUdF5M2OtOY/OiREB3JIhcDs0sjlbbLzqphxrM3lTDyKOFHIFx6B00rXp2TNnMGp7HcYHUTfQ+cDzOkIdcIS7ao1J7Hv3FBi7J3/YWLcKCwu58comHBsyrM9Zq7FqZwXH9pylnUXOzNNOnsJn4SqwQ2x0eBPG/LOKTstiGPxYDkGoCFO2leIvwVl/bvxm/RdQA2dF0M2m2gAAAABJRU5ErkJggg==36:T524,--type=gpu-process --disable-breakpad --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1812,i,18319449011516929177,12583561184424983395,262144 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708988185955192 --log-level=0 --mojo-platform-channel-handle=1996 /prefetch:237:T4db,--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --metrics-shmem-handle=2148,i,17267744487367402371,11634344560142731517,524288 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708989122997041 --log-level=0 --mojo-platform-channel-handle=2152 /prefetch:338:T4dc,--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --metrics-shmem-handle=2344,i,1241775883664236765,7783346831593374003,524288 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708990060038890 --log-level=0 --mojo-platform-channel-handle=2840 /prefetch:839:T5c4,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1793245970643619 --launch-time-ticks=2417480101 --metrics-shmem-handle=3368,i,5715496688405882942,18385052539505099290,2097152 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708990997080739 --log-level=0 --mojo-platform-channel-handle=3392 /prefetch:13a:T5dd,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1793245970643619 --launch-time-ticks=2418577103 --metrics-shmem-handle=4588,i,6046968942318215975,2254561167036244339,2097152 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708991934122588 --log-level=0 --mojo-platform-channel-handle=4548 /prefetch:13b:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1793245970643619 --launch-time-ticks=2422755002 --metrics-shmem-handle=3164,i,13400429447663338110,14620108493721196487,2097152 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708992871164437 --log-level=0 --mojo-platform-channel-handle=5460 /prefetch:13c:T4db,--type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --metrics-shmem-handle=5596,i,3084809342326149800,10293004793928433419,524288 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708993808206286 --log-level=0 --mojo-platform-channel-handle=5564 /prefetch:83d:T5de,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1793245970643619 --launch-time-ticks=2424049405 --metrics-shmem-handle=4568,i,7438369747218726186,13160604040076556484,2097152 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708994745248135 --log-level=0 --mojo-platform-channel-handle=5644 /prefetch:13e:T5e0,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1793245970643619 --launch-time-ticks=2424357216 --metrics-shmem-handle=3408,i,11675171344119100994,10229371721047335238,2097152 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708995682289984 --log-level=0 --mojo-platform-channel-handle=5728 /prefetch:13f:T5de,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1793245970643619 --launch-time-ticks=2432831720 --metrics-shmem-handle=4028,i,15011107016900093573,308319500418740755,2097152 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708997556373682 --log-level=0 --mojo-platform-channel-handle=4612 /prefetch:140:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1793245970643619 --launch-time-ticks=2433521035 --metrics-shmem-handle=6148,i,10577447837671987269,4347859551368545418,2097152 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708998493415531 --log-level=0 --mojo-platform-channel-handle=4616 /prefetch:141:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1793245970643619 --launch-time-ticks=2434064246 --metrics-shmem-handle=6132,i,15650274963700948561,9789656881373990343,2097152 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708999430457380 --log-level=0 --mojo-platform-channel-handle=4040 /prefetch:142:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --time-ticks-at-unix-epoch=-1793245970643619 --launch-time-ticks=2434580328 --metrics-shmem-handle=6148,i,11872630974139005340,8803098415491316686,2097152 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709000367499229 --log-level=0 --mojo-platform-channel-handle=6384 /prefetch:143:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --time-ticks-at-unix-epoch=-1793245970643619 --launch-time-ticks=2435085836 --metrics-shmem-handle=6148,i,1576914733895326793,13243163879738917913,2097152 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709001304541078 --log-level=0 --mojo-platform-channel-handle=6532 /prefetch:144:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --time-ticks-at-unix-epoch=-1793245970643619 --launch-time-ticks=2435594755 --metrics-shmem-handle=6636,i,7004928913156173270,13007379411498300873,2097152 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709002241582927 --log-level=0 --mojo-platform-channel-handle=6624 /prefetch:145:T5e0,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --time-ticks-at-unix-epoch=-1793245970643619 --launch-time-ticks=2436108238 --metrics-shmem-handle=6656,i,12603941959131411844,17939009155370347778,2097152 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709003178624776 --log-level=0 --mojo-platform-channel-handle=6776 /prefetch:146:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --time-ticks-at-unix-epoch=-1793245970643619 --launch-time-ticks=2496238071 --metrics-shmem-handle=5648,i,12610927052083515792,3661856002942792317,2097152 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709004115666625 --log-level=0 --mojo-platform-channel-handle=6164 /prefetch:147:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --time-ticks-at-unix-epoch=-1793245970643619 --launch-time-ticks=2496947821 --metrics-shmem-handle=6704,i,15699124657105955773,5859355362717459148,2097152 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709005052708474 --log-level=0 --mojo-platform-channel-handle=6648 /prefetch:148:T4ed,--type=utility --utility-sub-type=webapps.mojom.WebAppOriginAssociationParser --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --metrics-shmem-handle=3832,i,18073947095699485352,11616397325889019674,524288 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709005989750323 --log-level=0 --mojo-platform-channel-handle=5908 /prefetch:849:T5c1,--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.5794 --disable-breakpad --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmpuntwk05c" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4656,i,11593461974212067126,14284902849347959689,262144 --field-trial-handle=2000,i,5273963979628757961,17538560671246156225,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709006926792172 --log-level=0 --mojo-platform-channel-handle=4668 /prefetch:81d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"cc29c8d2f35603c016320b6510607571f62a1684ac273688d5dc417d5b615137","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1793248608100,"unified_at":"2026-10-29T04:36:48.100Z","metadata":{"hashes":{"sha256":"cc29c8d2f35603c016320b6510607571f62a1684ac273688d5dc417d5b615137","sha1":"46fe3c72b18ac037205354118059ecd1748e953a","md5":"da9b80fc9f5081e84b402aefc8e42829","sha512":"098ed93c38d14e209727dc62f36ff53b9bb4308fc00beccf9675fc4251f44289618d189704fe4eef6c0e7f3607b7093009fb7e5ce46912004b20be030965d90b","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"https://shared-cloud-manager.folio.io.vn/w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/INVIT=364440204111982654914037898403225251795987579778814986454152","file_type":["url"],"file_type_id":"url","file_size":0,"is_container_sample":false,"url_analysis":true},"submissions":{"first_seen":1793248288000,"last_seen":1793248288000,"last_multi_scan":1793248288000}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":["fake_captcha","url_encoding","social_engineering","form_submission","captcha"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":6},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":22},"sandbox_signatures":{"informative_count":32,"suspicious_count":3,"malicious_count":0,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"bforeai":{"name":"BforeAI","success":true,"verdict":"undetected","status":"no-result","progress":100,"data_source":"BforeAI","permalink":"https://bfore.ai/"},"cleandns":{"name":"CleanDNS","success":true,"verdict":"undetected","status":"no-result","progress":100,"data_source":"CleanDNS","permalink":"https://www.cleandns.com/","extra_fields":[{"name":"domain","value":"shared-cloud-manager.folio.io.vn"},{"name":"percent","value":0},{"name":"reports_count","value":0}]},"criminalip":{"name":"Criminal IP","success":true,"verdict":"clean","status":"clean","progress":100,"data_source":"Criminal