hxxp://pufferhost[.]pl

Analysis

max time kernel
128s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 09:35 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://pufferhost.pl

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "customshellhost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2096	dismhost.exe

Loads dropped DLL 5 IoCs

pid	Process
2096	dismhost.exe
2096	dismhost.exe
2096	dismhost.exe
2096	dismhost.exe
2096	dismhost.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001\User\Registry.pol	svchost.exe
File opened for modification	C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001\GPT.INI	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM2F028.tmp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CM2E52.tmp	svchost.exe
File opened for modification	C:\Windows\System32\GroupPolicyUsers	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM2EF8B.tmp	svchost.exe
File opened for modification	C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001\User\Registry.pol	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CM2F028.tmp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CM2F097.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM2DE4.tmp	svchost.exe
File opened for modification	C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001	svchost.exe
File opened for modification	C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001\gpt.ini	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CM2EF8B.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM2F097.tmp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CM2DE4.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM2E52.tmp	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{8DDEAE55-7684-47D0-941E-3103CF937480}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{44CB0206-9DF5-49CC-8AE3-719F349209E6}User\Software\Policies\Microsoft\Windows\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{44A6F7D4-E6C7-4B2C-9E8E-8F0A30EEA181}User\Software\Policies\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{44A6F7D4-E6C7-4B2C-9E8E-8F0A30EEA181}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{123BB688-F132-4AE9-92AD-47F9BC611FB1}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{8DDEAE55-7684-47D0-941E-3103CF937480}User\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{8DDEAE55-7684-47D0-941E-3103CF937480}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{942E661F-34DE-4413-A5A3-04D6A72A7627}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B2A0CA86-A7C3-4C10-AA36-11B86853F2FC}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4B1117DF-1C19-4BA9-96AC-FC9F75F98641}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{123BB688-F132-4AE9-92AD-47F9BC611FB1}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1806 = "3"	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{495E9F78-4017-4AFC-81F3-4BF17946CACE}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B9AB46FB-E95D-484B-8CA9-E544972FB33A}User\Software\Microsoft\Windows\CurrentVersion\Policies\Associations	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4B1117DF-1C19-4BA9-96AC-FC9F75F98641}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{123BB688-F132-4AE9-92AD-47F9BC611FB1}User\Software\Policies	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{8DDEAE55-7684-47D0-941E-3103CF937480}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B9AB46FB-E95D-484B-8CA9-E544972FB33A}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B9AB46FB-E95D-484B-8CA9-E544972FB33A}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{123BB688-F132-4AE9-92AD-47F9BC611FB1}User\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4F377F49-32EB-42AC-B8B1-C8FE43E60A42}User\Software\Policies\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C5889B70-D29B-4E85-90A4-933C0ADF09CE}User\Software\Policies	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B2A0CA86-A7C3-4C10-AA36-11B86853F2FC}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1806 = "3"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B9AB46FB-E95D-484B-8CA9-E544972FB33A}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B9AB46FB-E95D-484B-8CA9-E544972FB33A}User\Software\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{6579CF81-BA4B-446C-8AF0-5FBAACF4C7C2}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{44CB0206-9DF5-49CC-8AE3-719F349209E6}User\Software\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{1E4A482C-40B6-4C69-BBF4-FA626A7CDB67}User\Software\Microsoft\Windows	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C5889B70-D29B-4E85-90A4-933C0ADF09CE}User\Software\Microsoft\Windows\CurrentVersion\Policies	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B2A0CA86-A7C3-4C10-AA36-11B86853F2FC}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{8DDEAE55-7684-47D0-941E-3103CF937480}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1806 = "3"	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{8DDEAE55-7684-47D0-941E-3103CF937480}User\Software\Policies	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{38D594D3-92C7-4178-98B9-609CA0C5AA27}User\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B2A0CA86-A7C3-4C10-AA36-11B86853F2FC}User\Software\Policies\Microsoft\Windows\CurrentVersion	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C5889B70-D29B-4E85-90A4-933C0ADF09CE}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B9AB46FB-E95D-484B-8CA9-E544972FB33A}User\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4F377F49-32EB-42AC-B8B1-C8FE43E60A42}User\Software\Microsoft\Windows\CurrentVersion\Policies\Associations	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B9AB46FB-E95D-484B-8CA9-E544972FB33A}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{6579CF81-BA4B-446C-8AF0-5FBAACF4C7C2}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{495E9F78-4017-4AFC-81F3-4BF17946CACE}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{8DDEAE55-7684-47D0-941E-3103CF937480}User\Software\Policies	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{718C0AB6-43A5-4963-BC53-35E8EA48814F}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B2A0CA86-A7C3-4C10-AA36-11B86853F2FC}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{6579CF81-BA4B-446C-8AF0-5FBAACF4C7C2}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{44CB0206-9DF5-49CC-8AE3-719F349209E6}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C5889B70-D29B-4E85-90A4-933C0ADF09CE}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{718C0AB6-43A5-4963-BC53-35E8EA48814F}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4F377F49-32EB-42AC-B8B1-C8FE43E60A42}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1806 = "3"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{718C0AB6-43A5-4963-BC53-35E8EA48814F}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B9AB46FB-E95D-484B-8CA9-E544972FB33A}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4F377F49-32EB-42AC-B8B1-C8FE43E60A42}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1806 = "3"	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B2A0CA86-A7C3-4C10-AA36-11B86853F2FC}User\Software\Microsoft	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4B1117DF-1C19-4BA9-96AC-FC9F75F98641}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{718C0AB6-43A5-4963-BC53-35E8EA48814F}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B9AB46FB-E95D-484B-8CA9-E544972FB33A}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{942E661F-34DE-4413-A5A3-04D6A72A7627}User\Software\Policies	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{44A6F7D4-E6C7-4B2C-9E8E-8F0A30EEA181}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{44A6F7D4-E6C7-4B2C-9E8E-8F0A30EEA181}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{123BB688-F132-4AE9-92AD-47F9BC611FB1}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{495E9F78-4017-4AFC-81F3-4BF17946CACE}User\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{1E4A482C-40B6-4C69-BBF4-FA626A7CDB67}User\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{6579CF81-BA4B-446C-8AF0-5FBAACF4C7C2}User\Software\Policies\Microsoft	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{6579CF81-BA4B-446C-8AF0-5FBAACF4C7C2}User\Software\Policies\Microsoft\Windows\CurrentVersion	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{1E4A482C-40B6-4C69-BBF4-FA626A7CDB67}User\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{44A6F7D4-E6C7-4B2C-9E8E-8F0A30EEA181}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
5784	msedge.exe
5784	msedge.exe
5520	msedge.exe
5520	msedge.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
1624	Process not Found
1460	Process not Found
2380	Process not Found
2400	Process not Found
2868	Process not Found
1932	Process not Found
2364	Process not Found
4492	Process not Found
4356	Process not Found
5544	Process not Found
5516	Process not Found
4476	Process not Found
4588	Process not Found
1800	Process not Found
3528	Process not Found
2188	Process not Found
4440	Process not Found
2196	Process not Found
3076	Process not Found
3088	Process not Found
3684	Process not Found
2292	Process not Found
3048	Process not Found
4732	Process not Found
2268	Process not Found
1140	Process not Found
3644	Process not Found
244	Process not Found
5152	Process not Found
6140	Process not Found
220	Process not Found
5176	Process not Found
5240	Process not Found
5320	Process not Found
5436	Process not Found
460	Process not Found
5392	Process not Found
5312	Process not Found
5328	Process not Found
5388	Process not Found
5452	Process not Found
5448	Process not Found
5080	Process not Found
1852	Process not Found
5212	Process not Found
864	Process not Found
5716	Process not Found
3832	Process not Found
5740	Process not Found
5308	Process not Found
6036	Process not Found
5316	Process not Found
5200	Process not Found
3948	Process not Found
5352	Process not Found
5356	Process not Found
5908	Process not Found
5976	Process not Found
3112	Process not Found
5904	Process not Found
5964	Process not Found
5636	Process not Found
1488	Process not Found
5604	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	firefox.exe
Token: SeDebugPrivilege	4220	firefox.exe
Token: SeBackupPrivilege	632	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	632	SystemSettingsAdminFlows.exe
Token: SeLoadDriverPrivilege	800	svchost.exe
Token: SeLoadDriverPrivilege	800	svchost.exe
Token: SeTcbPrivilege	5896	svchost.exe
Token: SeLoadDriverPrivilege	800	svchost.exe
Token: SeLoadDriverPrivilege	800	svchost.exe
Token: SeLoadDriverPrivilege	800	svchost.exe
Token: SeLoadDriverPrivilege	800	svchost.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
4220	firefox.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4220	firefox.exe
5472	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4220	4644	firefox.exe	84
PID 4644 wrote to memory of 4220	4644	firefox.exe	84
PID 4644 wrote to memory of 4220	4644	firefox.exe	84
PID 4644 wrote to memory of 4220	4644	firefox.exe	84
PID 4644 wrote to memory of 4220	4644	firefox.exe	84
PID 4644 wrote to memory of 4220	4644	firefox.exe	84
PID 4644 wrote to memory of 4220	4644	firefox.exe	84
PID 4644 wrote to memory of 4220	4644	firefox.exe	84
PID 4644 wrote to memory of 4220	4644	firefox.exe	84
PID 4644 wrote to memory of 4220	4644	firefox.exe	84
PID 4644 wrote to memory of 4220	4644	firefox.exe	84
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3496	4220	firefox.exe	85
PID 4220 wrote to memory of 3424	4220	firefox.exe	86
PID 4220 wrote to memory of 3424	4220	firefox.exe	86
PID 4220 wrote to memory of 3424	4220	firefox.exe	86
PID 4220 wrote to memory of 3424	4220	firefox.exe	86
PID 4220 wrote to memory of 3424	4220	firefox.exe	86
PID 4220 wrote to memory of 3424	4220	firefox.exe	86
PID 4220 wrote to memory of 3424	4220	firefox.exe	86
PID 4220 wrote to memory of 3424	4220	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://pufferhost.pl"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://pufferhost.pl
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc8588c2-c516-4b1e-889c-0b3fa7350e4e} 4220 "\\.\pipe\gecko-crash-server-pipe.4220" gpu
    3⤵
    PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2484 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bde18ed-ea83-4451-bacf-2cb9108d9cb8} 4220 "\\.\pipe\gecko-crash-server-pipe.4220" socket
    3⤵
    - Checks processor information in registry
    PID:3424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2668 -childID 1 -isForBrowser -prefsHandle 3140 -prefMapHandle 2868 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 964 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2be84e9-ceb0-44a1-ad06-b96455d0db24} 4220 "\\.\pipe\gecko-crash-server-pipe.4220" tab
    3⤵
    PID:2784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3848 -childID 2 -isForBrowser -prefsHandle 3840 -prefMapHandle 3836 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 964 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92693bc0-dff1-4e54-b746-b2dd0346e7a1} 4220 "\\.\pipe\gecko-crash-server-pipe.4220" tab
    3⤵
    PID:3604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4996 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4844 -prefMapHandle 4840 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb22372d-75a4-4a51-828f-ec0e9a5d3ffe} 4220 "\\.\pipe\gecko-crash-server-pipe.4220" utility
    3⤵
    - Checks processor information in registry
    PID:2736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5136 -childID 3 -isForBrowser -prefsHandle 4844 -prefMapHandle 5076 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 964 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3ace512-5fff-4d51-8c49-1e731feee769} 4220 "\\.\pipe\gecko-crash-server-pipe.4220" tab
    3⤵
    PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault89b449efhb5b1h46a1h978ah23e45b41c386
1⤵
PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcd16c46f8,0x7ffcd16c4708,0x7ffcd16c4718
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13688328701861496925,5461448577414220517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13688328701861496925,5461448577414220517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13688328701861496925,5461448577414220517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:608

