cryptolocker | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure[.]apk

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2025, 23:27 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk

Score

10^/10

cryptolocker wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Cryptolocker family
cryptolocker
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Downloads MZ/PE file 3 IoCs

flow	pid	Process
114	5320	msedge.exe
114	5320	msedge.exe
114	5320	msedge.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDBF8D.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDBF94.tmp	WannaCry.exe

Executes dropped EXE 24 IoCs

pid	Process
2484	CryptoLocker.exe
4924	{34184A33-0407-212E-3320-09040709E2C2}.exe
3484	{34184A33-0407-212E-3320-09040709E2C2}.exe
872	WannaCry.exe
3904	!WannaDecryptor!.exe
5708	WannaCry.exe
3412	!WannaDecryptor!.exe
4600	!WannaDecryptor!.exe
2316	!WannaDecryptor!.exe
2840	ColorBug.exe
5500	ColorBug.exe
4768	ColorBug.exe
5380	ColorBug.exe
3384	ColorBug.exe
4472	ColorBug.exe
2124	ColorBug.exe
2476	ColorBug.exe
5784	ColorBug.exe
6124	ColorBug.exe
4592	ColorBug.exe
5400	ColorBug.exe
4184	ColorBug.exe
2896	ColorBug.exe
4432	ColorBug.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\~~CB = "cb.exe"	ColorBug.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
104	raw.githubusercontent.com
105	raw.githubusercontent.com
107	raw.githubusercontent.com
113	raw.githubusercontent.com
108	raw.githubusercontent.com
109	raw.githubusercontent.com
112	raw.githubusercontent.com
114	raw.githubusercontent.com
229	raw.githubusercontent.com
230	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1691947829\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_144710394\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_144710394\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1691947829\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1691947829\safety_tips.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1691947829\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1691947829\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_144710394\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_144710394\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_144710394\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
4912	taskkill.exe
2888	taskkill.exe
2304	taskkill.exe
4648	taskkill.exe

