Windows Analysis Report
https://www.extcovdoc125.org/

Overview

General Information

Sample URL: https://www.extcovdoc125.org/
Analysis ID: 634729
Infos:

Detection

HTMLPhisher
Score: 64
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish10
Snort IDS alert for network traffic
Phishing site detected (based on logo template match)
Phishing site detected (based on image similarity)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
No HTML title found
Detected potential crypto function
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
HTML body contains low number of good links
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Extensive use of GetProcAddress (often used to hide API calls)
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Found evasive API chain checking for process token information
Invalid T&C link found
Contains functionality for read data from the clipboard

Classification

Phishing
barindex
Yara detected HtmlPhish10
Source: Yara match File source: 81505.1.pages.csv, type: HTML
Phishing site detected (based on logo template match)
Source: https://torch-rare-nerine.glitch.me/extdoc125index.html Matcher: Template: onedrive matched
Phishing site detected (based on image similarity)
Source: embedded Matcher: Found strong image similarity, brand: Microsoft image: 81505.1.img.2.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
No HTML title found
Source: https://torch-rare-nerine.glitch.me/extdoc125index.html HTTP Parser: HTML title missing
Source: https://torch-rare-nerine.glitch.me/extdoc125index.html HTTP Parser: HTML title missing
HTML body contains low number of good links
Source: https://torch-rare-nerine.glitch.me/extdoc125index.html HTTP Parser: Number of links: 0
Source: https://torch-rare-nerine.glitch.me/extdoc125index.html HTTP Parser: Number of links: 0
Invalid T&C link found
Source: https://torch-rare-nerine.glitch.me/extdoc125index.html HTTP Parser: Invalid link: Privacy & Cookies
Source: https://torch-rare-nerine.glitch.me/extdoc125index.html HTTP Parser: Invalid link: Privacy & Cookies
Source: https://torch-rare-nerine.glitch.me/extdoc125index.html HTTP Parser: No <meta name="author".. found
Source: https://torch-rare-nerine.glitch.me/extdoc125index.html HTTP Parser: No <meta name="author".. found
Source: https://torch-rare-nerine.glitch.me/extdoc125index.html HTTP Parser: No <meta name="copyright".. found
Source: https://torch-rare-nerine.glitch.me/extdoc125index.html HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\5164_329640452\LICENSE.txt Jump to behavior
Source: unknown HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.4:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.102.176.152:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.82.210.154:443 -> 192.168.2.4:49863 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.82.210.154:443 -> 192.168.2.4:49862 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.35.236.56:443 -> 192.168.2.4:49874 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49880 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.4:49881 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49883 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.4:49889 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49891 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.4:49898 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49906 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.4:49911 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49914 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49918 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.4:49925 version: TLS 1.2
Source: unknown HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.4:49926 version: TLS 1.2
Source: unknown HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.4:49923 version: TLS 1.2
Source: unknown HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.4:49927 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49928 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.4:49929 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49931 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49932 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49933 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49934 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.4:49938 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Directory created: C:\Program Files\Google\Chrome\ChromeRecovery Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Directory created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Directory created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecoveryCRX.crx Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Directory created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Directory created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\manifest.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Directory created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\_metadata\ Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Directory created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\_metadata\verified_contents.json Jump to behavior
Source: Binary string: GoogleUpdateB231574670_unsigned.pdb` source: ChromeRecovery.exe, 00000019.00000002.428435187.0000000000DC7000.00000002.00000001.01000000.00000006.sdmp, ChromeRecovery.exe, 00000019.00000000.427447807.0000000000DC7000.00000002.00000001.01000000.00000006.sdmp, ChromeRecovery.exe.22.dr
Source: Binary string: GoogleUpdateB231574670_unsigned.pdb source: ChromeRecovery.exe, 00000019.00000002.428435187.0000000000DC7000.00000002.00000001.01000000.00000006.sdmp, ChromeRecovery.exe, 00000019.00000000.427447807.0000000000DC7000.00000002.00000001.01000000.00000006.sdmp, ChromeRecovery.exe.22.dr
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DB98C3 FindFirstFileExW, 25_2_00DB98C3

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2013145 ET SHELLCODE Possible %41%41%41%41 Heap Spray Attempt 52.203.39.37:443 -> 192.168.2.4:49826
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown Network traffic detected: HTTP traffic on port 49888 -> 443
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 26 May 2022 16:22:57 GMTContent-Length: 3672Connection: closeCache-Control: max-age=0
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.143
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.4
Source: Ruleset Data.0.dr String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr, Ruleset Data.0.dr String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)