IP","permalink":"https://www.criminalip.io/","report_link":"https://www.criminalip.io/domain/report?scan_id=74839306","extra_fields":[{"name":"phishing_probability","value":0},{"name":"is_fake_domain","value":false},{"name":"suspicious_file_count","value":0},{"name":"is_invalid_ssl","value":false},{"name":"is_suspicious_cookie","value":false},{"name":"dga_score","value":0},{"name":"credential_input","value":"safe"},{"name":"is_url_analysis","value":true},{"name":"is_mitm_attack","value":false},{"name":"suspicious_html_element_count","value":2},{"name":"critical_abuse_record_count","value":0},{"name":"phishing_record_count","value":0},{"name":"dangerous_abuse_record_count","value":0},{"name":"percent","value":40}]},"scamadviser":{"name":"ScamAdviser","success":true,"verdict":"undetected","status":"unsure","progress":100,"data_source":"ScamAdviser","permalink":"https://www.scamadviser.com/?utm_source=hybridanalysis","report_link":"https://www.scamadviser.com/check-website/shared-cloud-manager.folio.io.vn?utm_source=hybridanalysis","extra_fields":[{"name":"domain","value":"shared-cloud-manager.folio.io.vn"},{"name":"percent","value":20}]},"urlscanio":{"name":"urlscan.io","success":true,"verdict":"undetected","status":"no-classification","progress":100,"data_source":"urlscan.io","permalink":"https://urlscan.io/","report_link":"https://urlscan.io/result/01a185ed-61b7-763f-a594-b05a0f138881/","extra_fields":[{"name":"percent","value":0}]},"vipre":{"name":"Vipre","success":true,"verdict":"undetected","status":"no-result","progress":100,"data_source":"Vipre","permalink":"https://vipre.com/","extra_fields":[{"name":"percent","value":0}]}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Detected User Agent or request patterns of known vulnerability scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"informative","value":"Detected CAPTCHA challenge content in webpage"},{"type":"informative","value":"Detected URL or domain pattern embedded within URL path"},{"type":"informative","value":"Detected credential input form in webpage"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Execution","technique":"Malicious Link","attack_id":"T1204.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/001","identifiers":[{"type":"suspicious","value":"Detected social engineering methods via fake CAPTCHA site in HTML"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"Remote JavaScript loaded at runtime during browser detonation"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Credential Access","technique":"Web Portal Capture","attack_id":"T1056.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/003","identifiers":[{"type":"suspicious","value":"Form or script submission detected during browser detonation"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server"},{"type":"informative","value":"Contacts random domain names"},{"type":"informative","value":"Identifies external resources in HTML content"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"suspicious","value":"Contacts Mail Related Domain Names"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Detection of obfuscated or encoded content in URLs"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"chrome.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Session Traversal Utilities for NAT (STUN Binding Request)\" (SID: 2016149, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Session Traversal Utilities for NAT (STUN Binding Response)\" (SID: 2016150, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)\" (SID: 2033078, Rev: 5, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.google.com\"\n \"shared-cloud-manager.folio.io.vn\"\n \"challenges.cloudflare.com\"\n \"static.cloudflareinsights.com\"\n \"thumb.wikimedia.org\"\n \"chat.google.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.75.180\"\n \"104.21.75.180:443\"\n \"142.251.41.174:80\"\n \"142.251.155.119:443\"\n \"172.253.63.84:443\"\n \"142.251.155.119\"\n \"142.251.151.120:443\"\n \"142.250.190.234:443\"\n \"142.251.156.7:443\"\n \"104.16.79.73:443\"\n \"104.18.95.41:443\"\n \"162.159.207.0:3478\"\n \"74.125.250.129:19302\"\n \"208.80.153.224:443\"\n \"142.250.190.238:443\"\n \"173.194.45.188:5228\"\n \"104.18.95.41\"\n \"142.251.45.165:443\"\n \"142.251.153.120:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$27","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"permarcussen@post.dk\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"General","name":"GETs files from a web server","description":"$28","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-8622","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"General","name":"POSTs data to a web server","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-8621","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"accounts.google.com\"\n \"android.clients.google.com\"\n \"brunhild.challenges.cloudflare.com\"\n \"challenges.cloudflare.com\"\n \"chat.google.com\"\n \"clients1.google.com\"\n \"clients2.google.com\"\n \"mail.google.com\"\n \"mtalk.google.com\"\n \"ogads-pa.clients6.google.com\"\n \"play.google.com\"\n \"shared-cloud-manager.folio.io.vn\"\n \"ssl.gstatic.com\"\n \"static.cloudflareinsights.com\"\n \"stun.cloudflare.com\"\n \"stun.l.google.com\"\n \"stun1.l.google.com\"\n \"thumb.wikimedia.org\"\n \"www.google.com\"\n \"www.gstatic.