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" AssignedAccessAdminHelper
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:632
- C:\Users\Admin\AppData\Local\Temp\587BEAE8-46FC-49D0-A138-96495333A914\dismhost.exe
  C:\Users\Admin\AppData\Local\Temp\587BEAE8-46FC-49D0-A138-96495333A914\dismhost.exe {983CC3AF-F0AD-4A27-8363-D5559ED8EE89}
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?LinkId=780679
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcd16c46f8,0x7ffcd16c4708,0x7ffcd16c4718
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9854208302826749854,1623779788028200409,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,9854208302826749854,1623779788028200409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,9854208302826749854,1623779788028200409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9854208302826749854,1623779788028200409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9854208302826749854,1623779788028200409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9854208302826749854,1623779788028200409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:2092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k AssignedAccessManagerSvc -s AssignedAccessManagerSvc
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s dmwappushservice
1⤵
PID:6088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DialogBlockingService -s DialogBlockingService
1⤵
PID:5364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s MsKeyboardFilter
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5896

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa38d7055 /state1:0x41c64e6d
1⤵
- Suspicious use of SetWindowsHookEx
PID:5472

Network

DNS

pufferhost.pl

firefox.exe

Remote address:

8.8.8.8:53

Request

pufferhost.pl

IN A

Response

pufferhost.pl

IN A

172.67.195.64

pufferhost.pl

IN A

104.21.12.186
DNS

spocs.getpocket.com

firefox.exe

Remote address:

8.8.8.8:53

Request

spocs.getpocket.com

IN A

Response

spocs.getpocket.com

IN CNAME

prod.ads.prod.webservices.mozgcp.net

prod.ads.prod.webservices.mozgcp.net

IN A

34.117.188.166
DNS

spocs.getpocket.com

firefox.exe

Remote address:

8.8.8.8:53

Request

spocs.getpocket.com

IN A
DNS

firefox-api-proxy.cdn.mozilla.net

firefox.exe

Remote address:

8.8.8.8:53

Request

firefox-api-proxy.cdn.mozilla.net

IN A

Response

firefox-api-proxy.cdn.mozilla.net

IN CNAME

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

IN A

34.149.97.1
DNS

firefox-api-proxy.cdn.mozilla.net

firefox.exe

Remote address:

8.8.8.8:53

Request

firefox-api-proxy.cdn.mozilla.net

IN A
GET

http://pufferhost.pl/

firefox.exe

Remote address:

172.67.195.64:80

Request

GET / HTTP/1.1
Host: pufferhost.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

Response

HTTP/1.1 301 Moved Permanently

Date: Sun, 18 Aug 2024 09:35:20 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sun, 18 Aug 2024 10:35:20 GMT
Location: https://pufferhost.pl/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hHftw3AZI4KLjEHEPEFTUWMG4cvkWl16uS0KIWEiYvL%2Bl4gD7xOMmFI0AhM7ujl78SlAnOzhY4dDUJK65MSlTezRMNjMeYquFsUXLtKNa%2FNlhaNWcutCt9YpKKnFT9YR"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8b50e9cae8957702-LHR
alt-svc: h2=":443"; ma=60
DNS

28.118.140.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

28.118.140.52.in-addr.arpa

IN PTR

Response
DNS

28.118.140.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

28.118.140.52.in-addr.arpa

IN PTR
DNS

73.144.22.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.144.22.2.in-addr.arpa

IN PTR

Response

73.144.22.2.in-addr.arpa

IN PTR

a2-22-144-73deploystaticakamaitechnologiescom
DNS

prod.content-signature-chains.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.content-signature-chains.prod.webservices.mozgcp.net

IN A

Response

prod.content-signature-chains.prod.webservices.mozgcp.net

IN A

34.160.144.191
DNS

pufferhost.pl

firefox.exe

Remote address:

8.8.8.8:53

Request

pufferhost.pl

IN A

Response

pufferhost.pl

IN A

104.21.12.186

pufferhost.pl

IN A

172.67.195.64
DNS

shavar.prod.mozaws.net

firefox.exe

Remote address:

8.8.8.8:53

Request

shavar.prod.mozaws.net

IN A

Response

shavar.prod.mozaws.net

IN A

44.240.54.139

shavar.prod.mozaws.net

IN A

35.82.42.34

shavar.prod.mozaws.net

IN A

44.226.249.47
DNS

shavar.prod.mozaws.net

firefox.exe

Remote address:

8.8.8.8:53

Request

shavar.prod.mozaws.net

IN A
DNS

prod.content-signature-chains.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.content-signature-chains.prod.webservices.mozgcp.net

IN AAAA

Response

prod.content-signature-chains.prod.webservices.mozgcp.net

IN AAAA

2600:1901:0:92a9::
DNS

prod.content-signature-chains.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.content-signature-chains.prod.webservices.mozgcp.net

IN AAAA
DNS

pufferhost.pl

firefox.exe

Remote address:

8.8.8.8:53

Request

pufferhost.pl

IN AAAA

Response

pufferhost.pl

IN AAAA

2606:4700:3035::ac43:c340

pufferhost.pl

IN AAAA

2606:4700:3033::6815:cba
DNS

pufferhost.pl

firefox.exe

Remote address:

8.8.8.8:53

Request

pufferhost.pl

IN AAAA
GET

https://pufferhost.pl/

firefox.exe

Remote address:

172.67.195.64:443

Request

GET / HTTP/2.0
host: pufferhost.pl
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
upgrade-insecure-requests: 1
sec-fetch-dest: document
sec-fetch-mode: navigate
sec-fetch-site: none
sec-fetch-user: ?1
te: trailers

Response

HTTP/2.0 403

date: Sun, 18 Aug 2024 09:35:20 GMT
content-type: text/html; charset=UTF-8
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-content-options: nosniff
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: nsGyHk2m3b3qNnq94rRQGSvWTcacCP9/krzCzxlFmsCRTNFkFnoDiJHA0Engy28LWH0om23KFCx7n4crRciwQjCic+NEEIfSXZjpzyMKX5HRcdf+n5RkhqSZGTyBndo6vfHjXES3qm6MqfjM6WIjVw==$LPSNRNK6xeg4cR9QKYJGmw==
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gtMKJyVJDdvI47bnL9pfBK%2B3fmTmvqAOhIigxyuiLiIZfzfSopO7swXGZil34PNiNALlAx1SiUfvK%2BD%2BMP6to4mHW85dohLp1bZP5RijBG5X8BSsXUoUSfUKgciLft68"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8b50e9cc1d387201-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
DNS

prod.remote-settings.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.remote-settings.prod.webservices.mozgcp.net

IN A

Response

prod.remote-settings.prod.webservices.mozgcp.net

IN A

34.149.100.209
DNS

prod.remote-settings.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.remote-settings.prod.webservices.mozgcp.net

IN AAAA

Response
DNS

prod.remote-settings.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.remote-settings.prod.webservices.mozgcp.net

IN AAAA
DNS

64.195.67.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

64.195.67.172.in-addr.arpa

IN PTR

Response
DNS

139.54.240.44.in-addr.arpa

Remote address:

8.8.8.8:53

Request

139.54.240.44.in-addr.arpa

IN PTR

Response

139.54.240.44.in-addr.arpa

IN PTR

ec2-44-240-54-139 us-west-2compute amazonawscom
DNS

challenges.cloudflare.com

firefox.exe

Remote address:

8.8.8.8:53

Request

challenges.cloudflare.com

IN A

Response

challenges.cloudflare.com

IN A

104.18.94.41

challenges.cloudflare.com

IN A

104.18.95.41
DNS

prod.ads.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.ads.prod.webservices.mozgcp.net

IN A

Response

prod.ads.prod.webservices.mozgcp.net

IN A

34.117.188.166
DNS

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

IN A

Response

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

IN A

34.149.97.1
GET

https://challenges.cloudflare.com/turnstile/v0/g/ba7376691753/api.js?onload=IbcA8&render=explicit

firefox.exe

Remote address:

104.18.94.41:443

Request

GET /turnstile/v0/g/ba7376691753/api.js?onload=IbcA8&render=explicit HTTP/2.0
host: challenges.cloudflare.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
origin: https://pufferhost.pl
sec-fetch-dest: script
sec-fetch-mode: cors
sec-fetch-site: cross-site
te: trailers

Response

HTTP/2.0 200

date: Sun, 18 Aug 2024 09:35:21 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 13 Aug 2024 23:33:59 GMT
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 8b50e9d20db83854-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
DNS

challenges.cloudflare.com

firefox.exe

Remote address:

8.8.8.8:53

Request

challenges.cloudflare.com

IN A

Response

challenges.cloudflare.com

IN A

104.18.94.41

challenges.cloudflare.com

IN A

104.18.95.41
DNS

prod.ads.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.ads.prod.webservices.mozgcp.net

IN AAAA

Response
DNS

shavar.prod.mozaws.net

firefox.exe

Remote address:

8.8.8.8:53

Request

shavar.prod.mozaws.net

IN AAAA

Response
DNS

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

IN AAAA

Response

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

IN AAAA

2600:1901:0:74e4::
DNS

challenges.cloudflare.com

firefox.exe

Remote address:

8.8.8.8:53

Request

challenges.cloudflare.com

IN AAAA

Response

challenges.cloudflare.com

IN AAAA

2606:4700::6812:5f29

challenges.cloudflare.com

IN AAAA

2606:4700::6812:5e29
DNS

41.94.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

41.94.18.104.in-addr.arpa

IN PTR

Response
DNS

133.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.32.126.40.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

88.156.103.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.156.103.20.in-addr.arpa

IN PTR

Response
DNS

cxcs.microsoft.net

Remote address:

8.8.8.8:53

Request

cxcs.microsoft.net

IN A

Response

cxcs.microsoft.net

IN CNAME

cxcs.microsoft.net.edgekey.net

cxcs.microsoft.net.edgekey.net

IN CNAME

e3230.b.akamaiedge.net

e3230.b.akamaiedge.net

IN A

23.62.195.195
GET

https://cxcs.microsoft.net/api/settings/en-US/xml/settings-tipset?release=20h1&sku=Professional&platform=desktop

Remote address:

23.62.195.195:443

Request

GET /api/settings/en-US/xml/settings-tipset?release=20h1&sku=Professional&platform=desktop HTTP/2.0
host: cxcs.microsoft.net
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

content-type: text/html
content-length: 26
date: Sun, 18 Aug 2024 09:35:34 GMT
GET

https://cxcs.microsoft.net/api/settings/en-US/xml/settings-tipset?release=20h1&sku=Professional&platform=desktop

Remote address:

23.62.195.195:443

Request

GET /api/settings/en-US/xml/settings-tipset?release=20h1&sku=Professional&platform=desktop HTTP/2.0
host: cxcs.microsoft.net
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

content-type: text/html
content-length: 26
date: Sun, 18 Aug 2024 09:35:35 GMT
GET

https://cxcs.microsoft.net/api/settings/en-US/xml/settings-tipset?release=20h1&sku=Professional&platform=desktop

Remote address:

23.62.195.195:443

Request

GET /api/settings/en-US/xml/settings-tipset?release=20h1&sku=Professional&platform=desktop HTTP/2.0
host: cxcs.microsoft.net
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

content-type: text/html
content-length: 26
date: Sun, 18 Aug 2024 09:35:39 GMT
POST

https://www.bing.com/RelatedSearch?addfeaturesnoexpansion=relatedsearch&mkt=en-US

Remote address:

92.123.142.153:443

Request

POST /RelatedSearch?addfeaturesnoexpansion=relatedsearch&mkt=en-US HTTP/2.0
host: www.bing.com
accept-encoding: gzip, deflate
content-length: 1190
content-type: application/json; charset=UTF-8
cache-control: no-cache