Modifies Control Panel 64 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveTitleText = "43 214 75"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\TitleText = "153 20 210"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ActiveTitle = "222 57 1"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Hilight = "83 118 46"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Scrollbar = "200 213 68"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowText = "141 123 27"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Hilight = "97 202 3"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ButtonFace = "68 127 250"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\GrayText = "145 137 173"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Window = "61 101 234"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowText = "124 184 68"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\MenuText = "65 18 230"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Background = "51 191 48"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Menu = "53 217 243"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowText = "86 170 223"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Menu = "141 233 110"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\MenuText = "132 162 84"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\AppWorkspace = "176 87 203"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ActiveTitle = "40 151 64"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\HilightText = "61 251 200"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveTitleText = "2 118 68"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Background = "116 2 101"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ActiveTitle = "138 255 207"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveTitleText = "104 181 228"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveBorder = "184 36 207"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveBorder = "5 130 139"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowText = "100 205 96"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Window = "236 85 217"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveBorder = "244 208 156"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowText = "205 242 60"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ButtonFace = "20 161 161"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveTitle = "7 235 162"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Window = "104 71 84"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowFrame = "194 28 40"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\GrayText = "66 24 253"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveTitleText = "217 17 85"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Background = "68 154 130"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\MenuText = "122 59 108"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveTitle = "184 148 129"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Window = "27 199 36"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowFrame = "218 173 118"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ActiveTitle = "242 52 53"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\WindowText = "116 11 209"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\InactiveBorder = "38 4 235"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ActiveBorder = "224 154 249"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\MenuText = "94 236 42"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Scrollbar = "109 80 247"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ButtonShadow = "249 8 229"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Window = "7 115 93"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Menu = "246 136 16"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ButtonShadow = "216 245 68"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Window = "48 19 233"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\HilightText = "17 119 227"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\Menu = "212 29 141"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\HilightText = "0 119 46"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ButtonText = "101 78 117"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\ActiveBorder = "34 14 158"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Colors\AppWorkspace = "12 187 182"	ColorBug.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133868140477411622"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3446877943-4095308722-756223633-1000\{F0B0E397-475B-43F3-B09C-B29B2E2611EA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	taskkill.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	2304	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5928	WMIC.exe
Token: SeSecurityPrivilege	5928	WMIC.exe
Token: SeTakeOwnershipPrivilege	5928	WMIC.exe
Token: SeLoadDriverPrivilege	5928	WMIC.exe
Token: SeSystemProfilePrivilege	5928	WMIC.exe
Token: SeSystemtimePrivilege	5928	WMIC.exe
Token: SeProfSingleProcessPrivilege	5928	WMIC.exe
Token: SeIncBasePriorityPrivilege	5928	WMIC.exe
Token: SeCreatePagefilePrivilege	5928	WMIC.exe
Token: SeBackupPrivilege	5928	WMIC.exe
Token: SeRestorePrivilege	5928	WMIC.exe
Token: SeShutdownPrivilege	5928	WMIC.exe
Token: SeDebugPrivilege	5928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5928	WMIC.exe
Token: SeRemoteShutdownPrivilege	5928	WMIC.exe
Token: SeUndockPrivilege	5928	WMIC.exe
Token: SeManageVolumePrivilege	5928	WMIC.exe
Token: 33	5928	WMIC.exe
Token: 34	5928	WMIC.exe
Token: 35	5928	WMIC.exe
Token: 36	5928	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5928	WMIC.exe
Token: SeSecurityPrivilege	5928	WMIC.exe
Token: SeTakeOwnershipPrivilege	5928	WMIC.exe
Token: SeLoadDriverPrivilege	5928	WMIC.exe
Token: SeSystemProfilePrivilege	5928	WMIC.exe
Token: SeSystemtimePrivilege	5928	WMIC.exe
Token: SeProfSingleProcessPrivilege	5928	WMIC.exe
Token: SeIncBasePriorityPrivilege	5928	WMIC.exe
Token: SeCreatePagefilePrivilege	5928	WMIC.exe
Token: SeBackupPrivilege	5928	WMIC.exe
Token: SeRestorePrivilege	5928	WMIC.exe
Token: SeShutdownPrivilege	5928	WMIC.exe
Token: SeDebugPrivilege	5928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5928	WMIC.exe
Token: SeRemoteShutdownPrivilege	5928	WMIC.exe
Token: SeUndockPrivilege	5928	WMIC.exe
Token: SeManageVolumePrivilege	5928	WMIC.exe
Token: 33	5928	WMIC.exe
Token: 34	5928	WMIC.exe
Token: 35	5928	WMIC.exe
Token: 36	5928	WMIC.exe
Token: SeBackupPrivilege	5528	vssvc.exe
Token: SeRestorePrivilege	5528	vssvc.exe
Token: SeAuditPrivilege	5528	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3904	!WannaDecryptor!.exe
3904	!WannaDecryptor!.exe
3412	!WannaDecryptor!.exe
3412	!WannaDecryptor!.exe
4600	!WannaDecryptor!.exe
4600	!WannaDecryptor!.exe
2316	!WannaDecryptor!.exe
2316	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 4224	5460	msedge.exe	84
PID 5460 wrote to memory of 4224	5460	msedge.exe	84
PID 5460 wrote to memory of 5320	5460	msedge.exe	85
PID 5460 wrote to memory of 5320	5460	msedge.exe	85
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5920	5460	msedge.exe	86
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5568	5460	msedge.exe	87
PID 5460 wrote to memory of 5568	5460	msedge.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffe9882f208,0x7ffe9882f214,0x7ffe9882f220
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1948,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2160,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2196,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:8
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3508,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3512,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5116,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5100,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5640,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5804,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5804,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5928,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6108,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6088,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6672,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:436
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2484
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4924
  - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000224
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5324,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3984,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5192,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:5552
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 214501742340527.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1860
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:956
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe c
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3412
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b !WannaDecryptor!.exe v
    3⤵
    - System Location Discovery: System Language Discovery
    PID:640
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe v
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4600
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4028
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5928
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2316
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5844,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5632,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5920,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=4904,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5184,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6696,i,2335919207601595533,5875151768983711164,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4868
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:2840
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:5500
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:4768
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:5380
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:3384
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:4472
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:2124
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:2476
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:5784
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:4592
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:5400
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:6124
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:4184
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:2896
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1584