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$29","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlref_httpsshared-cloud-manager.folio.io.vnwei_1751289670562732151166080940319016694263902887701215048success%25post.dk%25id%25per.mar\" has type \"HTML document Unicode text UTF-8 text with very long lines (530)\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"chrome.exe\" opens a process \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (UID: 00000000-00006292)\n \"chrome.exe\" opens a process \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (UID: 00000000-00005732)\n \"chrome.exe\" opens a process \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (UID: 00000000-00004840)\n \"chrome.exe\" opens a process \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (UID: 00000000-00004956)\n \"chrome.exe\" opens a process \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (UID: 00000000-00000412)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Network Related","name":"Contacts random domain names","description":"\"stun.cloudflare.com\" seems to be random","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 142.251.41.174 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Network Related","name":"Detected URL or domain pattern embedded within URL path","description":"Discovered embedded domains:\n-> success%post.dk%\n\nSource URL: https://shared-cloud-manager.folio.io.vn/w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/INVIT=364440204111982654914037898403225251795987579778814986454152","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":8,"id":"network-8607","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Network Related","name":"Detected User Agent or request patterns of known vulnerability scanning tools","description":"Vulnerability scan URL pattern \"/.well-known/\" requested from \"chat.google.com\"","origin":"Network Traffic","mitre_attack_id":"T1595.002","relevance":1,"id":"network-115","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Network Related","name":"Detection of obfuscated or encoded content in URLs","description":"Original URL:\nhttps://shared-cloud-manager.folio.io.vn/w/ei=1751289670562732151166080940319016694263902887701215048/success%25post.dk%25/id%25per.marcussen%25/INVIT=364440204111982654914037898403225251795987579778814986454152\n\nDecoded URL:\nhttps://shared-cloud-manager.folio.io.vn/w/ei=1751289670562732151166080940319016694263902887701215048/success%post.dk%/id%per.marcussen%/INVIT=364440204111982654914037898403225251795987579778814986454152\n","origin":"Network Traffic","mitre_attack_id":"T1027","relevance":8,"id":"network-8615","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"1.2.1.1\" found in string \"/cdn-cgi/challenge-platform/h/g/fo/2544198922:1793246418:0s2MsVefCOD3alPX-DDml8pJAB7jQFyms85SEEHKLvE/a51f761a0ef2f005/3Lidd95hBNkE08iwkD132rAVc1oaGX3WsDxYSgpFq7k-1793248398-1.2.1.1-ikEEuwOdpcYkuFesoc0h8vhE_qUdhlurlGUHF3cNsSexpdqlWoJYc42arS2eeB9O\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"shared-cloud-manager.folio.io.vn\" has high entropy\n Contacted domain: \"challenges.cloudflare.com\" has high entropy\n Contacted domain: \"static.cloudflareinsights.com\" has high entropy\n Contacted domain: \"thumb.wikimedia.org\" has high entropy\n Contacted domain: \"android.clients.google.com\" has high entropy\n Contacted domain: \"ogads-pa.clients6.google.com\" has high entropy\n Contacted domain: \"stun.cloudflare.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"shared-cloud-manager.folio.io.vn\" (6 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"$2c","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Pattern Matching","name":"Browser-observed domain contacts (CDP)","description":"Domains contacted (5):\n shared-cloud-manager.folio.io.vn\n challenges.cloudflare.com\n static.cloudflareinsights.com\n brunhild.challenges.cloudflare.com\n thumb.wikimedia.org","origin":"Unknown","relevance":10,"id":"cdp-8615","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Pattern Matching","name":"Detected CAPTCHA challenge content in webpage","description":"Detected CAPTCHA challenge content via OCR analysis. (Source: screen_5.png | Matches: 4 | Pairs: confirm+human)","origin":"File/Memory","mitre_attack_id":"T1566","relevance":3,"id":"string-8608","sources":[{"report_type":"sandbox","report_id":"6ae2cc1fbfb610cf380412b6"}]},{"level":"informative","category":"Pattern Matching","name":"Detected CAPTCHA implementation in HTML content","description":"CAPTCHA Implementation Detected:\n\nCaptcha Elements:\n-> class=\"cf-turnstile\"\n-> data-callback=\"onHuman\"\n-> data-sitekey=\"0x4AAAAAAFbs5vUs-OBVcJ4C\"\n\nCaptcha Scripts:\n->