Response

HTTP/2.0 200

content-length: 272
content-type: application/json; charset=utf-8
cache-control: private
content-encoding: gzip
vary: Accept-Encoding
x-eventid: 66c1c066370c4843a893a331d295fbc2
x-as-setsessionmarket: en-US
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
p3p: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND"
date: Sun, 18 Aug 2024 09:35:34 GMT
set-cookie: MUID=222F730ADAE76B1A0D7967D5DB406A2F; domain=.bing.com; expires=Fri, 12-Sep-2025 09:35:34 GMT; path=/; secure; SameSite=None
set-cookie: MUIDB=222F730ADAE76B1A0D7967D5DB406A2F; expires=Fri, 12-Sep-2025 09:35:34 GMT; path=/
set-cookie: _EDGE_S=F=1&SID=36ACCD77AA5E65FB3F6DD9A8ABF9640F&mkt=en-US; domain=.bing.com; path=/
set-cookie: _EDGE_V=1; domain=.bing.com; expires=Fri, 12-Sep-2025 09:35:34 GMT; path=/
set-cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Tue, 18-Aug-2026 09:35:34 GMT; path=/
set-cookie: SRCHUID=V=2&GUID=949A369E8B654EB89ED497BE8D863250&dmnchg=1; domain=.bing.com; expires=Tue, 18-Aug-2026 09:35:34 GMT; path=/
set-cookie: SRCHUSR=DOB=20240818; domain=.bing.com; expires=Tue, 18-Aug-2026 09:35:34 GMT; path=/
set-cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Tue, 18-Aug-2026 09:35:34 GMT; path=/
set-cookie: _SS=SID=36ACCD77AA5E65FB3F6DD9A8ABF9640F; domain=.bing.com; path=/
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.a58e7b5c.1723973734.daff938
POST

https://www.bing.com/RelatedSearch?addfeaturesnoexpansion=relatedsearch&mkt=en-US

Remote address:

92.123.142.153:443

Request

POST /RelatedSearch?addfeaturesnoexpansion=relatedsearch&mkt=en-US HTTP/2.0
host: www.bing.com
accept-encoding: gzip, deflate
content-length: 1176
content-type: application/json; charset=UTF-8
cache-control: no-cache
cookie: MUID=222F730ADAE76B1A0D7967D5DB406A2F; _EDGE_S=F=1&SID=36ACCD77AA5E65FB3F6DD9A8ABF9640F&mkt=en-US; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=949A369E8B654EB89ED497BE8D863250&dmnchg=1; SRCHUSR=DOB=20240818; SRCHHPGUSR=SRCHLANG=en; _SS=SID=36ACCD77AA5E65FB3F6DD9A8ABF9640F; MUIDB=222F730ADAE76B1A0D7967D5DB406A2F

Response

HTTP/2.0 200

content-length: 350
content-type: application/json; charset=utf-8
cache-control: private
content-encoding: gzip
vary: Accept-Encoding
x-eventid: 66c1c067beca4cdca2b2311e99bfd36f
x-as-setsessionmarket: en-US
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
p3p: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND"
date: Sun, 18 Aug 2024 09:35:35 GMT
set-cookie: _EDGE_S=F=1&SID=36ACCD77AA5E65FB3F6DD9A8ABF9640F&mkt=en-US; domain=.bing.com; path=/
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.a58e7b5c.1723973735.daffdbc
DNS

154.239.44.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

154.239.44.20.in-addr.arpa

IN PTR

Response
DNS

55.36.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

55.36.223.20.in-addr.arpa

IN PTR

Response
DNS

195.195.62.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

195.195.62.23.in-addr.arpa

IN PTR

Response

195.195.62.23.in-addr.arpa

IN PTR

a23-62-195-195deploystaticakamaitechnologiescom
DNS

153.142.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

153.142.123.92.in-addr.arpa

IN PTR

Response

153.142.123.92.in-addr.arpa

IN PTR

a92-123-142-153deploystaticakamaitechnologiescom
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR

Response
DNS

18.31.95.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.31.95.13.in-addr.arpa

IN PTR

Response
DNS

192.142.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

192.142.123.92.in-addr.arpa

IN PTR

Response

192.142.123.92.in-addr.arpa

IN PTR

a92-123-142-192deploystaticakamaitechnologiescom
DNS

167.57.26.184.in-addr.arpa

Remote address:

8.8.8.8:53

Request

167.57.26.184.in-addr.arpa

IN PTR

Response

167.57.26.184.in-addr.arpa

IN PTR

a184-26-57-167deploystaticakamaitechnologiescom
DNS

learn.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

learn.microsoft.com

IN A

Response

learn.microsoft.com

IN CNAME

learn-public.trafficmanager.net

learn-public.trafficmanager.net

IN CNAME

learn.microsoft.com.edgekey.net

learn.microsoft.com.edgekey.net

IN CNAME

learn.microsoft.com.edgekey.net.globalredir.akadns.net

learn.microsoft.com.edgekey.net.globalredir.akadns.net

IN CNAME

e13636.dscb.akamaiedge.net

e13636.dscb.akamaiedge.net

IN A

184.25.193.230
DNS

learn.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

learn.microsoft.com

IN A

Response

learn.microsoft.com

IN CNAME

learn-public.trafficmanager.net

learn-public.trafficmanager.net

IN CNAME

learn.microsoft.com.edgekey.net

learn.microsoft.com.edgekey.net

IN CNAME

learn.microsoft.com.edgekey.net.globalredir.akadns.net

learn.microsoft.com.edgekey.net.globalredir.akadns.net

IN CNAME

e13636.dscb.akamaiedge.net

e13636.dscb.akamaiedge.net

IN A

184.25.193.230
GET

https://learn.microsoft.com/windows/configuration/kiosk/guidelines-for-assigned-access-app

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /windows/configuration/kiosk/guidelines-for-assigned-access-app HTTP/2.0
host: learn.microsoft.com
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 302

content-length: 0
location: /en-us/windows/configuration/kiosk/guidelines-for-assigned-access-app
request-context: appId=cid-v1:
content-security-policy: default-src *;script-src 'self' 'unsafe-inline' 'unsafe-eval' *.microsoft.com js.monitor.azure.com dc.services.visualstudio.com try-ppe.dot.net aznb-ame-prod.azureedge.net client-api.arkoselabs.com afd-markdowneditor-public-bvaydge8egfggtbs.b01.azurefd.net;style-src 'self' 'unsafe-inline' *.microsoft.com aznb-ame-prod.azureedge.net try-ppe.dot.net afd-markdowneditor-public-bvaydge8egfggtbs.b01.azurefd.net;img-src * data: blob:;frame-ancestors docs.microsoft.com *.docs.microsoft.com learn.microsoft.com *.learn.microsoft.com labclient.labondemand.com portal.azure.com *.portal.azure.com portal.azure.us portal.azure.cn *.onecloud.azure-test.net *.sharepoint.com localhost:3000;worker-src 'self' blob: *.microsoft.com;form-action 'self' *.microsoft.com *.azure.cn *.pearsonvue.com;media-src 'self' blob: *.microsoft.com *.azure.cn videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net videoencodingpubdevwus.blob.core.windows.net;base-uri 'self';font-src 'self' https: data:;object-src 'none';script-src-attr 'none';upgrade-insecure-requests
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
origin-agent-cluster: ?1
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
x-datacenter: East US
x-buildversion: 0.4.027845716
x-azure-ref: 20240818T093558Z-154b59dbc6dqh86j84a748wzes00000003z0000000015rke
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
cache-control: max-age=0
expires: Sun, 18 Aug 2024 09:35:59 GMT
date: Sun, 18 Aug 2024 09:35:59 GMT
akamai-cache-status: Miss from child, Miss from parent
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/en-us/windows/configuration/kiosk/guidelines-for-assigned-access-app

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /en-us/windows/configuration/kiosk/guidelines-for-assigned-access-app HTTP/2.0
host: learn.microsoft.com
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 301

content-length: 0
location: /en-us/windows/configuration/assigned-access/overview
request-context: appId=cid-v1:
content-security-policy: default-src *;script-src 'self' 'unsafe-inline' 'unsafe-eval' *.microsoft.com js.monitor.azure.com dc.services.visualstudio.com try-ppe.dot.net aznb-ame-prod.azureedge.net client-api.arkoselabs.com afd-markdowneditor-public-bvaydge8egfggtbs.b01.azurefd.net;style-src 'self' 'unsafe-inline' *.microsoft.com aznb-ame-prod.azureedge.net try-ppe.dot.net afd-markdowneditor-public-bvaydge8egfggtbs.b01.azurefd.net;img-src * data: blob:;frame-ancestors docs.microsoft.com *.docs.microsoft.com learn.microsoft.com *.learn.microsoft.com labclient.labondemand.com portal.azure.com *.portal.azure.com portal.azure.us portal.azure.cn *.onecloud.azure-test.net *.sharepoint.com localhost:3000;worker-src 'self' blob: *.microsoft.com;form-action 'self' *.microsoft.com *.azure.cn *.pearsonvue.com;media-src 'self' blob: *.microsoft.com *.azure.cn videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net videoencodingpubdevwus.blob.core.windows.net;base-uri 'self';font-src 'self' https: data:;object-src 'none';script-src-attr 'none';upgrade-insecure-requests
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
origin-agent-cluster: ?1
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
server-timing: content.metadata;dur=0.00
x-datacenter: East US
x-buildversion: 0.4.027845716
x-azure-ref: 20240818T093559Z-154b59dbc6dv6rws56cfta1t50000000034g00000000fbvm
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
cache-control: public, max-age=1799
expires: Sun, 18 Aug 2024 10:05:58 GMT
date: Sun, 18 Aug 2024 09:35:59 GMT
akamai-cache-status: Miss from child, Miss from parent
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /en-us/windows/configuration/assigned-access/overview HTTP/2.0
host: learn.microsoft.com
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

last-modified: Thu, 01 Aug 2024 17:53:30 GMT
etag: "ko3EshuGzHdfIRwVdT4XpqyaUUE="
content-type: text/html
content-length: 21805
content-encoding: gzip
vary: Accept-Encoding
request-context: appId=cid-v1:
content-security-policy: default-src *;script-src 'self' 'unsafe-inline' 'unsafe-eval' *.microsoft.com js.monitor.azure.com dc.services.visualstudio.com try-ppe.dot.net aznb-ame-prod.azureedge.net client-api.arkoselabs.com afd-markdowneditor-public-bvaydge8egfggtbs.b01.azurefd.net;style-src 'self' 'unsafe-inline' *.microsoft.com aznb-ame-prod.azureedge.net try-ppe.dot.net afd-markdowneditor-public-bvaydge8egfggtbs.b01.azurefd.net;img-src * data: blob:;frame-ancestors docs.microsoft.com *.docs.microsoft.com learn.microsoft.com *.learn.microsoft.com labclient.labondemand.com portal.azure.com *.portal.azure.com portal.azure.us portal.azure.cn *.onecloud.azure-test.net *.sharepoint.com localhost:3000;worker-src 'self' blob: *.microsoft.com;form-action 'self' *.microsoft.com *.azure.cn *.pearsonvue.com;media-src 'self' blob: *.microsoft.com *.azure.cn videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net videoencodingpubdevwus.blob.core.windows.net;base-uri 'self';font-src 'self' https: data:;object-src 'none';script-src-attr 'none';upgrade-insecure-requests
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
origin-agent-cluster: ?1
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
server-timing: content.metadata;dur=0.00, render.template;dur=0.03, render.content;dur=0.00, render.transform;dur=0.00, render.render;dur=7.54
x-datacenter: East US
x-buildversion: 0.4.027845716
x-azure-ref: 20240816T175723Z-154b59dbc6d2cd7ht60g90uxg800000001d0000000005qks
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
accept-ranges: bytes
cache-control: public, max-age=543
expires: Sun, 18 Aug 2024 09:45:02 GMT
date: Sun, 18 Aug 2024 09:35:59 GMT
akamai-cache-status: Miss from child, RefreshHit from parent
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/static/third-party/adobe-target/at-js/2.9.0/at.js

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /static/third-party/adobe-target/at-js/2.9.0/at.js HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
origin: https://learn.microsoft.com
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript
content-encoding: gzip
content-md5: p2plPaqhNrF9OruIDBWWBg==
last-modified: Fri, 05 Apr 2024 21:56:25 GMT
etag: 0x8DC55BB3D2DB12B
x-ms-request-id: 45537bd2-601e-0005-72d7-8feeeb000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0UDUeZgAAAAAWAUuMcjIgQ4opWjlg7zpzQU1TMDRFREdFMTkxOQA3MTY4OTIwZS05ZjViLTRhNjItYjE2ZS1kNWJlNjNjZTYxZTc=
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
x-content-type-options: nosniff
x-azure-ref: 02gcqZgAAAAD6+CR4P1a5TaKA35zoDN/9TE9OMjEyMDUwNzE4MDMzADcxNjg5MjBlLTlmNWItNGE2Mi1iMTZlLWQ1YmU2M2NlNjFlNw==
content-length: 33794
vary: Accept-Encoding
cache-control: max-age=25887712
expires: Sat, 14 Jun 2025 00:37:51 GMT
date: Sun, 18 Aug 2024 09:35:59 GMT
akamai-cache-status: Hit from child
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/static/assets/0.4.027845716/styles/site-ltr.css