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5528

Network

DNS

github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

github.com

IN A

Response

github.com

IN A

20.26.156.215
DNS

github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

github.com

IN Unknown

Response
DNS

edge.microsoft.com

Remote address:

8.8.8.8:53

Request

edge.microsoft.com

IN A

Response

edge.microsoft.com

IN CNAME

edge-domain.trafficmanager.net

edge-domain.trafficmanager.net

IN CNAME

edge-microsoft-com.dual-a-0036.a-msedge.net

edge-microsoft-com.dual-a-0036.a-msedge.net

IN CNAME

dual-a-0036.a-msedge.net

dual-a-0036.a-msedge.net

IN A

204.79.197.239

dual-a-0036.a-msedge.net

IN A

13.107.21.239
DNS

orpwpjkgrirv.info

Remote address:

8.8.8.8:53

Request

orpwpjkgrirv.info

IN A

Response
DNS

edge.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

edge.microsoft.com

IN Unknown

Response

edge.microsoft.com

IN CNAME

edge-domain.trafficmanager.net

edge-domain.trafficmanager.net

IN CNAME

edge-microsoft-com.dual-a-0036.a-msedge.net
DNS

edge.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

edge.microsoft.com

IN A

Response

edge.microsoft.com

IN CNAME

edge-domain.trafficmanager.net

edge-domain.trafficmanager.net

IN CNAME

edge-microsoft-com.dual-a-0036.a-msedge.net

edge-microsoft-com.dual-a-0036.a-msedge.net

IN CNAME

dual-a-0036.a-msedge.net

dual-a-0036.a-msedge.net

IN A

13.107.21.239

dual-a-0036.a-msedge.net

IN A

204.79.197.239
DNS

edge.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

edge.microsoft.com

IN Unknown

Response

edge.microsoft.com

IN CNAME

edge-domain.trafficmanager.net

edge-domain.trafficmanager.net

IN CNAME

edge-microsoft-com.ax-0002.ax-msedge.net
DNS

copilot.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

copilot.microsoft.com

IN A

Response

copilot.microsoft.com

IN CNAME

copilot-copilot-msft-com.trafficmanager.net

copilot-copilot-msft-com.trafficmanager.net

IN CNAME

copilot.microsoft.com.edgekey.net

copilot.microsoft.com.edgekey.net

IN CNAME

e107108.dscx.akamaiedge.net

e107108.dscx.akamaiedge.net

IN A

95.101.143.218

e107108.dscx.akamaiedge.net

IN A

88.221.135.26

e107108.dscx.akamaiedge.net

IN A

88.221.135.2
DNS

copilot.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

copilot.microsoft.com

IN Unknown

Response

copilot.microsoft.com

IN CNAME

copilot-copilot-msft-com.trafficmanager.net

copilot-copilot-msft-com.trafficmanager.net

IN CNAME

copilot.microsoft.com.edgekey.net

copilot.microsoft.com.edgekey.net

IN CNAME

e107108.dscx.akamaiedge.net
DNS

api.edgeoffer.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

api.edgeoffer.microsoft.com

IN A

Response

api.edgeoffer.microsoft.com

IN CNAME

bingadsedgeextension-prod.trafficmanager.net

bingadsedgeextension-prod.trafficmanager.net

IN CNAME

bingadsedgeextension-prod-europe.azurewebsites.net

bingadsedgeextension-prod-europe.azurewebsites.net

IN CNAME

ssl.bingadsedgeextension-prod-europe.azurewebsites.net

ssl.bingadsedgeextension-prod-europe.azurewebsites.net

IN A

94.245.104.56
DNS

api.edgeoffer.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

api.edgeoffer.microsoft.com

IN Unknown

Response

api.edgeoffer.microsoft.com