Source: elevation_service.exe, 00000016.00000003.423563012.0000015C88993000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.425903505.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.423573982.0000015C8898A000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.424706914.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.427551053.0000015C88991000.00000004.00000020.00020000.00000000.sdmp, ChromeRecovery.exe.22.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: elevation_service.exe, 00000016.00000003.423563012.0000015C88993000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000002.429760228.0000015C8898F000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.425903505.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.423573982.0000015C8898A000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.429166091.0000015C8898F000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.427560610.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.424706914.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, ChromeRecovery.exe.22.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: elevation_service.exe, 00000016.00000003.423563012.0000015C88993000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.425903505.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.423573982.0000015C8898A000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.424706914.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.427551053.0000015C88991000.00000004.00000020.00020000.00000000.sdmp, ChromeRecovery.exe.22.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: elevation_service.exe, 00000016.00000003.423563012.0000015C88993000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.425903505.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.423573982.0000015C8898A000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.424706914.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.427551053.0000015C88991000.00000004.00000020.00020000.00000000.sdmp, ChromeRecovery.exe.22.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: elevation_service.exe, 00000016.00000003.423563012.0000015C88993000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000002.429760228.0000015C8898F000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.425903505.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.423573982.0000015C8898A000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.429166091.0000015C8898F000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.427560610.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.424706914.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, ChromeRecovery.exe.22.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ChromeRecovery.exe.22.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: elevation_service.exe, 00000016.00000003.423563012.0000015C88993000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.425903505.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.423573982.0000015C8898A000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.424706914.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.427551053.0000015C88991000.00000004.00000020.00020000.00000000.sdmp, ChromeRecovery.exe.22.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: elevation_service.exe, 00000016.00000003.423563012.0000015C88993000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.425903505.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.423573982.0000015C8898A000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.424706914.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.427551053.0000015C88991000.00000004.00000020.00020000.00000000.sdmp, ChromeRecovery.exe.22.dr String found in binary or memory: http://ocsp.digicert.com0
Source: elevation_service.exe, 00000016.00000003.423563012.0000015C88993000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.425903505.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.423573982.0000015C8898A000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.424706914.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.427551053.0000015C88991000.00000004.00000020.00020000.00000000.sdmp, ChromeRecovery.exe.22.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: elevation_service.exe, 00000016.00000003.423563012.0000015C88993000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000002.429760228.0000015C8898F000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.425903505.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.423573982.0000015C8898A000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.429166091.0000015C8898F000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.427560610.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.424706914.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, ChromeRecovery.exe.22.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: elevation_service.exe, 00000016.00000003.423563012.0000015C88993000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.425903505.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.423573982.0000015C8898A000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.424706914.0000015C8898D000.00000004.00000020.00020000.00000000.sdmp, elevation_service.exe, 00000016.00000003.427551053.0000015C88991000.00000004.00000020.00020000.00000000.sdmp, ChromeRecovery.exe.22.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr, 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr String found in binary or memory: https://accounts.google.com/MergeSession
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr String found in binary or memory: https://ajax.googleapis.com
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr, 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://apis.google.com
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr, 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json1.0.dr, manifest.json.0.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr, 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr String found in binary or memory: https://content-autofill.googleapis.com
Source: LICENSE.txt.0.dr String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: 76a08e1b-f850-43ff-98b8-abad74e26e25.tmp.1.dr, ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr, 95a364d5-26f9-4ca9-adeb-c806278941d8.tmp.1.dr, 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://dns.google
Source: LICENSE.txt.0.dr String found in binary or memory: https://easylist.to/)
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr, 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://fonts.googleapis.com
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr, 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://fonts.gstatic.com
Source: LICENSE.txt.0.dr String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr, 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr, 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://play.google.com
Source: 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr, 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr String found in binary or memory: https://siteassets.parastorage.com
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr, 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://ssl.gstatic.com
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr String found in binary or memory: https://static.wixstatic.com
Source: History Provider Cache.0.dr String found in binary or memory: https://torch-rare-nerine.glitch.me/extdoc125index.html2
Source: craw_window.js.0.dr, craw_background.js.0.dr String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr String found in binary or memory: https://www.extcovdoc125.org
Source: History Provider Cache.0.dr String found in binary or memory: https://www.extcovdoc125.org/2
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr, 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: craw_window.js.0.dr, craw_background.js.0.dr, ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr, 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: ad8021df-c392-483e-a98f-826780bc171d.tmp.1.dr, 9e61d1e6-e002-42ab-9f16-2495e9afe44b.tmp.1.dr String found in binary or memory: https://www.gstatic.com