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /static/assets/0.4.027845716/styles/site-ltr.css HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript
vary: Accept-Encoding
vary: Accept-Encoding
vary: Accept-Encoding
vary: Accept-Encoding
last-modified: Fri, 16 Aug 2024 16:16:12 GMT
etag: 0x8DCBE0EBF41FE70
x-ms-request-id: d3bca789-d01e-0053-0a02-f0069b000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240818T093559Z-154b59dbc6dwdqd8seck9h94gs00000004qg00000000ght9
x-fd-int-roxy-purgeid: 61262308
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
x-content-type-options: nosniff
accept-ranges: bytes
content-encoding: gzip
cache-control: max-age=31536000
expires: Mon, 18 Aug 2025 09:35:59 GMT
date: Sun, 18 Aug 2024 09:35:59 GMT
content-length: 584
akamai-cache-status: Hit from child
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/static/assets/0.4.027845716/global/deprecation.js

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /static/assets/0.4.027845716/global/deprecation.js HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/javascript
vary: Accept-Encoding
vary: Accept-Encoding
vary: Accept-Encoding
vary: Accept-Encoding
last-modified: Fri, 16 Aug 2024 16:17:46 GMT
etag: 0x8DCBE0EF6F86C0C
x-ms-request-id: 531b1a7d-e01e-0097-6903-f0795d000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240818T093559Z-154b59dbc6d2cd7ht60g90uxg800000003pg000000019aqb
x-fd-int-roxy-purgeid: 61262308
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
x-content-type-options: nosniff
accept-ranges: bytes
content-encoding: gzip
cache-control: max-age=31535984
expires: Mon, 18 Aug 2025 09:35:43 GMT
date: Sun, 18 Aug 2024 09:35:59 GMT
akamai-cache-status: Hit from child
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/static/assets/0.4.027845716/scripts/en-us/index-docs.js

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /static/assets/0.4.027845716/scripts/en-us/index-docs.js HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/css
vary: Accept-Encoding
vary: Accept-Encoding
vary: Accept-Encoding
vary: Accept-Encoding
last-modified: Fri, 16 Aug 2024 16:23:20 GMT
etag: 0x8DCBE0FBE63D4F3
x-ms-request-id: 7c7db8de-e01e-0036-5102-f0b7c6000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240818T093559Z-154b59dbc6d28m7mvf1ww9zgbn00000003h00000000015hy
x-fd-int-roxy-purgeid: 61262308
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
x-content-type-options: nosniff
accept-ranges: bytes
content-encoding: gzip
cache-control: max-age=31535944
expires: Mon, 18 Aug 2025 09:35:03 GMT
date: Sun, 18 Aug 2024 09:35:59 GMT
akamai-cache-status: Hit from child
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/en-us/windows/configuration/images/icons/intune.svg

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /en-us/windows/configuration/images/icons/intune.svg HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

last-modified: Fri, 15 Mar 2024 14:06:04 GMT
etag: "bxxx9QcTqHElWXSujN3h8cVcqZc="
content-type: image/svg+xml
request-context: appId=cid-v1:
content-security-policy: default-src *;script-src 'self' 'unsafe-inline' 'unsafe-eval' *.microsoft.com js.monitor.azure.com dc.services.visualstudio.com try-ppe.dot.net aznb-ame-prod.azureedge.net client-api.arkoselabs.com afd-markdowneditor-public-bvaydge8egfggtbs.b01.azurefd.net;style-src 'self' 'unsafe-inline' *.microsoft.com aznb-ame-prod.azureedge.net try-ppe.dot.net afd-markdowneditor-public-bvaydge8egfggtbs.b01.azurefd.net;img-src * data: blob:;frame-ancestors docs.microsoft.com *.docs.microsoft.com learn.microsoft.com *.learn.microsoft.com labclient.labondemand.com portal.azure.com *.portal.azure.com portal.azure.us portal.azure.cn *.onecloud.azure-test.net *.sharepoint.com localhost:3000;worker-src 'self' blob: *.microsoft.com;form-action 'self' *.microsoft.com *.azure.cn *.pearsonvue.com;media-src 'self' blob: *.microsoft.com *.azure.cn videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net videoencodingpubdevwus.blob.core.windows.net;base-uri 'self';font-src 'self' https: data:;object-src 'none';script-src-attr 'none';upgrade-insecure-requests
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
origin-agent-cluster: ?1
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
server-timing: content.metadata;dur=0.00, blob;dur=0.00
x-datacenter: East US
x-buildversion: 0.4.027845716
x-azure-ref: 20240816T175723Z-154b59dbc6dnd8twcers5n9ua000000001k000000001rsub
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
vary: Accept-Encoding
content-encoding: gzip
cache-control: public, max-age=731
expires: Sun, 18 Aug 2024 09:48:11 GMT
date: Sun, 18 Aug 2024 09:36:00 GMT
content-length: 1424
akamai-cache-status: Hit from child
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/en-us/windows/configuration/images/icons/provisioning-package.svg

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /en-us/windows/configuration/images/icons/provisioning-package.svg HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: image/svg+xml
last-modified: Tue, 04 Oct 2022 20:22:20 GMT
etag: "0x8DAA64623A124F7"
request-context: appId=cid-v1:8f3babe3-1612-4642-87ca-e9e867ad0935
x-datacenter: eus
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block
x-rendering-stack: Static
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
x-azure-ref: 02PHlZAAAAADDJPfh2BqvSrq5wmQTEIU/TE9OMjFFREdFMTgxOQA3MTY4OTIwZS05ZjViLTRhNjItYjE2ZS1kNWJlNjNjZTYxZTc=
vary: Accept-Encoding
content-encoding: gzip
content-length: 1020
cache-control: public, max-age=1303
expires: Sun, 18 Aug 2024 09:57:43 GMT
date: Sun, 18 Aug 2024 09:36:00 GMT
akamai-cache-status: Hit from child
strict-transport-security: max-age=31536000; includeSubDomains; preload
POST

https://learn.microsoft.com/api/recommendations/92ba4412-9860-4de4-9147-b2da0fe5373d/batch

msedge.exe

Remote address:

184.25.193.230:443

Request

POST /api/recommendations/92ba4412-9860-4de4-9147-b2da0fe5373d/batch HTTP/2.0
host: learn.microsoft.com
content-length: 170
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
content-type: application/json
accept: */*
origin: https://learn.microsoft.com
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/json
content-length: 1408
content-encoding: gzip
etag: "0x8DCAA8BC7FB4143"
last-modified: Mon, 22 Jul 2024 20:20:51 GMT
request-context: appId=cid-v1:8f3babe3-1612-4642-87ca-e9e867ad0935
x-datacenter: eus
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block
x-rendering-stack: Static
x-azure-ref: 20240722T210215Z-154b59dbc6d5rsg42ezfd1r42c00000004rg00000000qb7f
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
accept-ranges: bytes
vary: Accept-Encoding
cache-control: public, max-age=360
expires: Sun, 18 Aug 2024 09:42:00 GMT
date: Sun, 18 Aug 2024 09:36:00 GMT
akamai-cache-status: Hit from child
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /en-us/content-nav/site-header/site-header.json? HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/json
content-length: 1165
content-encoding: gzip
etag: "0x8DCA80EC9629E33"
last-modified: Fri, 19 Jul 2024 16:21:04 GMT
request-context: appId=cid-v1:8f3babe3-1612-4642-87ca-e9e867ad0935
x-datacenter: eus
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block
x-rendering-stack: Static
x-azure-ref: 20240731T175216Z-154b59dbc6dftqbpk107s7cudc00000000ag00000001t4hc
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
accept-ranges: bytes
vary: Accept-Encoding
cache-control: public, max-age=102
expires: Sun, 18 Aug 2024 09:37:42 GMT
date: Sun, 18 Aug 2024 09:36:00 GMT
akamai-cache-status: RefreshHit from child, Hit from parent
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-Windows.json?

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /en-us/content-nav/MSDocsHeader-Windows.json? HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/json
content-length: 2397
content-encoding: gzip
etag: "0x8DCB24A55FC5DAB"
last-modified: Thu, 01 Aug 2024 16:52:31 GMT
request-context: appId=cid-v1:8f3babe3-1612-4642-87ca-e9e867ad0935
x-datacenter: eus
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block
x-rendering-stack: Static
x-azure-ref: 20240801T184451Z-154b59dbc6dbfz5wnyvgxvrk1g00000001sg00000001r016
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
accept-ranges: bytes
vary: Accept-Encoding
cache-control: public, max-age=108
expires: Sun, 18 Aug 2024 09:37:48 GMT
date: Sun, 18 Aug 2024 09:36:00 GMT
akamai-cache-status: RefreshHit from child, RefreshHit from parent
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/en-us/windows/configuration/toc.json

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /en-us/windows/configuration/toc.json HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/json
content-length: 565
content-encoding: gzip
etag: "0x8DCB24A57809D2C"
last-modified: Thu, 01 Aug 2024 16:52:34 GMT
request-context: appId=cid-v1:8f3babe3-1612-4642-87ca-e9e867ad0935
x-datacenter: eus
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block
x-rendering-stack: Static
x-azure-ref: 20240801T183908Z-17cc7bff758rf55tnngkn4h2ns00000002c0000000001y92
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
accept-ranges: bytes
vary: Accept-Encoding
cache-control: public, max-age=148
expires: Sun, 18 Aug 2024 09:38:28 GMT
date: Sun, 18 Aug 2024 09:36:00 GMT
akamai-cache-status: RefreshHit from child, Hit from parent
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/en-us/windows/resources/breadcrumb/toc.json

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /en-us/windows/resources/breadcrumb/toc.json HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: image/svg+xml
etag: "0x8DC44F90DBA155E"
last-modified: Fri, 15 Mar 2024 14:06:04 GMT
request-context: appId=cid-v1:8f3babe3-1612-4642-87ca-e9e867ad0935
x-datacenter: eus
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block
x-rendering-stack: Static
x-azure-ref: 20240411T175605Z-17585d9fd9cdjv9qprkxdeszyn00000000pg00000001td1d
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 24010
cache-control: public, max-age=1379
expires: Sun, 18 Aug 2024 09:58:59 GMT
date: Sun, 18 Aug 2024 09:36:00 GMT
akamai-cache-status: Hit from child
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/en-us/windows/configuration/images/icons/powershell.svg

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /en-us/windows/configuration/images/icons/powershell.svg HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: image/svg+xml
etag: "0x8DC44F90DBAB0ED"
last-modified: Fri, 15 Mar 2024 14:06:04 GMT
request-context: appId=cid-v1:8f3babe3-1612-4642-87ca-e9e867ad0935
x-datacenter: eus
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block
x-rendering-stack: Static
x-azure-ref: 20240411T182706Z-174cb64fdd7kcrphv4xeadmk280000000150000000004he3
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 1266
cache-control: public, max-age=1441
expires: Sun, 18 Aug 2024 10:00:01 GMT
date: Sun, 18 Aug 2024 09:36:00 GMT
akamai-cache-status: Hit from child
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/en-us/windows/configuration/images/icons/settings-app.svg

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /en-us/windows/configuration/images/icons/settings-app.svg HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
content-encoding: gzip
last-modified: Fri, 12 Apr 2024 16:21:33 GMT
vary: Accept-Encoding
request-context: appId=cid-v1:418739f6-6645-4fdc-afa6-e1dfd90c96a2
x-content-type-options: nosniff
x-ms-taxonomy-version: 2024-04-12T16:21:33.3513004Z!075dab8e-d9b0-483d-b640-46051b191bc1
x-powered-by: ASP.NET
x-azure-ref-originshield: 04WgZZgAAAADNGSQznMfOQKxMuwPpruKLQU1TMDRFREdFMTgxOQA3MTY4OTIwZS05ZjViLTRhNjItYjE2ZS1kNWJlNjNjZTYxZTc=
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
x-azure-ref: 04WgZZgAAAADWOXoOAqNlSrfxXYAAjMR7TE9OMjEyMDUwNzE3MDA5ADcxNjg5MjBlLTlmNWItNGE2Mi1iMTZlLWQ1YmU2M2NlNjFlNw==
content-length: 7528
cache-control: public, max-age=501
expires: Sun, 18 Aug 2024 09:44:21 GMT
date: Sun, 18 Aug 2024 09:36:00 GMT
akamai-cache-status: Hit from child
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/api/taxonomies?name=devlang&locale=en-us