IN CNAME

bingadsedgeextension-prod.trafficmanager.net

bingadsedgeextension-prod.trafficmanager.net

IN CNAME

bingadsedgeextension-prod-europe.azurewebsites.net

bingadsedgeextension-prod-europe.azurewebsites.net

IN CNAME

ssl.bingadsedgeextension-prod-europe.azurewebsites.net
GET

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk HTTP/2.0
host: github.com
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:24 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"d97ad1f8c80979b2ff74ee25debf7a75"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
set-cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _octo=GH1.1.1565031185.1742340444; Path=/; Domain=github.com; Expires=Wed, 18 Mar 2026 23:27:24 GMT; Secure; SameSite=Lax
set-cookie: logged_in=no; Path=/; Domain=github.com; Expires=Wed, 18 Mar 2026 23:27:24 GMT; HttpOnly; Secure; SameSite=Lax
x-github-request-id: 7364:244E5F:81FEA9:9A46E4:67DA015C
GET

http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:sn7D6S1VL0h1pakyFSKcj5_cXfhMSlOWNCAqpFiP-R0&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

msedge.exe

Remote address:

204.79.197.239:80

Request

GET /browsernetworktime/time/1/current?cup2key=2:sn7D6S1VL0h1pakyFSKcj5_cXfhMSlOWNCAqpFiP-R0&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1
Host: edge.microsoft.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Sec-Mesh-Client-Edge-Version: 133.0.3065.69
Sec-Mesh-Client-Edge-Channel: stable
Sec-Mesh-Client-OS: Windows
Sec-Mesh-Client-OS-Version: 10.0.19041
Sec-Mesh-Client-Arch: x86_64
Sec-Mesh-Client-WebView: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK

Cache-Control: no-store, must-revalidate, no-cache, max-age=0
Pragma: no-cache
Content-Length: 100
Content-Type: application/json
Content-Encoding: gzip
Expires: Mon, 01 Jan 1990 00:00:00 GMT
X-Frame-Options: sameorigin
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
x-cup-server-proof: 3046022100C3EC36D40269C3249D80613C6CCEE3C31E9505E6CBF2EB167886CABA4B54822A022100F02A23B9B861A2A0B3A626A78CABDABD455903A8AD30F7C2109E39B1153294EB:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Content-Disposition: attachment; filename='json.txt'
X-Cache: CONFIG_NOCACHE
X-MSEdge-Ref: Ref A: 46DCC17044A444E5845262F8BBAA2B52 Ref B: FRA31EDGE0807 Ref C: 2025-03-18T23:27:24Z
Date: Tue, 18 Mar 2025 23:27:23 GMT
GET

https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19041&devicefamily=desktop&installdate=1741877482&clientversion=133.0.3065.69&experimentationmode=2&scpguard=0&scpfull=0&scpver=0

msedge.exe

Remote address:

13.107.21.239:443

Request

GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19041&devicefamily=desktop&installdate=1741877482&clientversion=133.0.3065.69&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/2.0
host: edge.microsoft.com
pragma: no-cache
cache-control: no-cache
sec-mesh-client-edge-version: 133.0.3065.69
sec-mesh-client-edge-channel: stable
sec-mesh-client-os: Windows
sec-mesh-client-os-version: 10.0.19041
sec-mesh-client-arch: x86_64
sec-mesh-client-webview: 0
x-client-data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiLTY5MjMwMjcxODcxMTMzNTIzODkiLCI2Ijoic3RhYmxlIiwiOSI6ImRlc2t0b3AifQ==
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=4, i