Source: unknown HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitContent-type: text/xmlX-MSEdge-ExternalExpType: JointCoordX-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40X-PositionerType: DesktopX-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: 60X-BM-FirstEnabledTime: 132061327679472806X-DeviceID: 0100748C0900D485X-BM-DeviceScale: 100X-Search-TimeZone: Bias=-60; StandardBias=0; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-BM-DeviceDimensionsLogical: 1232x1024X-BM-DeviceDimensions: 1232x1024X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAcrCUQHVmc1QWYMPz0DXFqeRx8wamoowmwbwUSyNYpjtyJpJRDfEtLg1rKS4/zxABCoKsuMFRUBIP7PFid4xD2qKyI0URDzKuBMFjFkKzlG3Ps9MGF%2BBZXTdKnpAzZrlgOtRPCtamchXz28q0CRmPxXD6ZHI2rcMOvnUBLbt1zkoTBTKYibaVaGygpAEYQDTKkpAamKV8eOep8EnHN50LiR92MCKiQtLylSx/qTDVfvmE81bne2UzPZEbqlm/DPuKdzajAWp%2BXa91MUXk%2BgPu95uggy8QPGrNOWbn7IkTjFjqBdAhJ5m/BiU45rQu3ck%2B6RC%2BU%2BEalYU42PwbfQmsDwDZgAACHBtXI8rJNLaqAG5bveMLq14sdqoo9yPGDTdHxA7OjsAOmIxUTUXgi%2B44zK9rStYOMPMq4e6et15tJFBbG2jKGVdJMY3ZkTFu%2BHWNopmckOWLVgFNq79y3hmsdxc1wOedU50wO01k4tR95v4Imjx%2BJujGLa9TWHvuxeDQi9Y4ybY/y9vY1LteXSo0kKHbGazTsLNxyFfmSDOcn8ClbW9bmk0c4jHKD1yRpmMUoJ6GMEDPMqNOCkwrk63Ab7wPb/Ik//Xt/R1gr%2Bom7Tc2OeYYcdyru5UC/xxsJOAvl6NlTvqnrrwv3tNwIcpsdUqBF6TuxWSlAQvZrc4R0FfqAmC1gmCnHgcn6LOJmRb0NP4X2cysqVe7yMirSTCCMByWMIyPaVuut%2BME7E/g1i7%2BF6GOmOb4jaw5esWXZItZITutJph%2B%2BiB5Jhj5m5K8KwagRMAS5gWCtioSFd8CezxoiPqJxEvqdn2z7PYPJa2IEPLnuo8hgVRtHuU8/aTQiACqk%2BA7ilNPbpjD1XsiVE35rwQalWYecZgjOX1bVhMm1bTSpRC5s14qea2UC8ENIkJSR9nRsud1AE%3D%26p%3DX-Agent-DeviceId: 0100748C0900D485X-BM-CBT: 1646732532X-Device-isOptin: trueX-Device-Touch: falseX-Device-ClientSession: B3FD0EB2977A44E390C07B484049F516X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderAccept: */*Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: www.bing.comContent-Length: 87238Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=BEEBF15262804E24A8DF6781500AB975; _SS=CPID=1653582146793&AC=1&CPH=4ef661f2
Source: unknown DNS traffic detected: queries for: accounts.google.com
Source: global traffic HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220308T094316Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=81bae2f7770f482c9fd83c782c1a80fe&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1417890&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1417890&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32089&sc=6Cache-Control: no-cacheMS-CV: f9dh9gsMmkKiW/nL.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220308T094316Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f9438c1e240a4fa8b1f2c9ff23cc84cc&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1417890&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1417890&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32089&sc=6Cache-Control: no-cacheMS-CV: f9dh9gsMmkKiW/nL.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.extcovdoc125.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /pages/pages/thunderbolt?beckyExperiments=specs.thunderbolt.responsiveAbsoluteChildrenPosition%3Atrue%2Cspecs.thunderbolt.byRefV2%3Atrue%2Cspecs.thunderbolt.DatePickerPortal%3Atrue%2Cspecs.thunderbolt.SearchBoxSuggestionsFacelift%3Atrue%2Cspecs.thunderbolt.LinkBarPlaceholderImages%3Atrue%2Cspecs.thunderbolt.LoginSocialBarNewStyles%3Atrue%2Cspecs.thunderbolt.final_image_auto_encode%3Atrue%2Cspecs.thunderbolt.inflatePresetsWithNoDefaultItems%3Atrue%2Cspecs.thunderbolt.FilterResponsiveEditorMasterPageTpas%3Atrue%2Cspecs.thunderbolt.maskImageCSS%3Atrue&contentType=application%2Fjson&deviceType=Desktop&dfCk=6&dfVersion=1.1581.0&excludedSafariOrIOS=false&experiments=bv_remove_add_chat_viewer_fixer%2Cdm_enableDefaultA11ySettings%2Cdm_fixStylableButtonProperties%2Cdm_fixVectorImageProperties%2Cdm_migrateToTextTheme&externalBaseUrl=https%3A%2F%2Fwww.extcovdoc125.org&fileId=dd6ac2cd.bundle.min&hasTPAWorkerOnSite=false&isHttps=true&isInSeo=false&isMultilingualEnabled=false&isPremiumDomain=true&isResponsive=true&isUrlMigrated=true&isWixCodeOnPage=false&isWixCodeOnSite=false&language=en&languageResolutionMethod=QueryParam&metaSiteId=361b8621-7187-4e93-b748-a6b720cc5eed&module=thunderbolt-features&originalLanguage=en&pageId=02b81a_f192a665d6f4a069b78583698aeb4878_1.json&quickActionsMenuEnabled=false&registryLibrariesTopology=%5B%7B%22artifactId%22%3A%22editor-elements%22%2C%22namespace%22%3A%22wixui%22%2C%22url%22%3A%22https%3A%2F%2Fstatic.parastorage.com%2Fservices%2Feditor-elements%2F1.8684.0%22%7D%2C%7B%22artifactId%22%3A%22editor-elements%22%2C%22namespace%22%3A%22dsgnsys%22%2C%22url%22%3A%22https%3A%2F%2Fstatic.parastorage.com%2Fservices%2Feditor-elements%2F1.8684.0%22%7D%5D&remoteWidgetStructureBuilderVersion=1.233.0&siteId=d2f95b4d-d274-49b1-b7ae-045e9f4850bf&siteRevision=5&staticHTMLComponentUrl=https%3A%2F%2Fwww-extcovdoc125-org.filesusr.com%2F&useSandboxInHTMLComp=false&viewMode=desktop HTTP/1.1Host: siteassets.parastorage.comConnection: keep-aliveOrigin: https://www.extcovdoc125.orgUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.extcovdoc125.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /pages/pages/thunderbolt?beckyExperiments=specs.thunderbolt.responsiveAbsoluteChildrenPosition%3Atrue%2Cspecs.thunderbolt.byRefV2%3Atrue%2Cspecs.thunderbolt.DatePickerPortal%3Atrue%2Cspecs.thunderbolt.SearchBoxSuggestionsFacelift%3Atrue%2Cspecs.thunderbolt.LinkBarPlaceholderImages%3Atrue%2Cspecs.thunderbolt.LoginSocialBarNewStyles%3Atrue%2Cspecs.thunderbolt.final_image_auto_encode%3Atrue%2Cspecs.thunderbolt.inflatePresetsWithNoDefaultItems%3Atrue%2Cspecs.thunderbolt.FilterResponsiveEditorMasterPageTpas%3Atrue%2Cspecs.thunderbolt.maskImageCSS%3Atrue&contentType=application%2Fjson&deviceType=Desktop&dfCk=6&dfVersion=1.1581.0&excludedSafariOrIOS=false&experiments=bv_remove_add_chat_viewer_fixer%2Cdm_enableDefaultA11ySettings%2Cdm_fixStylableButtonProperties%2Cdm_fixVectorImageProperties%2Cdm_migrateToTextTheme&externalBaseUrl=https%3A%2F%2Fwww.extcovdoc125.org&fileId=dd6ac2cd.bundle.min&hasTPAWorkerOnSite=false&isHttps=true&isInSeo=false&isMultilingualEnabled=false&isPremiumDomain=true&isResponsive=true&isUrlMigrated=true&isWixCodeOnPage=false&isWixCodeOnSite=false&language=en&languageResolutionMethod=QueryParam&metaSiteId=361b8621-7187-4e93-b748-a6b720cc5eed&module=thunderbolt-features&originalLanguage=en&pageId=02b81a_0390df0e91f92b3ba3cabf7fdf607812_5.json&quickActionsMenuEnabled=false&registryLibrariesTopology=%5B%7B%22artifactId%22%3A%22editor-elements%22%2C%22namespace%22%3A%22wixui%22%2C%22url%22%3A%22https%3A%2F%2Fstatic.parastorage.com%2Fservices%2Feditor-elements%2F1.8684.0%22%7D%2C%7B%22artifactId%22%3A%22editor-elements%22%2C%22namespace%22%3A%22dsgnsys%22%2C%22url%22%3A%22https%3A%2F%2Fstatic.parastorage.com%2Fservices%2Feditor-elements%2F1.8684.0%22%7D%5D&remoteWidgetStructureBuilderVersion=1.233.0&siteId=d2f95b4d-d274-49b1-b7ae-045e9f4850bf&siteRevision=5&staticHTMLComponentUrl=https%3A%2F%2Fwww-extcovdoc125-org.filesusr.com%2F&useSandboxInHTMLComp=false&viewMode=desktop HTTP/1.1Host: siteassets.parastorage.comConnection: keep-aliveOrigin: https://www.extcovdoc125.orgUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.extcovdoc125.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /media/02b81a_70fc0acae7884e1fa34a11a1711c102e~mv2.png/v1/fill/w_245,h_126,al_c,q_85,usm_0.66_1.00_0.01,blur_2,enc_auto/Screenshot%202022.png HTTP/1.1Host: static.wixstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.extcovdoc125.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /media/02b81a_70fc0acae7884e1fa34a11a1711c102e~mv2.png/v1/fill/w_931,h_570,al_c,q_90,usm_0.66_1.00_0.01,enc_auto/Screenshot%202022.png HTTP/1.1Host: static.wixstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.extcovdoc125.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /_api/v2/dynamicmodel HTTP/1.1Host: www.extcovdoc125.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.extcovdoc125.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: ssr-caching=cache#desc=hit#varnish=hit#dc#desc=euw3; XSRF-TOKEN=1653582165|HZpWdyMf1a2f