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /api/taxonomies?name=devlang&locale=en-us HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/json; charset=utf-8
access-control-allow-origin: https://learn.microsoft.com
content-encoding: gzip
vary: Origin,Accept-Encoding
request-context: appId=cid-v1:8da7faac-355b-4ce1-beec-f624ec5c6263
x-ms-operation-id: 5c49d7175db57b3a6c92dd766d25b0d7
x-content-type-options: nosniff
x-azure-ref: 20240818T093600Z-154b59dbc6dqs78mfs1tm69a3000000004cg00000000x088
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
content-length: 555
cache-control: public, max-age=43181
expires: Sun, 18 Aug 2024 21:35:41 GMT
date: Sun, 18 Aug 2024 09:36:00 GMT
set-cookie: ARRAffinity=087ec83d2cc4d10d61a748016be7d4166404c902653a275e2d6311c9653d4503;Path=/;HttpOnly;Secure;Domain=docsrecoapi-public-eus.azurewebsites.net
set-cookie: ARRAffinitySameSite=087ec83d2cc4d10d61a748016be7d4166404c902653a275e2d6311c9653d4503;Path=/;HttpOnly;SameSite=None;Secure;Domain=docsrecoapi-public-eus.azurewebsites.net
akamai-cache-status: Miss from child, Miss from parent
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/en-us/banners/index.json

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /en-us/banners/index.json HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview?tabs=intune
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: application/json
content-length: 1452
content-encoding: gzip
etag: "0x8DCBB2393F09971"
last-modified: Mon, 12 Aug 2024 23:07:46 GMT
request-context: appId=cid-v1:8f3babe3-1612-4642-87ca-e9e867ad0935
x-datacenter: eus
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block
x-rendering-stack: Static
x-azure-ref: 20240812T231502Z-17cc7bff7584sl6j3ghucq1kzw0000000w2g000000002upe
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
accept-ranges: bytes
vary: Accept-Encoding
cache-control: public, max-age=311
expires: Sun, 18 Aug 2024 09:41:11 GMT
date: Sun, 18 Aug 2024 09:36:00 GMT
akamai-cache-status: Hit from child
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/static/assets/0.4.027845716/styles/docons.6f24ebc5.woff2

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /static/assets/0.4.027845716/styles/docons.6f24ebc5.woff2 HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
origin: https://learn.microsoft.com
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: font
referer: https://learn.microsoft.com/static/assets/0.4.027845716/styles/site-ltr.css
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: MicrosoftApplicationsTelemetryDeviceId=21d899e9-696a-4fcb-a3e3-6142f4026187
cookie: ai_session=hPEJjVM8I/Kp5n4g8K/jVh|1723973759615|1723973759615

Response

HTTP/2.0 200

content-type: application/octet-stream
content-length: 18752
last-modified: Fri, 16 Aug 2024 16:23:20 GMT
etag: 0x8DCBE0FBE0AEC94
x-ms-request-id: ac041808-601e-00af-2a02-f03804000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240816T173702Z-154b59dbc6dkd5ssfyavh3bqgg00000001qg00000001wt7q
x-fd-int-roxy-purgeid: 61262308
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
x-content-type-options: nosniff
accept-ranges: bytes
cache-control: max-age=31392051
expires: Sat, 16 Aug 2025 17:36:51 GMT
date: Sun, 18 Aug 2024 09:36:00 GMT
akamai-cache-status: Hit from child
strict-transport-security: max-age=31536000; includeSubDomains; preload
GET

https://learn.microsoft.com/static/third-party/SegoeUIWeb/1.01.206/SegoeUI-Roman-VF_web.woff2

msedge.exe

Remote address:

184.25.193.230:443

Request

GET /static/third-party/SegoeUIWeb/1.01.206/SegoeUI-Roman-VF_web.woff2 HTTP/2.0
host: learn.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
origin: https://learn.microsoft.com
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: font
referer: https://learn.microsoft.com/static/assets/0.4.027845716/styles/site-ltr.css
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: MicrosoftApplicationsTelemetryDeviceId=21d899e9-696a-4fcb-a3e3-6142f4026187
cookie: ai_session=hPEJjVM8I/Kp5n4g8K/jVh|1723973759615|1723973759615

Response

HTTP/2.0 200

content-length: 118288
content-type: font/woff2
content-md5: vKlyGNyjyxXOAoTLy0UokA==
last-modified: Tue, 03 Oct 2023 20:01:59 GMT
etag: 0x8DBC44B9A533874
x-ms-request-id: bac9ff59-f01e-0070-59b9-3fbbfd000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
x-content-type-options: nosniff
x-azure-ref: 0FsuXZQAAAABNvBNYvTb+T6+kIrYIO2rDTE9OMjFFREdFMTYxMwA3MTY4OTIwZS05ZjViLTRhNjItYjE2ZS1kNWJlNjNjZTYxZTc=
cache-control: max-age=26383410
expires: Thu, 19 Jun 2025 18:19:30 GMT
date: Sun, 18 Aug 2024 09:36:00 GMT
akamai-cache-status: Hit from child
strict-transport-security: max-age=31536000; includeSubDomains; preload
DNS

wcpstatic.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

wcpstatic.microsoft.com

IN A

Response

wcpstatic.microsoft.com

IN CNAME

consentdeliveryfd.azurefd.net

consentdeliveryfd.azurefd.net

IN CNAME

firstparty-azurefd-prod.trafficmanager.net

firstparty-azurefd-prod.trafficmanager.net

IN CNAME

shed.dual-low.s-part-0036.t-0009.t-msedge.net

shed.dual-low.s-part-0036.t-0009.t-msedge.net

IN CNAME

s-part-0036.t-0009.t-msedge.net

s-part-0036.t-0009.t-msedge.net

IN A

13.107.246.64
DNS

js.monitor.azure.com

msedge.exe

Remote address:

8.8.8.8:53

Request

js.monitor.azure.com

IN A

Response

js.monitor.azure.com

IN CNAME

aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net

aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net

IN CNAME

star-azurefd-prod.trafficmanager.net

star-azurefd-prod.trafficmanager.net

IN CNAME

shed.dual-low.s-part-0036.t-0009.t-msedge.net

shed.dual-low.s-part-0036.t-0009.t-msedge.net

IN CNAME

s-part-0036.t-0009.t-msedge.net

s-part-0036.t-0009.t-msedge.net

IN A

13.107.246.64
GET

https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js

msedge.exe

Remote address:

13.107.246.64:443

Request

GET /mscc/lib/v2/wcp-consent.js HTTP/2.0
host: wcpstatic.microsoft.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://learn.microsoft.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sun, 18 Aug 2024 09:35:59 GMT
content-type: application/javascript
content-length: 81726
content-encoding: gzip
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
age: 30740
cache-control: max-age=43200
content-md5: X1JOIM5h9UISVFS6+GfEew==
etag: 0x8DA85F6EA62BF74
last-modified: Wed, 24 Aug 2022 17:34:36 GMT
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 82145d9c-501e-0074-430a-f119b1000000
x-ms-version: 2009-09-19
x-azure-ref: 20240818T093559Z-17cc7bff758vcw5zk5y8qcbcww00000002hg00000000amnk
accept-ranges: bytes
GET

https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js

msedge.exe

Remote address:

13.107.246.64:443

Request

GET /scripts/c/ms.jsll-4.min.js HTTP/2.0
host: js.monitor.azure.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://learn.microsoft.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sun, 18 Aug 2024 09:35:59 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
cache-control: no-transform, public, max-age=1800, immutable
last-modified: Mon, 15 Jul 2024 17:38:35 GMT
x-ms-request-id: d4c8dfae-301e-0072-33e1-ef2a0e000000
x-ms-version: 2009-09-19
x-ms-meta-jssdkver: 4.3.0
x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.0.min.js
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240818T093559Z-154b59dbc6d86d8ht0dpkep9s400000002d000000000g96u
x-fd-int-roxy-purgeid: 0
x-cache: TCP_HIT
content-encoding: br
DNS

230.193.25.184.in-addr.arpa

Remote address:

8.8.8.8:53

Request

230.193.25.184.in-addr.arpa

IN PTR

Response

230.193.25.184.in-addr.arpa

IN PTR

a184-25-193-230deploystaticakamaitechnologiescom
DNS

230.193.25.184.in-addr.arpa

Remote address:

8.8.8.8:53

Request

230.193.25.184.in-addr.arpa

IN PTR
DNS

64.246.107.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

64.246.107.13.in-addr.arpa

IN PTR

Response
DNS

64.246.107.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

64.246.107.13.in-addr.arpa

IN PTR
DNS

mscom.demdex.net

msedge.exe

Remote address:

8.8.8.8:53

Request

mscom.demdex.net

IN A

Response

mscom.demdex.net

IN CNAME

gslb-2.demdex.net

gslb-2.demdex.net

IN CNAME

edge-irl1.demdex.net

edge-irl1.demdex.net

IN CNAME

dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com

dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com

IN A

34.247.247.246

dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com

IN A

54.76.102.91

dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com

IN A

54.246.157.114

dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com

IN A

99.81.94.253

dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com

IN A

108.128.106.180

dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com

IN A

54.154.186.142

dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com

IN A

79.125.42.210

dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com

IN A

34.253.4.224
DNS

target.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

target.microsoft.com

IN A

Response

target.microsoft.com

IN CNAME

microsoftmscompoc.tt.omtrdc.net

microsoftmscompoc.tt.omtrdc.net

IN CNAME

adobetarget.data.adobedc.net

adobetarget.data.adobedc.net

IN A

66.235.152.156

adobetarget.data.adobedc.net

IN A

66.235.152.225

adobetarget.data.adobedc.net

IN A

66.235.152.221
DNS

target.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

target.microsoft.com

IN A

Response

target.microsoft.com

IN CNAME

microsoftmscompoc.tt.omtrdc.net

microsoftmscompoc.tt.omtrdc.net

IN CNAME

adobetarget.data.adobedc.net

adobetarget.data.adobedc.net

IN A

66.235.152.225

adobetarget.data.adobedc.net

IN A

66.235.152.221

adobetarget.data.adobedc.net

IN A

66.235.152.156
DNS

microsoftmscompoc.tt.omtrdc.net

msedge.exe

Remote address:

8.8.8.8:53

Request

microsoftmscompoc.tt.omtrdc.net

IN A

Response

microsoftmscompoc.tt.omtrdc.net

IN CNAME

adobetarget.data.adobedc.net

adobetarget.data.adobedc.net

IN A

66.235.152.225

adobetarget.data.adobedc.net

IN A

66.235.152.156

adobetarget.data.adobedc.net

IN A

66.235.152.221
DNS

microsoftmscompoc.tt.omtrdc.net

msedge.exe

Remote address:

8.8.8.8:53

Request

microsoftmscompoc.tt.omtrdc.net

IN A

Response

microsoftmscompoc.tt.omtrdc.net

IN CNAME

adobetarget.data.adobedc.net

adobetarget.data.adobedc.net

IN A

66.235.152.221

adobetarget.data.adobedc.net

IN A

66.235.152.225

adobetarget.data.adobedc.net

IN A

66.235.152.156
DNS

browser.events.data.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

browser.events.data.microsoft.com

IN A

Response

browser.events.data.microsoft.com

IN CNAME

browser.events.data.trafficmanager.net

browser.events.data.trafficmanager.net

IN CNAME

onedscolprdcus01.centralus.cloudapp.azure.com

onedscolprdcus01.centralus.cloudapp.azure.com

IN A

52.182.141.63
DNS

246.247.247.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

246.247.247.34.in-addr.arpa

IN PTR

Response

246.247.247.34.in-addr.arpa

IN PTR

ec2-34-247-247-246 eu-west-1compute amazonawscom
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

ax-0001.ax-msedge.net

ax-0001.ax-msedge.net

IN A

150.171.28.10

ax-0001.ax-msedge.net

IN A

150.171.27.10
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

ax-0001.ax-msedge.net

ax-0001.ax-msedge.net

IN A

150.171.28.10

ax-0001.ax-msedge.net

IN A

150.171.27.10
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340418579_1UMXSJ3YHHNUEPPRM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239340418579_1UMXSJ3YHHNUEPPRM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 604205
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AFB0495752B8486BBCF4EF2710254BDC Ref B: LON04EDGE1119 Ref C: 2024-08-18T09:36:40Z
date: Sun, 18 Aug 2024 09:36:40 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340418580_1XZDKNXCHEXKE96NH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239340418580_1XZDKNXCHEXKE96NH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 666447
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FFCFCB312B484D1E838B126F04821A07 Ref B: LON04EDGE1119 Ref C: 2024-08-18T09:36:40Z
date: Sun, 18 Aug 2024 09:36:40 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239339388113_1UUFKEO9Y9AYGD8YG&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239339388113_1UUFKEO9Y9AYGD8YG&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 385954
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6F17849E7E204D209B268C73A063D00F Ref B: LON04EDGE1119 Ref C: 2024-08-18T09:36:40Z
date: Sun, 18 Aug 2024 09:36:40 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301011_1Q64Y8U9UJ0Y7FTOQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239317301011_1Q64Y8U9UJ0Y7FTOQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 343343
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8BF3CB562D54474EA846F8A5ADBF66C7 Ref B: LON04EDGE1119 Ref C: 2024-08-18T09:36:40Z
date: Sun, 18 Aug 2024 09:36:40 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239339388114_1II63A1BYQ3WIA6DV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239339388114_1II63A1BYQ3WIA6DV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 349873
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7F6C0CDF03B44089A3270ABBD898D202 Ref B: LON04EDGE1119 Ref C: 2024-08-18T09:36:40Z
date: Sun, 18 Aug 2024 09:36:40 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301444_1ADW5UG9KMTHYULQ8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239317301444_1ADW5UG9KMTHYULQ8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 352599
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CCB7C410D7B5470482B54D68A25B5928 Ref B: LON04EDGE1119 Ref C: 2024-08-18T09:36:41Z
date: Sun, 18 Aug 2024 09:36:40 GMT

127.0.0.1:51014

firefox.exe
172.67.195.64:80

http://pufferhost.pl/

http

firefox.exe

623 B
1.0kB
6
4

HTTP Request

GET http://pufferhost.pl/

HTTP Response

301
172.67.195.64:443

https://pufferhost.pl/

tls, http2

firefox.exe

1.9kB
13.8kB
14
24

HTTP Request

GET https://pufferhost.pl/

HTTP Response

403
34.149.97.1:443

firefox-api-proxy.cdn.mozilla.net

tls, http2

firefox.exe

1.5kB
4.3kB
12
13
104.18.94.41:443

https://challenges.cloudflare.com/turnstile/v0/g/ba7376691753/api.js?onload=IbcA8&render=explicit

tls, http2

firefox.exe

2.0kB
21.6kB
15
28

HTTP Request

GET https://challenges.cloudflare.com/turnstile/v0/g/ba7376691753/api.js?onload=IbcA8&render=explicit

HTTP Response

200
127.0.0.1:51023

firefox.exe
23.62.195.195:443

https://cxcs.microsoft.net/api/settings/en-US/xml/settings-tipset?release=20h1&sku=Professional&platform=desktop

tls, http2

1.7kB
7.5kB
24
20

HTTP Request

GET https://cxcs.microsoft.net/api/settings/en-US/xml/settings-tipset?release=20h1&sku=Professional&platform=desktop

HTTP Response

404

HTTP Request

GET https://cxcs.microsoft.net/api/settings/en-US/xml/settings-tipset?release=20h1&sku=Professional&platform=desktop

HTTP Response

404

HTTP Request

GET https://cxcs.microsoft.net/api/settings/en-US/xml/settings-tipset?release=20h1&sku=Professional&platform=desktop

HTTP Response

404
92.123.142.153:443

https://www.bing.com/RelatedSearch?addfeaturesnoexpansion=relatedsearch&mkt=en-US

tls, http2

4.4kB
7.5kB
22
20

HTTP Request

POST https://www.bing.com/RelatedSearch?addfeaturesnoexpansion=relatedsearch&mkt=en-US

HTTP Response

200

HTTP Request

POST https://www.bing.com/RelatedSearch?addfeaturesnoexpansion=relatedsearch&mkt=en-US

HTTP Response

200
184.25.193.230:443

https://learn.microsoft.com/static/third-party/SegoeUIWeb/1.01.206/SegoeUI-Roman-VF_web.woff2

tls, http2

msedge.exe

32.0kB
830.7kB
516
627

HTTP Request

GET https://learn.microsoft.com/windows/configuration/kiosk/guidelines-for-assigned-access-app

HTTP Response

302

HTTP Request

GET https://learn.microsoft.com/en-us/windows/configuration/kiosk/guidelines-for-assigned-access-app

HTTP Response

301

HTTP Request

GET https://learn.microsoft.com/en-us/windows/configuration/assigned-access/overview

HTTP Response

200

HTTP Request

GET https://learn.microsoft.com/static/third-party/adobe-target/at-js/2.9.0/at.js

HTTP Request

GET https://learn.microsoft.com/static/assets/0.4.027845716/styles/site-ltr.css

HTTP Request

GET https://learn.microsoft.com/static/assets/0.4.027845716/global/deprecation.js

HTTP Request

GET https://learn.microsoft.com/static/assets/0.4.027845716/scripts/en-us/index-docs.js

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://learn.microsoft.com/en-us/windows/configuration/images/icons/intune.svg

HTTP Response

200

HTTP Request

GET https://learn.microsoft.com/en-us/windows/configuration/images/icons/provisioning-package.svg

HTTP Response

200

HTTP Request

POST https://learn.microsoft.com/api/recommendations/92ba4412-9860-4de4-9147-b2da0fe5373d/batch

HTTP Request

GET https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?

HTTP Request

GET https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-Windows.json?

HTTP Request

GET https://learn.microsoft.com/en-us/windows/configuration/toc.json

HTTP Request

GET https://learn.microsoft.com/en-us/windows/resources/breadcrumb/toc.json

HTTP Request

GET https://learn.microsoft.com/en-us/windows/configuration/images/icons/powershell.svg

HTTP Request

GET https://learn.microsoft.com/en-us/windows/configuration/images/icons/settings-app.svg

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://learn.microsoft.com/api/taxonomies?name=devlang&locale=en-us

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://learn.microsoft.com/en-us/banners/index.json

HTTP Response

200

HTTP Request

GET https://learn.microsoft.com/static/assets/0.4.027845716/styles/docons.6f24ebc5.woff2

HTTP Request

GET https://learn.microsoft.com/static/third-party/SegoeUIWeb/1.01.206/SegoeUI-Roman-VF_web.woff2

HTTP Response

200

HTTP Response

200
13.107.246.64:443

https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js

tls, http2

msedge.exe

4.3kB
90.7kB
56
72

HTTP Request

GET https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js

HTTP Response

200
13.107.246.64:443

https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js

tls, http2

msedge.exe

6.1kB
102.4kB
70
85

HTTP Request

GET https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js

HTTP Response

200
34.247.247.246:443

mscom.demdex.net

tls, http2

msedge.exe

989 B
5.2kB
9
10
52.182.141.63:443

browser.events.data.microsoft.com

msedge.exe

98 B
52 B
2
1
52.182.141.63:443

browser.events.data.microsoft.com

msedge.exe

98 B
52 B
2
1
52.182.141.63:443

browser.events.data.microsoft.com

msedge.exe

98 B
52 B
2
1
150.171.28.10:443

https://tse1.mm.bing.net/th?id=OADD2.10239317301444_1ADW5UG9KMTHYULQ8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

tls, http2

106.8kB
2.9MB
2126
2120

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340418579_1UMXSJ3YHHNUEPPRM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340418580_1XZDKNXCHEXKE96NH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239339388113_1UUFKEO9Y9AYGD8YG&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301011_1Q64Y8U9UJ0Y7FTOQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Response

200

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239339388114_1II63A1BYQ3WIA6DV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301444_1ADW5UG9KMTHYULQ8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Response

200
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.2kB
6.9kB
15
13
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.2kB
6.9kB
15
13
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.2kB
6.9kB
15
13