Response

HTTP/2.0 200

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-length: 931
content-type: application/json; charset=utf-8
content-security-policy: base-uri 'self';block-all-mixed-content;default-src 'self';img-src 'self';object-src 'none';script-src 'none';style-src 'self';upgrade-insecure-requests;
x-cache: CONFIG_NOCACHE
x-msedge-ref: Ref A: 43EE3E238BAF40EDAF7354202D5DE2F0 Ref B: FRA31EDGE0418 Ref C: 2025-03-18T23:27:24Z
date: Tue, 18 Mar 2025 23:27:24 GMT
GET

https://copilot.microsoft.com/c/api/user/eligibility

msedge.exe

Remote address:

95.101.143.218:443

Request

GET /c/api/user/eligibility HTTP/2.0
host: copilot.microsoft.com
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
sec-fetch-storage-access: active
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=4, i

Response

HTTP/2.0 200

x-ceto-ref: 67da015c55b441a588eefa912ecaef47|AFD:67da015c55b441a588eefa912ecaef47|2025-03-18T23:27:24.171Z
content-length: 0
date: Tue, 18 Mar 2025 23:27:24 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.34367a5c.1742340444.66652a7
GET

https://api.edgeoffer.microsoft.com/edgeoffer/pb/experiments?appId=edge-extensions&country=US

msedge.exe

Remote address:

94.245.104.56:443

Request

GET /edgeoffer/pb/experiments?appId=edge-extensions&country=US HTTP/1.1
Host: api.edgeoffer.microsoft.com
Connection: keep-alive
Sec-Fetch-Site: none
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: empty
Sec-Fetch-Storage-Access: active
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Length: 0
Content-Type: application/x-protobuf; charset=utf-8
Date: Tue, 18 Mar 2025 23:27:23 GMT
Server: Microsoft-IIS/10.0
Set-Cookie: ARRAffinity=9227ae1cb5a277729efa46e240c1611079a5bbd85009e9cf84a0012a98e40629;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com
Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com
Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com
Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9
X-Powered-By: ASP.NET
DNS

github.githubassets.com

msedge.exe

Remote address:

8.8.8.8:53

Request

github.githubassets.com

IN A

Response

github.githubassets.com

IN A

185.199.111.154

github.githubassets.com

IN A

185.199.109.154

github.githubassets.com

IN A

185.199.108.154

github.githubassets.com

IN A

185.199.110.154
DNS

github.githubassets.com

msedge.exe

Remote address:

8.8.8.8:53

Request

github.githubassets.com

IN Unknown

Response
DNS

avatars.githubusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

avatars.githubusercontent.com

IN A

Response

avatars.githubusercontent.com

IN A

185.199.108.133

avatars.githubusercontent.com

IN A

185.199.109.133

avatars.githubusercontent.com

IN A

185.199.110.133

avatars.githubusercontent.com

IN A

185.199.111.133
DNS

avatars.githubusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

avatars.githubusercontent.com

IN Unknown

Response
GET

https://github.githubassets.com/assets/light-605318cbe3a1.css

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/light-605318cbe3a1.css HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: style
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: text/css
last-modified: Tue, 11 Mar 2025 23:23:05 GMT
etag: "0x8DD60F3AD388533"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 15658
x-served-by: cache-iad-kjyo7100025-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 98, 688
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: f2d29413646fed726d1c9aa4a458e0f09e0c8880
content-length: 39262
GET

https://github.githubassets.com/assets/primer-aaa714e5674d.css

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/primer-aaa714e5674d.css HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: style
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: text/css
last-modified: Mon, 03 Mar 2025 21:33:14 GMT
etag: "0x8DD5A9B011C1A27"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1216171
x-served-by: cache-iad-kiad7000072-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 40, 35111
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 3ea0c16e1a22f846630c617766c61885266c3393
content-length: 8073
GET