Source: global traffic HTTP traffic detected: GET /_api/tag-manager/api/v1/tags/sites/361b8621-7187-4e93-b748-a6b720cc5eed?wixSite=false&htmlsiteId=d2f95b4d-d274-49b1-b7ae-045e9f4850bf&language=en HTTP/1.1Host: www.extcovdoc125.orgConnection: keep-aliveauthorization: wxCSMZwkquIzJ-JsDd1_HmhUFl5FISDrtJV1GxpE83E.eyJpbnN0YW5jZUlkIjoiMzYxYjg2MjEtNzE4Ny00ZTkzLWI3NDgtYTZiNzIwY2M1ZWVkIiwiYXBwRGVmSWQiOiIyMmJlZjM0NS0zYzViLTRjMTgtYjc4Mi03NGQ0MDg1MTEyZmYiLCJtZXRhU2l0ZUlkIjoiMzYxYjg2MjEtNzE4Ny00ZTkzLWI3NDgtYTZiNzIwY2M1ZWVkIiwic2lnbkRhdGUiOiIyMDIyLTA1LTI2VDE2OjIyOjQ2LjUwOFoiLCJkZW1vTW9kZSI6ZmFsc2UsImFpZCI6Ijk3YWM4ZDJkLTAwNzItNGYyYy04Nzc3LWY4MzM5ZWI3OGQyNSIsInNpdGVPd25lcklkIjoiMDJiODFhNWEtMTgwNS00YjlmLTgzYTItZTJmNzdmN2RkYjBiIn0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36content-type: application/jsonAccept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.extcovdoc125.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: ssr-caching=cache#desc=hit#varnish=hit#dc#desc=euw3; XSRF-TOKEN=1653582165|HZpWdyMf1a2f; hs=-1923742916; svSession=b08b185dd346498c0607da5cff1a1407284dde81c612d705eef43b774b7c2983e5c6b721e629e5a1803c62b36982ba8b1e60994d53964e647acf431e4f798bcde41610c2bf599792a6d723ea8d111057108bb66378cdacc63645ceba85ae402a8646abbad28f935ea05069a54a82c3e87d842b7a7307fa71357f430f261adc250e3b0f0cf57805cb1efee1f6e2908631; bSession=4b670852-7e7a-4bc3-8324-43727fa80a06|1
Source: global traffic HTTP traffic detected: GET /media/02b81a_70fc0acae7884e1fa34a11a1711c102e~mv2.png/v1/fill/w_931,h_570,al_c,q_90,usm_0.66_1.00_0.01,enc_auto/Screenshot%202022.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: static.wixstatic.com
Source: global traffic HTTP traffic detected: GET /extdoc125index.html HTTP/1.1Host: torch-rare-nerine.glitch.meConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://torch-rare-nerine.glitch.meUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://torch-rare-nerine.glitch.me/extdoc125index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://torch-rare-nerine.glitch.meUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://torch-rare-nerine.glitch.me/extdoc125index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://torch-rare-nerine.glitch.meUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://torch-rare-nerine.glitch.me/extdoc125index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://torch-rare-nerine.glitch.me/extdoc125index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: torch-rare-nerine.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://torch-rare-nerine.glitch.me/extdoc125index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220526T162311Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3069304d8bab462d8a10fb8972611dbd&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1532050&metered=false&nettype=ethernet&npid=sc-280815&oemName=pupkye%2C%20Inc.&oemid=pupkye%2C%20Inc.&ossku=Professional&smBiosDm=pupkye7%2C1&tl=2&tsu=1532050&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32089&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAaSgW0QV2xQ946N/g1NtQ3iQQU/RSrum6sbPcK9+Ibo92CRLwHdxHKriMeWSu2+cvMlGM41XBNTCda1l25WEqBy4Oo2u6LzorUOBirEyvO03AiqjGV3a0Tfn66mPWamklmsrbxQ3v/Ptf5BLjDAYgHnSwjVzVxHgwr5FZGvT8NSxH5p++3bhxsRTXP2jVqGrOdmX849/l7VGljk7wfnIZ/NsXhOLkxnwBvXKYjCQBWnbKiUGLSLvv8BCioZXsr5l4mLjmsvY+B671pvE2vCio/lRWDoz8V0LJohinpq1zvDXGqATXQ7Lz67DkMpcpEQId8ewhgguWUojaAJamPU/7joDZgAACMDy0fspbZK1sAHi0CeAJ/AmPXxmQmv5tob5NWSHU/3HHpbkofX+fi6KN4Aq0Hfw2jzacZxlgXl6nc5owrK8aKchUN82L0y5lydQ714GqL8GXmA/1SNoheH7ORr/fkgcpv5lQY/ygmJfZw0hCXTMQBM28nDXtKsF+0AE/usdD4ulajWFiWatHLd+sQLN4ztstfmcyoScCOpiXbJgKkhbsDhd4lam9RXFD+W7OJBhVNB5VWzPPO32L9hOTZNCs1M6dvLBS8LYAhOA9dPsurqPHL+MKXLdAwzi9H5Lp12vQrRJtWMft51mqv70nO/9WvhjBSucFH6vvWCx365S+CLiCdiSTjYaFvuEvg3B7i1BbfmRjBvP1SZQJB1RxS/9N6we2x8D1QTlw1A7bcDC5MePKUTQdqSM0uvUzpGqU9uiWQjhSQq4rW2gwgOw0Q+bLegrFdU7YbM9VLuoWA2DJgS8Kwn1Fl8xKFZ0zqKQtYPSRRmb/qDlyblcgmAyR4pS+wSDQCjlbeXUkWVphYnNWj8DFe7P67rhQSPmSBsnQ0BGR5uVtxKSj03Z1vjED6KnSLiSsFqxkF+TjKnQmUjYAQ==&p=Cache-Control: no-cacheMS-CV: 8dP2WoF9J0CbdSKy.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220526T162310Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=aa7d8038fa4c410bb6148241f7a6f5ce&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1532050&metered=false&nettype=ethernet&npid=sc-338389&oemName=pupkye%2C%20Inc.&oemid=pupkye%2C%20Inc.&ossku=Professional&smBiosDm=pupkye7%2C1&tl=2&tsu=1532050&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32089&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAaSgW0QV2xQ946N/g1NtQ3iQQU/RSrum6sbPcK9+Ibo92CRLwHdxHKriMeWSu2+cvMlGM41XBNTCda1l25WEqBy4Oo2u6LzorUOBirEyvO03AiqjGV3a0Tfn66mPWamklmsrbxQ3v/Ptf5BLjDAYgHnSwjVzVxHgwr5FZGvT8NSxH5p++3bhxsRTXP2jVqGrOdmX849/l7VGljk7wfnIZ/NsXhOLkxnwBvXKYjCQBWnbKiUGLSLvv8BCioZXsr5l4mLjmsvY+B671pvE2vCio/lRWDoz8V0LJohinpq1zvDXGqATXQ7Lz67DkMpcpEQId8ewhgguWUojaAJamPU/7joDZgAACMDy0fspbZK1sAHi0CeAJ/AmPXxmQmv5tob5NWSHU/3HHpbkofX+fi6KN4Aq0Hfw2jzacZxlgXl6nc5owrK8aKchUN82L0y5lydQ714GqL8GXmA/1SNoheH7ORr/fkgcpv5lQY/ygmJfZw0hCXTMQBM28nDXtKsF+0AE/usdD4ulajWFiWatHLd+sQLN4ztstfmcyoScCOpiXbJgKkhbsDhd4lam9RXFD+W7OJBhVNB5VWzPPO32L9hOTZNCs1M6dvLBS8LYAhOA9dPsurqPHL+MKXLdAwzi9H5Lp12vQrRJtWMft51mqv70nO/9WvhjBSucFH6vvWCx365S+CLiCdiSTjYaFvuEvg3B7i1BbfmRjBvP1SZQJB1RxS/9N6we2x8D1QTlw1A7bcDC5MePKUTQdqSM0uvUzpGqU9uiWQjhSQq4rW2gwgOw0Q+bLegrFdU7YbM9VLuoWA2DJgS8Kwn1Fl8xKFZ0zqKQtYPSRRmb/qDlyblcgmAyR4pS+wSDQCjlbeXUkWVphYnNWj8DFe7P67rhQSPmSBsnQ0BGR5uVtxKSj03Z1vjED6KnSLiSsFqxkF+TjKnQmUjYAQ==&p=Cache-Control: no-cacheMS-CV: 8dP2WoF9J0CbdSKy.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Thu, 20 Apr 2017 16:10:39 GMTUser-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220526T162348Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=fccfb3676c05413a82b9c39e8bc38ff5&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1532050&metered=false&nettype=ethernet&npid=sc-338387&oemName=pupkye%2C%20Inc.&oemid=pupkye%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=pupkye7%2C1&tl=2&tsu=1532050&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32089&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAaSgW0QV2xQ946N/g1NtQ3iQQU/RSrum6sbPcK9+Ibo92CRLwHdxHKriMeWSu2+cvMlGM41XBNTCda1l25WEqBy4Oo2u6LzorUOBirEyvO03AiqjGV3a0Tfn66mPWamklmsrbxQ3v/Ptf5BLjDAYgHnSwjVzVxHgwr5FZGvT8NSxH5p++3bhxsRTXP2jVqGrOdmX849/l7VGljk7wfnIZ/NsXhOLkxnwBvXKYjCQBWnbKiUGLSLvv8BCioZXsr5l4mLjmsvY+B671pvE2vCio/lRWDoz8V0LJohinpq1zvDXGqATXQ7Lz67DkMpcpEQId8ewhgguWUojaAJamPU/7joDZgAACMDy0fspbZK1sAHi0CeAJ/AmPXxmQmv5tob5NWSHU/3HHpbkofX+fi6KN4Aq0Hfw2jzacZxlgXl6nc5owrK8aKchUN82L0y5lydQ714GqL8GXmA/1SNoheH7ORr/fkgcpv5lQY/ygmJfZw0hCXTMQBM28nDXtKsF+0AE/usdD4ulajWFiWatHLd+sQLN4ztstfmcyoScCOpiXbJgKkhbsDhd4lam9RXFD+W7OJBhVNB5VWzPPO32L9hOTZNCs1M6dvLBS8LYAhOA9dPsurqPHL+MKXLdAwzi9H5Lp12vQrRJtWMft51mqv70nO/9WvhjBSucFH6vvWCx365S+CLiCdiSTjYaFvuEvg3B7i1BbfmRjBvP1SZQJB1RxS/9N6we2x8D1QTlw1A7bcDC5MePKUTQdqSM0uvUzpGqU9uiWQjhSQq4rW2gwgOw0Q+bLegrFdU7YbM9VLuoWA2DJgS8Kwn1Fl8xKFZ0zqKQtYPSRRmb/qDlyblcgmAyR4pS+wSDQCjlbeXUkWVphYnNWj8DFe7P67rhQSPmSBsnQ0BGR5uVtxKSj03Z1vjED6KnSLiSsFqxkF+TjKnQmUjYAQ==&p=Cache-Control: no-cacheMS-CV: 8dP2WoF9J0CbdSKy.