8.8.8.8:53

pufferhost.pl

dns

firefox.exe

59 B
91 B
1
1

DNS Request

pufferhost.pl

DNS Response

172.67.195.64

104.21.12.186
8.8.8.8:53

spocs.getpocket.com

dns

firefox.exe

130 B
131 B
2
1

DNS Request

spocs.getpocket.com

DNS Request

spocs.getpocket.com

DNS Response

34.117.188.166
8.8.8.8:53

firefox-api-proxy.cdn.mozilla.net

dns

firefox.exe

158 B
160 B
2
1

DNS Request

firefox-api-proxy.cdn.mozilla.net

DNS Request

firefox-api-proxy.cdn.mozilla.net

DNS Response

34.149.97.1
8.8.8.8:53

28.118.140.52.in-addr.arpa

dns

144 B
158 B
2
1

DNS Request

28.118.140.52.in-addr.arpa

DNS Request

28.118.140.52.in-addr.arpa
8.8.8.8:53

73.144.22.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

73.144.22.2.in-addr.arpa
8.8.8.8:53

prod.content-signature-chains.prod.webservices.mozgcp.net

dns

firefox.exe

103 B
119 B
1
1

DNS Request

prod.content-signature-chains.prod.webservices.mozgcp.net

DNS Response

34.160.144.191
8.8.8.8:53

pufferhost.pl

dns

firefox.exe

59 B
91 B
1
1

DNS Request

pufferhost.pl

DNS Response

104.21.12.186

172.67.195.64
8.8.8.8:53

shavar.prod.mozaws.net

dns

firefox.exe

136 B
116 B
2
1

DNS Request

shavar.prod.mozaws.net

DNS Request

shavar.prod.mozaws.net

DNS Response

44.240.54.139

35.82.42.34

44.226.249.47
8.8.8.8:53

prod.content-signature-chains.prod.webservices.mozgcp.net

dns

firefox.exe

206 B
131 B
2
1

DNS Request

prod.content-signature-chains.prod.webservices.mozgcp.net

DNS Request

prod.content-signature-chains.prod.webservices.mozgcp.net

DNS Response

2600:1901:0:92a9::
8.8.8.8:53

pufferhost.pl

dns

firefox.exe

118 B
115 B
2
1

DNS Request

pufferhost.pl

DNS Request

pufferhost.pl

DNS Response

2606:4700:3035::ac43:c340

2606:4700:3033::6815:cba
8.8.8.8:53

prod.remote-settings.prod.webservices.mozgcp.net

dns

firefox.exe

94 B
110 B
1
1

DNS Request

prod.remote-settings.prod.webservices.mozgcp.net

DNS Response

34.149.100.209
8.8.8.8:53

prod.remote-settings.prod.webservices.mozgcp.net

dns

firefox.exe

188 B
187 B
2
1

DNS Request

prod.remote-settings.prod.webservices.mozgcp.net

DNS Request

prod.remote-settings.prod.webservices.mozgcp.net
172.67.195.64:443

pufferhost.pl

https

firefox.exe

5.8kB
73.6kB
21
71
8.8.8.8:53

64.195.67.172.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

64.195.67.172.in-addr.arpa
8.8.8.8:53

139.54.240.44.in-addr.arpa

dns

72 B
135 B
1
1

DNS Request

139.54.240.44.in-addr.arpa
34.149.97.1:443

firefox-api-proxy.cdn.mozilla.net

https

firefox.exe

2.1kB
12.9kB
7
14
8.8.8.8:53

challenges.cloudflare.com

dns

firefox.exe

71 B
103 B
1
1

DNS Request

challenges.cloudflare.com

DNS Response

104.18.94.41

104.18.95.41
8.8.8.8:53

prod.ads.prod.webservices.mozgcp.net

dns

firefox.exe

82 B
98 B
1
1

DNS Request

prod.ads.prod.webservices.mozgcp.net

DNS Response

34.117.188.166
8.8.8.8:53

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

dns

firefox.exe

100 B
116 B
1
1

DNS Request

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

DNS Response

34.149.97.1
8.8.8.8:53

challenges.cloudflare.com

dns

firefox.exe

71 B
103 B
1
1

DNS Request

challenges.cloudflare.com

DNS Response

104.18.94.41

104.18.95.41
8.8.8.8:53

prod.ads.prod.webservices.mozgcp.net

dns

firefox.exe

82 B
175 B
1
1

DNS Request

prod.ads.prod.webservices.mozgcp.net
8.8.8.8:53

shavar.prod.mozaws.net

dns

firefox.exe

68 B
153 B
1
1

DNS Request

shavar.prod.mozaws.net
8.8.8.8:53

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

dns

firefox.exe

100 B
128 B
1
1

DNS Request

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

DNS Response

2600:1901:0:74e4::
8.8.8.8:53

challenges.cloudflare.com

dns

firefox.exe

71 B
127 B
1
1

DNS Request

challenges.cloudflare.com

DNS Response

2606:4700::6812:5f29

2606:4700::6812:5e29
104.18.94.41:443

challenges.cloudflare.com

https

firefox.exe

1.8kB
7.7kB
5
11
8.8.8.8:53

41.94.18.104.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

41.94.18.104.in-addr.arpa
8.8.8.8:53

133.32.126.40.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

133.32.126.40.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

88.156.103.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

88.156.103.20.in-addr.arpa
8.8.8.8:53

cxcs.microsoft.net

dns

64 B
154 B
1
1

DNS Request

cxcs.microsoft.net

DNS Response

23.62.195.195
8.8.8.8:53

154.239.44.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

154.239.44.20.in-addr.arpa
8.8.8.8:53

55.36.223.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

55.36.223.20.in-addr.arpa
8.8.8.8:53

195.195.62.23.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

195.195.62.23.in-addr.arpa
8.8.8.8:53

153.142.123.92.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

153.142.123.92.in-addr.arpa
8.8.8.8:53

103.169.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

103.169.127.40.in-addr.arpa
8.8.8.8:53

18.31.95.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

18.31.95.13.in-addr.arpa
8.8.8.8:53

192.142.123.92.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

192.142.123.92.in-addr.arpa
8.8.8.8:53

167.57.26.184.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

167.57.26.184.in-addr.arpa
8.8.8.8:53

learn.microsoft.com

dns

msedge.exe

130 B
540 B
2
2

DNS Request

learn.microsoft.com

DNS Request

learn.microsoft.com

DNS Response

184.25.193.230

DNS Response

184.25.193.230
8.8.8.8:53

wcpstatic.microsoft.com

dns

msedge.exe

69 B
251 B
1
1

DNS Request

wcpstatic.microsoft.com

DNS Response

13.107.246.64
8.8.8.8:53

js.monitor.azure.com

dns

msedge.exe

66 B
254 B
1
1

DNS Request

js.monitor.azure.com

DNS Response

13.107.246.64
8.8.8.8:53

230.193.25.184.in-addr.arpa

dns

146 B
139 B
2
1

DNS Request

230.193.25.184.in-addr.arpa

DNS Request

230.193.25.184.in-addr.arpa
8.8.8.8:53

64.246.107.13.in-addr.arpa

dns

144 B
158 B
2
1

DNS Request

64.246.107.13.in-addr.arpa

DNS Request

64.246.107.13.in-addr.arpa
8.8.8.8:53

mscom.demdex.net

dns

msedge.exe

62 B
307 B
1
1

DNS Request

mscom.demdex.net

DNS Response

34.247.247.246

54.76.102.91

54.246.157.114

99.81.94.253

108.128.106.180

54.154.186.142

79.125.42.210

34.253.4.224
8.8.8.8:53

target.microsoft.com

dns

msedge.exe

132 B
396 B
2
2

DNS Request

target.microsoft.com

DNS Request

target.microsoft.com

DNS Response

66.235.152.156

66.235.152.225

66.235.152.221

DNS Response

66.235.152.225

66.235.152.221

66.235.152.156
8.8.8.8:53

microsoftmscompoc.tt.omtrdc.net

dns

msedge.exe

154 B
328 B
2
2

DNS Request

microsoftmscompoc.tt.omtrdc.net

DNS Request

microsoftmscompoc.tt.omtrdc.net

DNS Response

66.235.152.225

66.235.152.156

66.235.152.221

DNS Response

66.235.152.221

66.235.152.225

66.235.152.156
8.8.8.8:53

browser.events.data.microsoft.com

dns

msedge.exe

79 B
203 B
1
1

DNS Request

browser.events.data.microsoft.com

DNS Response

52.182.141.63
8.8.8.8:53

246.247.247.34.in-addr.arpa

dns

73 B
137 B
1
1

DNS Request

246.247.247.34.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

124 B
340 B
2
2

DNS Request

tse1.mm.bing.net

DNS Request

tse1.mm.bing.net

DNS Response

150.171.28.10

150.171.27.10

DNS Response

150.171.28.10

150.171.27.10

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
35663f9c6f8fb3aab9754045a8890d55

SHA1
79297df6242d709e6f75f584b45c34113ca4d079

SHA256
30262aacec66d45920c45504bcbf9dbb08cd0c899f09221727f4a7baa0e801f5

SHA512
e54fdadec6644f82b466fbb169cd65d45ebb021f21e6944fe07df88eb5f607828a18192998fd526d05d2ee31e08b78720dc6d62b8c84bd9e1c312ad53bf3c2fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f95db3025bc378f254eb77805881e325

SHA1
95d0d8ed389d037824d7ee3d795ac70df7acada6

SHA256
6cfc7f4433f2382054fc03b9a9b89ce01993f437c1cb0e5f48df26efe55ee322

SHA512
d27e71245c8c6bfeb29918471644d75fdc6460a005451c47c3ceef77b2b2fcae280bb2d1d75c0e2c2480306bfa727f137bb006b31589640b52f3a1e3be757b33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
590212d8e387226338fc79140a05462c

SHA1
1ec116132b6ac14d6dee81c572e6d5d02593e310

SHA256
ca1b615ba00369c981749ea8bf9db0e1f1104a61e7545debfca6f7a6aeb2fc33

SHA512
93a63e5e227ab0d6c973672bcf1ff418b70a7755821bf5283d08fe9f6e2b38d84a6cc647711ec218a24fb27477e1190342651c8a5c214bb23df4b6c4518ff84d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
346B

MD5
172a03f1e073cbc347cb5102d038fa13

SHA1
83a95a02491a4b046ea79fd04ccf6c5c24b29d60

SHA256
b8193a8bbd8d5c6b71977d040537ea555fc414cb3f7c2d4166e9bd3ac1ef4e89

SHA512
2a47a09a51fbf77f8b2bcc2d3e46db628d45ebabb9bb4033965b3409810e9a6c55c1008a62bfab5d3ca2a64d8b67f5c726f3682da0132738065c14ff77c1f5bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ca2321a37d438c1184e87739c9233162

SHA1
3c216401bfc9f4b8dc9fcfcd9489102901e70402

SHA256
e89ee77284f44f4a5731f0eb82348a55ad5921e00d3643d804bcde10f9ec5661

SHA512
483751742f705e32a9568d8ee3ed83458182781d6141e39ab8a817552e6b2613371dd80b57ba6232f53206049b92eb74ea22809f66d53079eb2439ebe2e91d0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72fc9c89de7ae66e1528a86858a0f223

SHA1
e79da7c486116a9d2768eed6cad42e713affd848

SHA256
7c681129faf1b7b856f651bce86a0c0fbf8a1f1558dabce3253bf984af669737

SHA512
b675b1865b07cc5c4c2eaa4765d358c086eccc33fc2da8cd2fc8007c19123d4ccd5fc39506760ac257d01f8f2b3d03adcfeaf96e791d68560f9af86f9122e88f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ffdda7bb45c0fc3dd034c836a56b5c7

SHA1
056869105dcf5c062dddff0f81f09ca11b11a139

SHA256
2fa730d8c02fd95b09212f84c9471a831c80a791351d20d3969ac86df330b650

SHA512
28507bc73f8fcc950391caddca154b846d15e8bbfd8a29a80da25c96111fd8605f10d44f1be118560c85a192c7410c0a6832bcfa276db746a6aa2cad45078a7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
38fbdafa7727d8ebd7fcfce551fd7b8a

SHA1
d7dbaa0b85d22fa9cf3510f295ac33dc099c3cd0

SHA256
cf812853f15b683489aeddb6af260c6eef94ba79432bf56658c76ce2d75da7fe

SHA512
f1e72cc69e986b3594d722966e7aa509088a97c242a0cdb69f168ff156430bd6da624d885271b2297f1d4317db3f4cc44102c8989fa0d314f57ab0f2f683b08c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
fab9b35b4337476ad3486adf498fb43f

SHA1
d5228e2fa17348e995c0c52d2be9db3c91548af4

SHA256
09b1bc909bd2dea351fbc41cc66d0d8779fe999c2eb52eee3877815d5166746d

SHA512
bb35f60cd0f1071db189ee6b2848f7159ce715b0981a87ee688e0ee3d3cc15e8df41dbda711a149f61afb94ecdccc4277727a19d2767ec11049be1a706655c18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f47971c83d066359bb559c6aec54f828

SHA1
77cc996dd83dcfdc64ffd49a35b8492871559114

SHA256
234c1ed72811a14bd21ac6eaa14777e4c50699472f335a488f388c5448fce048

SHA512
e5640b4160b80360492e00cd457ec9587ea07e2230ed2984fc3c0735d7abe1b117ced69d76008e807b1c2cf2d2c6743cc2f999aed28b0f720c46821d99ee826c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fc2be8d4eee65e4d39d88276fd89f5c2

SHA1
bbaaad5aee2421c9c8e90ab1cd6b7df3fcdc3b34

SHA256
4356406f8bd1b12e1534800b64fcbfe7eb9627c1617a7047b7891a062eaa38ea

SHA512
451470ebcafd1323020c20373ec21b3e49017356231b66fa96debe47f4b1d3459ae76a6858754edb2c6dfe0afb38a3fb0fee0eb6e66324e795adc66abe622613

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
bbcf0bfea98ab10d97f5136ff10f8083

SHA1
4e8600714708b0e995a53b4f199230dc55c03419

SHA256
dd35da4604e29372c546b2dc1d610209810c097fc2ac4c56bc1d80c448654e17

SHA512
b8985b09c16dd9ffd9b329510772a06e96ffae543b983bdda6b497e92cb2bdd9aab67ad04f4e58be097b0c706755f8a24951366c07002d6b14db513b0323c219

Download Submit
C:\Users\Admin\AppData\Local\Temp\587BEAE8-46FC-49D0-A138-96495333A914\AppxProvider.dll

Filesize
554KB

MD5
a7927846f2bd5e6ab6159fbe762990b1

SHA1
8e3b40c0783cc88765bbc02ccc781960e4592f3f

SHA256
913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f

SHA512
1eafece2f6aa881193e6374b81d7a7c8555346756ed53b11ca1678f1f3ffb70ae3dea0a30c5a0aab8be45db9c31d78f30f026bb22a7519a0930483d50507243f

Download Submit
C:\Users\Admin\AppData\Local\Temp\587BEAE8-46FC-49D0-A138-96495333A914\DismCorePS.dll

Filesize
183KB

MD5
a033f16836d6f8acbe3b27b614b51453

SHA1
716297072897aea3ec985640793d2cdcbf996cf9

SHA256
e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e

SHA512
ad5b641d93ad35b3c7a3b56cdf576750d1ad4c63e2a16006739888f0702280cad57dd0a6553ef426111c04ceafd6d1e87f6e7486a171fff77f243311aee83871

Download Submit
C:\Users\Admin\AppData\Local\Temp\587BEAE8-46FC-49D0-A138-96495333A914\DismHost.exe