https://github.githubassets.com/assets/primer-primitives-225433424a87.css

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/primer-primitives-225433424a87.css HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: style
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: text/css
last-modified: Fri, 14 Mar 2025 17:38:43 GMT
etag: "0x8DD631F110691B2"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 69646
x-served-by: cache-iad-kiad7000177-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 141, 4417
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: c8f827077f685ad14096fbcfe8f426367021f77f
content-length: 21534
GET

https://github.githubassets.com/assets/dark-bd1cb5575fff.css

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/dark-bd1cb5575fff.css HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: style
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: text/css
last-modified: Thu, 13 Mar 2025 13:15:49 GMT
etag: "0x8DD62312CB5E39C"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 395291
x-served-by: cache-iad-kjyo7100171-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 9, 12799
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 45cd92bff4e876a19bb2681bfb3e2b87f4b98c3f
content-length: 38166
GET

https://github.githubassets.com/assets/global-7d4d2344e7ab.css

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/global-7d4d2344e7ab.css HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: style
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: text/css
last-modified: Mon, 17 Mar 2025 19:33:50 GMT
etag: "0x8DD658AA52B2A6E"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 15662
x-served-by: cache-iad-kjyo7100050-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 110, 709
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 7f61ce54d794a5f7b0a0f912197bae02feaecf6a
content-length: 21964
GET

https://github.githubassets.com/assets/github-43ae85d4871b.css

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/github-43ae85d4871b.css HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: style
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: text/css
last-modified: Thu, 06 Mar 2025 17:41:31 GMT
etag: "0x8DD5CD6217C4ECD"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1044340
x-served-by: cache-iad-kjyo7100068-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 82, 10007
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: dd50e40774572c3798e45babe2405fa51866a517
content-length: 1194
GET

https://github.githubassets.com/assets/primer-react.8ab4763323c317a58873.module.css

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/primer-react.8ab4763323c317a58873.module.css HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: style
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: text/css
last-modified: Mon, 26 Aug 2024 16:36:17 GMT
etag: "0x8DCC5ED35736954"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 10915575
x-served-by: cache-iad-kjyo7100115-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 32, 35476
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 70de898ce308274ce0e181d8f40577f0d1fae025
content-length: 479
GET

https://github.githubassets.com/assets/code-0210be90f4d3.css

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/code-0210be90f4d3.css HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: style
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: text/css
last-modified: Mon, 27 Jan 2025 16:33:51 GMT
etag: "0x8DD3EF06259EC32"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 2998013
x-served-by: cache-iad-kjyo7100076-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 23, 38194
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: dac679ca8d6350235c1c86c6bbfe7ccb8710ae8c
content-length: 5184
GET

https://github.githubassets.com/assets/repository-4fce88777fa8.css

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/repository-4fce88777fa8.css HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: style
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: text/css
last-modified: Fri, 17 Jan 2025 17:06:48 GMT
etag: "0x8DD37195443E4FE"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 3667411
x-served-by: cache-iad-kjyo7100163-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 10, 29968
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: e532cf88ab22e1a067cc23aeb268c180a03e431f
content-length: 5189
GET

https://github.githubassets.com/assets/notifications-subscriptions-menu.1bcff9205c241e99cff2.module.css

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/notifications-subscriptions-menu.1bcff9205c241e99cff2.module.css HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: style
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: text/css
last-modified: Mon, 03 Mar 2025 21:33:15 GMT
etag: "0x8DD5A9B01FC085A"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1216176
x-served-by: cache-iad-kiad7000140-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 49, 36196
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: f4d1fb846c8c54f127d1289964469bce8927629e
content-length: 2401
GET

https://github.githubassets.com/assets/react-code-view.a0633e3d36c876a6eaa1.module.css