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=SpotifyAB.SpotifyMusic_zpdnekdrzrea0&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: qef0cWLKyUyxKz1Z.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220526T162348Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=76874fb36a7a4f8a91f1fbcf04ff4b85&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1532050&metered=false&nettype=ethernet&npid=sc-338388&oemName=pupkye%2C%20Inc.&oemid=pupkye%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=pupkye7%2C1&tl=2&tsu=1532050&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32089&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAaSgW0QV2xQ946N/g1NtQ3iQQU/RSrum6sbPcK9+Ibo92CRLwHdxHKriMeWSu2+cvMlGM41XBNTCda1l25WEqBy4Oo2u6LzorUOBirEyvO03AiqjGV3a0Tfn66mPWamklmsrbxQ3v/Ptf5BLjDAYgHnSwjVzVxHgwr5FZGvT8NSxH5p++3bhxsRTXP2jVqGrOdmX849/l7VGljk7wfnIZ/NsXhOLkxnwBvXKYjCQBWnbKiUGLSLvv8BCioZXsr5l4mLjmsvY+B671pvE2vCio/lRWDoz8V0LJohinpq1zvDXGqATXQ7Lz67DkMpcpEQId8ewhgguWUojaAJamPU/7joDZgAACMDy0fspbZK1sAHi0CeAJ/AmPXxmQmv5tob5NWSHU/3HHpbkofX+fi6KN4Aq0Hfw2jzacZxlgXl6nc5owrK8aKchUN82L0y5lydQ714GqL8GXmA/1SNoheH7ORr/fkgcpv5lQY/ygmJfZw0hCXTMQBM28nDXtKsF+0AE/usdD4ulajWFiWatHLd+sQLN4ztstfmcyoScCOpiXbJgKkhbsDhd4lam9RXFD+W7OJBhVNB5VWzPPO32L9hOTZNCs1M6dvLBS8LYAhOA9dPsurqPHL+MKXLdAwzi9H5Lp12vQrRJtWMft51mqv70nO/9WvhjBSucFH6vvWCx365S+CLiCdiSTjYaFvuEvg3B7i1BbfmRjBvP1SZQJB1RxS/9N6we2x8D1QTlw1A7bcDC5MePKUTQdqSM0uvUzpGqU9uiWQjhSQq4rW2gwgOw0Q+bLegrFdU7YbM9VLuoWA2DJgS8Kwn1Fl8xKFZ0zqKQtYPSRRmb/qDlyblcgmAyR4pS+wSDQCjlbeXUkWVphYnNWj8DFe7P67rhQSPmSBsnQ0BGR5uVtxKSj03Z1vjED6KnSLiSsFqxkF+TjKnQmUjYAQ==&p=Cache-Control: no-cacheMS-CV: 8dP2WoF9J0CbdSKy.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162312Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Microsoft.YourPhone_8wekyb3d8bbwe&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: yiwVe14/BE6Jiq0C.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162318Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162318Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162319Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Microsoft.BingNews_8wekyb3d8bbwe&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: 8jhhiRSEsEyd1+DA.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162320Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162321Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162321Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9N0866FS04W8&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162322Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162323Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ140&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162324Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162324Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=6F71D7A7.HotspotShieldFreeVPN_nsbqstbb9qxb6&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: nECOV7N17kSU6ruy.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH1CQ7L&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162327Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220526T162328Z&asid=7a0693a71cb14370af5a80e996cf6964&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162331Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162332Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162334Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162335Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162335Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162336Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162337Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Disney.37853FC22B2CE_6rarf9sa4v8jt&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: 6k3szQVIikyy/vro.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162337Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220526T162338Z&asid=0d0793f889cb4113843a4a0a8a427723&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /cms/api/am/imageFileData/RE4WUmK?ver=1611 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cms/api/am/imageFileData/RWOVPV?ver=22fc HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cms/api/am/imageFileData/RWT67S?ver=7961 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cms/api/am/imageFileData/RWTjfV?ver=6856 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cms/api/am/imageFileData/RWPh04?ver=a482 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=BytedancePte.Ltd.TikTok_6yccndn6064se&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: W20lKBlwBEyUE2MD.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=AdobeSystemsIncorporated.AdobePhotoshopExpress_ynb6jyjzte8ga&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: vloa+nJwyEqkWvdm.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=zK+Y7moONcKnk5Y&MD=PxrF8BRP HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=AmazonVideo.PrimeVideo_pwbj9vvecjh7j&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: C7XX/NRXnEmaXXD7.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic HTTP traffic detected: GET /cms/api/am/imageFileData/RE4X4E4?ver=3eca HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220526T162427Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ce010275569047beb2ba7c8cf556af54&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1532051&metered=false&nettype=ethernet&npid=sc-310091&oemName=pupkye%2C%20Inc.&oemid=pupkye%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=pupkye7%2C1&tl=2&tsu=1532051&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32089&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAaSgW0QV2xQ946N/g1NtQ3iQQU/RSrum6sbPcK9+Ibo92CRLwHdxHKriMeWSu2+cvMlGM41XBNTCda1l25WEqBy4Oo2u6LzorUOBirEyvO03AiqjGV3a0Tfn66mPWamklmsrbxQ3v/Ptf5BLjDAYgHnSwjVzVxHgwr5FZGvT8NSxH5p++3bhxsRTXP2jVqGrOdmX849/l7VGljk7wfnIZ/NsXhOLkxnwBvXKYjCQBWnbKiUGLSLvv8BCioZXsr5l4mLjmsvY+B671pvE2vCio/lRWDoz8V0LJohinpq1zvDXGqATXQ7Lz67DkMpcpEQId8ewhgguWUojaAJamPU/7joDZgAACMDy0fspbZK1sAHi0CeAJ/AmPXxmQmv5tob5NWSHU/3HHpbkofX+fi6KN4Aq0Hfw2jzacZxlgXl6nc5owrK8aKchUN82L0y5lydQ714GqL8GXmA/1SNoheH7ORr/fkgcpv5lQY/ygmJfZw0hCXTMQBM28nDXtKsF+0AE/usdD4ulajWFiWatHLd+sQLN4ztstfmcyoScCOpiXbJgKkhbsDhd4lam9RXFD+W7OJBhVNB5VWzPPO32L9hOTZNCs1M6dvLBS8LYAhOA9dPsurqPHL+MKXLdAwzi9H5Lp12vQrRJtWMft51mqv70nO/9WvhjBSucFH6vvWCx365S+CLiCdiSTjYaFvuEvg3B7i1BbfmRjBvP1SZQJB1RxS/9N6we2x8D1QTlw1A7bcDC5MePKUTQdqSM0uvUzpGqU9uiWQjhSQq4rW2gwgOw0Q+bLegrFdU7YbM9VLuoWA2DJgS8Kwn1Fl8xKFZ0zqKQtYPSRRmb/qDlyblcgmAyR4pS+wSDQCjlbeXUkWVphYnNWj8DFe7P67rhQSPmSBsnQ0BGR5uVtxKSj03Z1vjED6KnSLiSsFqxkF+TjKnQmUjYAQ==&p=Cache-Control: no-cacheMS-CV: R41dJUPiNkyazJ8S.