Filesize
142KB

MD5
e5d5e9c1f65b8ec7aa5b7f1b1acdd731

SHA1
dbb14dcda6502ab1d23a7c77d405dafbcbeb439e

SHA256
e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80

SHA512
7cf80d4a16c5dbbf61fcb22ebe30cf78ca42a030b7d7b4ad017f28fba2c9b111e8cf5b3064621453a44869bbaed124d6fb1e8d2c8fe8202f1e47579d874fa4bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\587BEAE8-46FC-49D0-A138-96495333A914\LogProvider.dll

Filesize
77KB

MD5
815a4e7a7342224a239232f2c788d7c0

SHA1
430b7526d864cfbd727b75738197230d148de21a

SHA256
a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2

SHA512
0c19d1e388ed0855a660135dec7a5e6b72ecbb7eb67ff94000f2399bd07df431be538055a61cfb2937319a0ce060898bb9b6996765117b5acda8fc0bad47a349

Download Submit
C:\Users\Admin\AppData\Local\Temp\587BEAE8-46FC-49D0-A138-96495333A914\OSProvider.dll

Filesize
149KB

MD5
db4c3a07a1d3a45af53a4cf44ed550ad

SHA1
5dea737faadf0422c94f8f50e9588033d53d13b3

SHA256
2165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758

SHA512
5182b80459447f3c1fb63b70ad0370e1da26828a7f73083bec0af875b37888dd12ec5a6d9dc84157fc5b535f473ad7019eb6a53b9a47a2e64e6a8b7fae4cddde

Download Submit
C:\Users\Admin\AppData\Local\Temp\587BEAE8-46FC-49D0-A138-96495333A914\dismprov.dll

Filesize
255KB

MD5
490be3119ea17fa29329e77b7e416e80

SHA1
c71191c3415c98b7d9c9bbcf1005ce6a813221da

SHA256
ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a

SHA512
6339b030008b7d009d36abf0f9595da9b793264ebdce156d4a330d095a5d7602ba074075ea05fef3dde474fc1d8e778480429de308c121df0bf3075177f26f13

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

Filesize
7KB

MD5
a7c8375bb1495478fdb1a9d3bfb99473

SHA1
0897c94b3547bf973fdc13055e6b7fde3b7a9c0d

SHA256
c0ed4a798dac769939920c34a0e9bb933da289e6ad189d4f8f6f82833d90aae8

SHA512
7330453504d9a48060edec94bb712166c69f97f365966033fc6167ba4cfab5a176d97cc331f92718306a8edc3f1e8d53083e444135968a85c0b6b26c835a4b01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
ad270b05c0fe4b2099dbb934d2879ba7

SHA1
f87d266b27d206456b257975145daa1ff13d94f3

SHA256
568e7f471031c0741a3562b38daec6557f14b4483d684ab5942d57362d562a09

SHA512
de70e3c8c635cc6347fc3b1be0a30c545f72b9d291584137496816c823998dadb0c62a57909c4b460e2a0177f6d0b4d931fff943e5f0a1e1a1cb8895fc4f1330

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
6102ed5c04f8d811e10fb6fecaed080d

SHA1
057882a8cc26e62d8060a6c526949c6c812ecdb7

SHA256
5ae6b596e80b4e813d5076d4400f9d6d3a56636c31bc7ddabf8250591f3c4bfc

SHA512
de6100d16cd1b7d94bbb47f11665e63f6f5e34a1204da259e258c966b46bc56d06d1eb7a88a8387c8cd90e72fb01863e7cd15382b616c38a6245a57a9d03cbe3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
f4678b85554c47ab2cb3470249531dae

SHA1
effdb567028ba306b51c124f7c6448684aa97d67

SHA256
d0955d8a1f292a4edca275cf8cc3980934cda63745394eba03560495a9b7245e

SHA512
b2cd33c567a81b9d4d0d1849e0afdfa13758c05b5d79b81bd8df6021c21ae7e0194ff07fd3921b5d14c8dbfa932e08f36711a69bb2ef762492c10c22210731ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\3430bfc9-a5b0-4c40-8282-2551a0d5042c

Filesize
671B

MD5
af916a739e20356c6e0655a58c706ab3

SHA1
7718be7c34e7b0f9c4ffe9158a8817869d4b6673

SHA256
0980a3d902d8b878dc55c5062d8517e07288a17c42dfaa0c249691aa612cf4ab

SHA512
006d1db39f58d2089abdb4b491aa1ccb39b869a676105d97cba3186af6725c691117747225b3c58cca9842c91070dd45a1549ebee96288fa69594cd4fc3eb99d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\3e2f7d37-72c9-4d56-8d8a-8069dc6bb09d

Filesize
982B

MD5
d0739cfdf0defd05640639c9526fcaa4

SHA1
ec5a21c4334fa8730d10f171f61a334a9c88972b

SHA256
2b2daff75656e70b391c60a3c83137e8ec19395f2d32ef506478dd08bb32aff5

SHA512
ed7b532720ec1583e6ad114bcf3cd69a5b14d17df97a121f94240630adc46d98aaed5b8004bb2a91bc6089ee31e6df7a340fa1e300ac018dc409af5b257c80d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\fcbd9a94-be5d-491e-aa1d-be5d45cb36a3

Filesize
27KB

MD5
edbbaafdbc033d5bb61bf7321d715d39

SHA1
caabff31008a18a806616225c26e6c3d02adee09

SHA256
306e89541f2a84ad083014d359dd0a3a3a477628f636577499d067da526917af

SHA512
db88101921c0a0247db223a93735e9d03df63e056ce3228148b374e7124d5a9149a930525e04ff728cf0cabaf9e746cdeb2b282c30108f6e6dfb6988d84578df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js

Filesize
11KB

MD5
bd82d40dda99f9c488ed28397a15f47e

SHA1
4a1ea3c91b94635e67b41d5de80088359b173aa1

SHA256
2c6258552253a90755a0e06686068c94eec798e1a1ec6368a64ab40be788bf78

SHA512
d75835b774eb5778f576ff76aa338306183c9bf25b4fcac52c935305996e3784de8dd3401b3a890290df283f8c623573c3dcdabc4ebfe865ff55996b9982cd71

Download Submit
C:\Windows\Logs\DISM\dism.log

Filesize
233KB

MD5
fecbb1c00a09fbe7dd42a6437cb6c08c

SHA1
ce611ac149be8c9d6074f21b6a8f24b5fd8fe9b9

SHA256
136ae1d4dc2bd8ec37a332c715c552fcaee78287be99612e218e8cc9b608dec2

SHA512
9d5e5f08d889f6fc04689b9e34012b55d40003a0bdcca7fa76775674808e9211ff4b2ce93b16b4f54f1e01c2ac2314eed024901d0d8bf5c06157380e29cab38c

Download Submit
C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001\User\Registry.pol

Filesize
2KB

MD5
4b16d4336b2526400d7ad848a75888c6

SHA1
d8a5af89048ddb0578677421bb3e1478fb0ca58f

SHA256
43a77d88c281d206f275618c8acd90a7dc9652b330182cb3d2adbd7d6a3c9725

SHA512
37313e091d469a78fe72beb2153b70315b633c7eddcb4f1f278de21151aa885ac48584b6353b27b293a506cb2e23de9c7f20d439a5e032cc054f3dc1895a9708

Download Submit
C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001\User\Registry.pol

Filesize
2KB

MD5
e622da32a3c9fdea58ea0d299ed51838

SHA1
7e9d298259b3f357534df9e61aaacdaedd3db431

SHA256
90205042004276426d81f3ba1cdae9baceef95d1b618d34b34241ec68d99dc59

SHA512
629359e68d3ca43f243d2175b3bf6776a70a8e205ab3f99196e067403eb4375eba0b074545ab451ef1fd5d812ff3d1d575e680711cda07f8dd5897f8d2423649

Download Submit
C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001\gpt.ini

Filesize
156B

MD5
16d3db98a2e61c6cc9995c04dadbd2d9

SHA1
ebb9386c4bf0ff6f409242302b60dfd8e98f88c4

SHA256
b98e52b2880806730906a1ecc57ee8891a9f7f9f77464677f9767702c14dd26b

SHA512
bebb7b2713bcd581421dc5cba9eccd7731b31daf630829b3d3d20488b7eb545e01432f7522f20e63ed3418d855189eaa5854781ff2b0f7b7f752a84c33739adf

Download Submit
C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001\gpt.ini

Filesize
156B

MD5
43ae5785e5ea6bf65171874ceae48306

SHA1
9f0f4f7a828027f205aa83908cf766680e2879d4

SHA256
80ca003578e36802876bb3e5141235c3e68bb37e6c5f4971a1c64a19ac72e3bf

SHA512
62b8262c0a9391b3b9c85c418f380f1b79e0742b514e2d49356d484b9f8295bf5cc63b098a8d8a0a5d3bef23e73a3ffec75377111808c167abbfa62974ea8ff0

Download Submit
C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001\gpt.ini

Filesize
156B

MD5
a1e6004d428db0a9256276298b757073

SHA1
f330528b94d25866c504ed82889df4c4b62e25e9

SHA256
20722165653a54e11afdbee1a1c1bf17d625a1f5e81e8d9edcbb03e3329a9bb3

SHA512
1c09687193aafd7e1d3e69e183a55f1053970853e0b871b243ae3ebc6afd26e71ba578c2eaf71ca20f56ef88aeaa9b1bb9b7aba1b3dee5892ebdd192b85dd20b

Download Submit
C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001\gpt.ini

Filesize
156B

MD5
9d45cd049ab7a405803946a149f6220f

SHA1
70f1352e873f9ca1349f8bf3400079d596465274

SHA256
f20c7f8a67a91145a52412bacebd9a61a5570c75658ff31eb284b4b91501b3f9

SHA512
1d0cd1190ab05c6eac681235d2e0dbbb4130a484459329a77899a5da50828ddd8accbeee27dfe4f7c23da9d13e9d845f0efd4d3fe7dcbcdf688d3d287ffb1732

Download Submit
C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001\gpt.ini

Filesize
156B

MD5
38c69b078cf14e384a0caf2fd06e1542

SHA1
9a6bda6a32774cc15ba9263a097ffa38df301edc

SHA256
7861f9503b219e53b7f14a2bd62e148378feaa61b91bf94eb6d21a56920833c1

SHA512
c7a55af562ad81250450d4ac8b47063ed85ae43184a0ec134c484f5bf59b36f27ca616f3537e7c0bf7349163abfd195f4b8133a5367b59931aadce2cab48290c

Download Submit
C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001\gpt.ini

Filesize
156B

MD5
01f7312accda4df66532f2167d3bbb99

SHA1
84800575cdfc785f112e4a1a356e787f7496c876

SHA256
7e36ca2a5fc506c2f3bdde57fc01382849649da42526e9b3fcdfd0448ab575e3

SHA512
4308601dea31bd9ca9be8e0c252a4258560ee8a844e6b817c3511d5a2a84a7b894a19283183dfaf6090f4b74e1c80030ba957fb46bdd9575d9958dfa81e3caed

Download Submit
C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001\gpt.ini

Filesize
156B

MD5
4205a65eaa089928c453333460d2b860

SHA1
7539ed4a8d5e198f653d15be5c35a07e4b594580

SHA256
aa85980aa0b330ec7a6780df76a3acbef4aa0071b53b62cd3bdb44341928a333

SHA512
210289cfd240a69483e1fcf8ed52d46816dae646cc22b060508e172e78241a1035893b3045376625cd49294895ec95c13cdb742621cac72d7527ef80f6b8c414

Download Submit
C:\Windows\System32\GroupPolicyUsers\S-1-5-21-945322488-2060912225-3527527000-1001\gpt.ini

Filesize
156B

MD5
e206d6f1e4ac7e81f07f284406e21297

SHA1
387c9d4edce7ccf9a5445e1cf5d71406ed7d4244

SHA256
7e29c9824333a91e0b856321fc28caee9b715d5af376a281f10a08324c2d80ca

SHA512
b07332fdd61a4df2ea50dcf3313a98c59890a4a652a9a99bb06426d697322c03ed1b384ca825938b84c3b47df02d7de59018edd7adcd30f03b13bade43e8cb20

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

DNS Request