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162358Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162359Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162401Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162402Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162404Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162405Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162406Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162406Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162409Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162410Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162411Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=2c89f1d999654b2297216ea867bdb66c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=0d0793f889cb4113843a4a0a8a427723&time=20220526T162411Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162412Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162413Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162414Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162414Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162415Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162415Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162416Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162416Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162417Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2c99e9488c394593964bb152f27c057b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=7a0693a71cb14370af5a80e996cf6964&time=20220526T162418Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1826355266&PG=PC000P0FR5.0000000IRT&REQASID=76874FB36A7A4F8A91F1FBCF04FF4B85&UNID=338388&ASID=e9a3619a2ecb427186947da62365e5f2&PERSID=1A4A490328ED3BBECC8505EAE64E45F5&GLOBALDEVICEID=6966530473343700&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=4be684b2482f4a6684b1c351bfc0dc5e&DEVOSVER=10.0.17134.1&REQT=20220526T162349&TIME=20220526T162427Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1826355266&PG=PC000P0FR5.0000000IRT&REQASID=76874FB36A7A4F8A91F1FBCF04FF4B85&UNID=338388&ASID=e9a3619a2ecb427186947da62365e5f2&PERSID=1A4A490328ED3BBECC8505EAE64E45F5&GLOBALDEVICEID=6966530473343700&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=4be684b2482f4a6684b1c351bfc0dc5e&DEVOSVER=10.0.17134.1&REQT=20220526T162349&TIME=20220526T162428Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.4:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.102.176.152:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.82.210.154:443 -> 192.168.2.4:49863 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.82.210.154:443 -> 192.168.2.4:49862 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.35.236.56:443 -> 192.168.2.4:49874 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49880 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.4:49881 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49883 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.4:49889 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49891 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.4:49898 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49906 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.4:49911 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49914 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49918 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.4:49925 version: TLS 1.2
Source: unknown HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.4:49926 version: TLS 1.2
Source: unknown HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.4:49923 version: TLS 1.2
Source: unknown HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.4:49927 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49928 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.4:49929 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49931 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49932 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.4:49933 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.24.244:443 -> 192.168.2.4:49934 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.4:49938 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DA9029 lstrlenW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard, 25_2_00DA9029
Detected potential crypto function
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DBC8DF 25_2_00DBC8DF
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DC51B0 25_2_00DC51B0
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DB7AF1 25_2_00DB7AF1
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DC328B 25_2_00DC328B
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DB02A1 25_2_00DB02A1
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DC4A67 25_2_00DC4A67
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DC423B 25_2_00DC423B
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DC44E5 25_2_00DC44E5
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DBF428 25_2_00DBF428
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DC3EC9 25_2_00DC3EC9
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DC56B9 25_2_00DC56B9
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DB7E39 25_2_00DB7E39
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DC47AC 25_2_00DC47AC
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DBEFA0 25_2_00DBEFA0
Found potential string decryption / allocating functions
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: String function: 00DAFE60 appears 43 times
Contains functionality to communicate with device drivers
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DA9D31: CreateFileW,DeviceIoControl,CloseHandle, 25_2_00DA9D31
PE file contains strange resources
Source: ChromeRecovery.exe.22.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ChromeRecovery.exe.22.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://www.extcovdoc125.org/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,9165260210357532166,5390511694361261753,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Process created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=85.0.4183.121 --sessionid={dd012639-423b-4d94-869b-89f3badab017} --system
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,9165260210357532166,5390511694361261753,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Process created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=85.0.4183.121 --sessionid={dd012639-423b-4d94-869b-89f3badab017} --system Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-628FA952-142C.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\55b6949c-382d-42a0-9862-3e9d4fa4ad79.tmp Jump to behavior
Source: classification engine Classification label: mal64.phis.win@34/119@15/15
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Mutant created: \BaseNamedObjects\Global\G{D19BAF17-7C87-467E-8D63-6C4B1C836373}
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DA1209 LoadResource,LockResource,SizeofResource, 25_2_00DA1209
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe File created: C:\Program Files\Google\Chrome\ChromeRecovery Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Directory created: C:\Program Files\Google\Chrome\ChromeRecovery Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Directory created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Directory created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecoveryCRX.crx Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Directory created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Directory created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\manifest.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Directory created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\_metadata\ Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe Directory created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\_metadata\verified_contents.json Jump to behavior
Source: Binary string: GoogleUpdateB231574670_unsigned.pdb` source: ChromeRecovery.exe, 00000019.00000002.428435187.0000000000DC7000.00000002.00000001.01000000.00000006.sdmp, ChromeRecovery.exe, 00000019.00000000.427447807.0000000000DC7000.00000002.00000001.01000000.00000006.sdmp, ChromeRecovery.exe.22.dr
Source: Binary string: GoogleUpdateB231574670_unsigned.pdb source: ChromeRecovery.exe, 00000019.00000002.428435187.0000000000DC7000.00000002.00000001.01000000.00000006.sdmp, ChromeRecovery.exe, 00000019.00000000.427447807.0000000000DC7000.00000002.00000001.01000000.00000006.sdmp, ChromeRecovery.exe.22.dr
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DC39A3 push ecx; ret 25_2_00DC39B6
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DAFEA6 push ecx; ret 25_2_00DAFEB9
Contains functionality to dynamically determine API calls
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DAE00C CloseHandle,InitializeCriticalSection,CreateSemaphoreW,CreateSemaphoreW,CreateSemaphoreW,CreateThread,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,InitializeCriticalSection,EnterCriticalSection,SetUnhandledExceptionFilter,LeaveCriticalSection, 25_2_00DAE00C
Drops PE files
Source: C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe File created: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Jump to dropped file
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DA3298 GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW, 25_2_00DA3298
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\5164_329640452\LICENSE.txt Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DB02A1 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 25_2_00DB02A1
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found evasive API chain (date check)
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Found evasive API chain checking for process token information
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DC525D VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect, 25_2_00DC525D
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DB98C3 FindFirstFileExW, 25_2_00DB98C3
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DAF243 IsDebuggerPresent,OutputDebugStringW, 25_2_00DAF243
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DC525D VirtualProtect ?,-00000001,00000104,?,?,?,0000001C 25_2_00DC525D
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DA41A3 CreateFileW,GetFileAttributesExW,OutputDebugStringW,CloseHandle,GetLastError,WriteFile, 25_2_00DA41A3
Contains functionality to dynamically determine API calls
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DAE00C CloseHandle,InitializeCriticalSection,CreateSemaphoreW,CreateSemaphoreW,CreateSemaphoreW,CreateThread,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,InitializeCriticalSection,EnterCriticalSection,SetUnhandledExceptionFilter,LeaveCriticalSection, 25_2_00DAE00C
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DA13D8 GetProcessHeap, 25_2_00DA13D8
Contains functionality to read the PEB
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DB3E6C mov ecx, dword ptr fs:[00000030h] 25_2_00DB3E6C
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DB9665 mov eax, dword ptr fs:[00000030h] 25_2_00DB9665
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DAE00C CloseHandle,InitializeCriticalSection,CreateSemaphoreW,CreateSemaphoreW,CreateSemaphoreW,CreateThread,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,InitializeCriticalSection,EnterCriticalSection,SetUnhandledExceptionFilter,LeaveCriticalSection, 25_2_00DAE00C
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DAE2C3 FreeLibrary,FreeLibrary,FreeLibrary,EnterCriticalSection,SetUnhandledExceptionFilter,LeaveCriticalSection,DeleteCriticalSection,ReleaseSemaphore,WaitForSingleObject,CloseHandle,FindCloseChangeNotification,DeleteCriticalSection,CloseHandle,CloseHandle,DeleteCriticalSection, 25_2_00DAE2C3
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DAFE00 SetUnhandledExceptionFilter, 25_2_00DAFE00
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DAF886 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 25_2_00DAF886
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DB323D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 25_2_00DB323D
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DAE4E6 EnterCriticalSection,SetUnhandledExceptionFilter, 25_2_00DAE4E6
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DAFC6A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 25_2_00DAFC6A
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DAE553 SetUnhandledExceptionFilter,LeaveCriticalSection, 25_2_00DAE553
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DA59D6 GetSecurityDescriptorDacl,SetSecurityDescriptorDacl, 25_2_00DA59D6
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DA8FB3 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 25_2_00DA8FB3
Contains functionality to query CPU information (cpuid)
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DAFAC3 cpuid 25_2_00DAFAC3
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DA3047 GetLocalTime,GetCurrentThreadId,GetCurrentProcessId, 25_2_00DA3047
Source: C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5484_1535481702\ChromeRecovery.exe Code function: 25_2_00DA8E0B GetVersionExW,GetProcAddress,FreeLibrary, 25_2_00DA8E0B
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 634729 URL: https://www.extcovdoc125.org/ Startdate: 26/05/2022 Architecture: WINDOWS Score: 64 20 static.wixstatic.com 2->20 22 static.parastorage.com 2->22 24 gcp.media-router.wixstatic.com 2->24 38 Snort IDS alert for network traffic 2->38 40 Yara detected HtmlPhish10 2->40 42 Phishing site detected (based on image similarity) 2->42 44 Phishing site detected (based on logo template match) 2->44 7 chrome.exe 15 286 2->7         started        10 elevation_service.exe 7 2->10         started        signatures3 process4 dnsIp5 26 192.168.2.4, 137, 138, 443 unknown unknown 7->26 28 192.168.2.1 unknown unknown 7->28 30 239.255.255.250 unknown Reserved 7->30 13 chrome.exe 38 7->13         started        18 C:\Program Files\...\ChromeRecovery.exe, PE32 10->18 dropped 16 ChromeRecovery.exe 10->16         started        file6 process7 dnsIp8 32 accounts.google.com 142.250.203.109, 443, 49757 GOOGLEUS United States 13->32 34 gstaticadssl.l.google.com 216.58.215.227, 443, 49763, 49838 GOOGLEUS United States 13->34 36 21 other IPs or domains 13->36
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
3.231.116.131
 bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com United States
14618 AMAZON-AESUS false
104.18.10.207
 stackpath.bootstrapcdn.com United States
13335 CLOUDFLARENETUS false
216.58.215.238
 clients.l.google.com United States
15169 GOOGLEUS false
34.96.106.200
 td-static-34-96-106-200.parastorage.com United States
15169 GOOGLEUS false
142.250.203.109
 accounts.google.com United States
15169 GOOGLEUS false
104.17.24.14
 cdnjs.cloudflare.com United States
13335 CLOUDFLARENETUS false
52.203.39.37
 torch-rare-nerine.glitch.me United States
14618 AMAZON-AESUS false
216.58.215.227
 gstaticadssl.l.google.com United States
15169 GOOGLEUS false
34.117.168.233
 td-ccm-168-233.wixdns.net United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
104.18.11.207
 maxcdn.bootstrapcdn.com United States
13335 CLOUDFLARENETUS false
239.255.255.250
 unknown Reserved
unknown unknown false
34.102.176.152
 gcp.media-router.wixstatic.com United States
15169 GOOGLEUS false

Private

IP
192.168.2.1
192.168.2.4
127.0.0.1

Contacted Domains

Name IP Active
gstaticadssl.l.google.com 216.58.215.227 true
stackpath.bootstrapcdn.com 104.18.10.207 true
td-ccm-168-233.wixdns.net 34.117.168.233 true
td-static-34-96-106-200.parastorage.com 34.96.106.200 true
torch-rare-nerine.glitch.me 52.203.39.37 true
accounts.google.com 142.250.203.109 true
cdnjs.cloudflare.com 104.17.24.14 true
gcp.media-router.wixstatic.com 34.102.176.152 true
maxcdn.bootstrapcdn.com 104.18.11.207 true
c-0001.c-msedge.net 13.107.4.50 true
clients.l.google.com 216.58.215.238 true
bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com 3.231.116.131 true
siteassets.parastorage.com unknown unknown
static.wixstatic.com unknown unknown
frog.editorx.com unknown unknown
www.extcovdoc125.org unknown unknown
clients2.google.com unknown unknown
code.jquery.com unknown unknown
frog.wix.com unknown unknown
static.parastorage.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.extcovdoc125.org/ false
    		unknown
    https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js false
      		high
      https://frog.wix.com/bt?src=29&evid=3&viewer_name=thunderbolt&caching=hit,hit&dc=84&et=12&event_name=Partially%20visible&is_cached=true&is_platform_loaded=0&is_rollout=0&ism=1&isp=0&isjp=true&iss=0&ita=1&msid=361b8621-7187-4e93-b748-a6b720cc5eed&pid=c1dmp&pn=1&sessionId=81c9320b-2bae-438b-a0b9-134b38f115b3&siterev=5-__siteCacheRevision__&st=2&ts=398&tts=2334&url=https%3A%2F%2Fwww.extcovdoc125.org%2F&v=1.10130.0&vsi=6dfd68d1-a23a-4534-98f9-4366ecc38fe1&_brandId=editorx false
        		high
        https://www.extcovdoc125.org/_api/tag-manager/api/v1/tags/sites/361b8621-7187-4e93-b748-a6b720cc5eed?wixSite=false&htmlsiteId=d2f95b4d-d274-49b1-b7ae-045e9f4850bf&language=en false
        • Avira URL Cloud: safe
        		 unknown
        https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard false
          		high
          https://frog.editorx.com/bpm?_msid=361b8621-7187-4e93-b748-a6b720cc5eed&vsi=6dfd68d1-a23a-4534-98f9-4366ecc38fe1&_av=thunderbolt-1.10130.0&isb=true&isbr=webdriver&ts=6004&tsn=7940&dc=84&caching=hit%2Chit&session_id=81c9320b-2bae-438b-a0b9-134b38f115b3&st=2&url=https%253A%252F%252Fwww.extcovdoc125.org%252F&ish=true&pn=1&pv=true&pageId=c1dmp&isServerSide=false&is_lightbox=false&is_cached=true&is_sav_rollout=0&is_dac_rollout=0&v=1.10130.0&_brandId=editorx&_siteBranchId=undefined&_ms=7941&_lv=2.0.985%7CC&_visitorId=undefined&_siteMemberId=undefined&src=72&evid=502&_=16535821715601&tti=3441&tbt=89&iframes=0&screens=1&entryType=loaded&lcp=3154&lcpSize=529506&closestId=img-comp-l3imgj4o&lcpTag=PICTURE&lcpResourceType=png&lcpInLightbox=false&countScripts=22&startTimeScripts=1941&durationScripts=1935&mttfbScripts=29&attfbScripts=41&tbdScripts=1016138&countImages=2&startTimeImages=2452&durationImages=490&mttfbImages=256&attfbImages=256&tbdImages=135200&countFonts=2&startTimeFonts=2059&durationFonts=2476&mttfbFonts=9&attfbFonts=9&tbdFonts=18344&duration=3947&ttlb=1925&dcl=2374&transferSize=263842&decodedBodySize=262198&pageCaching=maybe%20CDN&isSsr=true&isWelcome=false&visitorId=97ac8d2d-0072-4f2c-8777-f8339eb78d25&btype=webdriver&bsi=4b670852-7e7a-4bc3-8324-43727fa80a06%7C1&ssrDuration=41&ssrTimestamp=1653541541625&microPop=euw3&isRollout=false&isPlatformLoaded=false&maybeBot=true&cls=0&countCls=0&clsOld=0&clientType=ugc&analytics=true false
          • Avira URL Cloud: safe
          		 unknown
          https://torch-rare-nerine.glitch.me/favicon.ico false
            		high
            https://static.wixstatic.com/media/02b81a_70fc0acae7884e1fa34a11a1711c102e~mv2.png/v1/fill/w_931,h_570,al_c,q_90,usm_0.66_1.00_0.01,enc_auto/Screenshot%202022.png false
              		high
              https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js false
                		high
                https://frog.wix.com/bt?src=29&evid=3&viewer_name=thunderbolt&caching=hit,hit&dc=84&et=1&event_name=Init&is_cached=true&is_platform_loaded=0&is_rollout=0&ism=1&isp=0&isjp=true&iss=0&ita=1&msid=361b8621-7187-4e93-b748-a6b720cc5eed&pn=1&sessionId=81c9320b-2bae-438b-a0b9-134b38f115b3&siterev=5-__siteCacheRevision__&st=2&ts=18&tts=1954&url=https%3A%2F%2Fwww.extcovdoc125.org%2F&v=1.10130.0&vsi=6dfd68d1-a23a-4534-98f9-4366ecc38fe1&_brandId=editorx false
                  		high
                  https://frog.wix.com/bt?src=29&evid=3&viewer_name=thunderbolt&caching=hit,hit&dc=84&et=33&event_name=page%20interactive&is_cached=true&is_platform_loaded=0&is_rollout=0&ism=1&isp=0&isjp=true&iss=0&ita=1&msid=361b8621-7187-4e93-b748-a6b720cc5eed&pid=c1dmp&pn=1&sar=1280x984&sessionId=81c9320b-2bae-438b-a0b9-134b38f115b3&siterev=5-__siteCacheRevision__&sr=1280x1024&st=2&ts=1994&tts=3930&url=https%3A%2F%2Fwww.extcovdoc125.org%2F&v=1.10130.0&vid=97ac8d2d-0072-4f2c-8777-f8339eb78d25&bsi=4b670852-7e7a-4bc3-8324-43727fa80a06|1&vsi=6dfd68d1-a23a-4534-98f9-4366ecc38fe1&wor=1280x984&wr=1280x869&_brandId=editorx false
                    		high
                    https://torch-rare-nerine.glitch.me/extdoc125index.html false
                      		high
                      https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css false
                        		high
                        https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 false
                          		high
                          https://www.extcovdoc125.org/_api/v2/dynamicmodel false
                          • Avira URL Cloud: safe
                          		 unknown
                          https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js false
                            		high
                            https://frog.wix.com/bolt-performance?src=72&evid=21&appName=thunderbolt-responsive&is_rollout=0&is_sav_rollout=0&is_dac_rollout=0&dc=84&is_cached=true&msid=361b8621-7187-4e93-b748-a6b720cc5eed&session_id=81c9320b-2bae-438b-a0b9-134b38f115b3&ish=true&isb=true&isbr=webdriver&vsi=6dfd68d1-a23a-4534-98f9-4366ecc38fe1&caching=hit,hit&pv=visible&pn=1&v=1.10130.0&url=https%3A%2F%2Fwww.extcovdoc125.org%2F&st=2&ts=13&tsn=1949 false
                              		high
                              https://www.extcovdoc125.org/ true
                                		unknown
                                https://frog.wix.com/bolt-performance?src=72&evid=28&appName=thunderbolt-responsive&is_rollout=0&is_sav_rollout=0&is_dac_rollout=0&dc=84&is_cached=true&msid=361b8621-7187-4e93-b748-a6b720cc5eed&session_id=81c9320b-2bae-438b-a0b9-134b38f115b3&ish=true&isb=true&isbr=webdriver&vsi=6dfd68d1-a23a-4534-98f9-4366ecc38fe1&caching=hit,hit&pv=visible&pn=1&v=1.10130.0&url=https%3A%2F%2Fwww.extcovdoc125.org%2F&st=2&ts=13&tsn=1949&name=partially_visible&duration=1653582165943&pageId=c1dmp false
                                  		high
                                  https://frog.editorx.com/bpm false
                                  • Avira URL Cloud: safe
                                  		 unknown
                                  https://static.wixstatic.com/media/02b81a_70fc0acae7884e1fa34a11a1711c102e~mv2.png/v1/fill/w_245,h_126,al_c,q_85,usm_0.66_1.00_0.01,blur_2,enc_auto/Screenshot%202022.png false
                                    		high
                                    https://frog.editorx.com/pa?_msid=361b8621-7187-4e93-b748-a6b720cc5eed&vsi=6dfd68d1-a23a-4534-98f9-4366ecc38fe1&_av=thunderbolt-1.10130.0&isb=true&isbr=webdriver&_brandId=editorx&_siteBranchId=undefined&_ms=3898&_lv=2.0.985%7CC&_visitorId=97ac8d2d-0072-4f2c-8777-f8339eb78d25&_siteMemberId=undefined&bsi=4b670852-7e7a-4bc3-8324-43727fa80a06%7C1&src=76&evid=1109&pid=c1dmp&pn=1&viewer=TB&pt=static&pa=editor&pti=c1dmp&uuid=02b81a5a-1805-4b9f-83a2-e2f77f7ddb0b&url=https%3A%2F%2Fwww.extcovdoc125.org%2F&ref=&bot=true&bl=en-GB&pl=en-GB%2Cen-US%2Cen&_=16535821675170 false
                                    • Avira URL Cloud: safe
                                    		 unknown
                                    https://torch-rare-nerine.glitch.me/extdoc125index.html false
                                      		high