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/react-code-view.a0633e3d36c876a6eaa1.module.css HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: style
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: text/css
last-modified: Mon, 03 Mar 2025 21:33:11 GMT
etag: "0x8DD5A9AFFAE6DF7"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1216176
x-served-by: cache-iad-kjyo7100138-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 100, 35275
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 6acfb5a375a1b9517f278e9af370226560fde3e9
content-length: 8174
GET

https://github.githubassets.com/assets/wp-runtime-ba9cc7e99d50.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/wp-runtime-ba9cc7e99d50.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 18 Mar 2025 20:23:55 GMT
etag: "0x8DD665ACEA9B882"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 4050
x-served-by: cache-iad-kiad7000136-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 23, 130
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: f0dce3bf6f23dcd2025fef2713b5fcfe76d27b8e
content-length: 14579
GET

https://github.githubassets.com/assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover_js-9da652f58479.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover_js-9da652f58479.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 12 Nov 2024 14:39:55 GMT
etag: "0x8DD0327E029647C"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 3573323
x-served-by: cache-iad-kiad7000023-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 8, 47909
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 284f37df48c53a407805db939ef9aa7acb5cc8f4
content-length: 3080
GET

https://github.githubassets.com/assets/vendors-node_modules_github_arianotify-polyfill_ariaNotify-polyfill_js-node_modules_github_mi-3abb8f-46b9f4874d95.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_arianotify-polyfill_ariaNotify-polyfill_js-node_modules_github_mi-3abb8f-46b9f4874d95.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 07 Mar 2025 23:05:42 GMT
etag: "0x8DD5DCC95987E6D"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 517959
x-served-by: cache-iad-kcgs7200051-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 71, 16329
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 74b671c934f4e78f53a3cfe237243a16ff172c2b
content-length: 3695
GET

https://github.githubassets.com/assets/ui_packages_failbot_failbot_ts-857611aed7fe.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/ui_packages_failbot_failbot_ts-857611aed7fe.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 17:29:27 GMT
etag: "0x8DD631DC5862072"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 352869
x-served-by: cache-iad-kiad7000102-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 32, 11177
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 36e2950301e98725cdaeed865aabf8a4e4397fb6
content-length: 4853
GET

https://github.githubassets.com/assets/environment-f04cb2a9fc8c.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/environment-f04cb2a9fc8c.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 12 Feb 2025 21:20:53 GMT
etag: "0x8DD4BAB21C35645"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 2792983
x-served-by: cache-iad-kiad7000150-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 49499
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: ab9a2ce6d20773a59a13b7630d0b1e3a7ab703b2
content-length: 783
GET

https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_index_mjs-0dbb79f97f8f.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_primer_behaviors_dist_esm_index_mjs-0dbb79f97f8f.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 03 Jan 2025 21:10:51 GMT
etag: "0x8DD2C3B1AB7B5CF"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 4761405
x-served-by: cache-iad-kjyo7100116-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 33, 48662
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 984804428d92604d312b48eef4ff86d27456b87d
content-length: 5794
GET

https://github.githubassets.com/assets/vendors-node_modules_github_selector-observer_dist_index_esm_js-f690fd9ae3d5.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_selector-observer_dist_index_esm_js-f690fd9ae3d5.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Thu, 13 Mar 2025 05:22:50 GMT
etag: "0x8DD61EF19738E21"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 58360
x-served-by: cache-iad-kiad7000134-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 39, 4337
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 953cbbe423710c366cc1e86ce710b5877d12c6ea
content-length: 4704
GET

https://github.githubassets.com/assets/vendors-node_modules_github_relative-time-element_dist_index_js-62d275b7ddd9.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_relative-time-element_dist_index_js-62d275b7ddd9.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Thu, 08 Aug 2024 18:12:13 GMT
etag: "0x8DCB7D5A12F8D41"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 5395447
x-served-by: cache-iad-kiad7000168-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 5, 47874
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: dda6db4a43acfcf03252826665af5ed73dbcff0c
content-length: 3284
GET

https://github.githubassets.com/assets/vendors-node_modules_github_text-expander-element_dist_index_js-78748950cb0c.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_text-expander-element_dist_index_js-78748950cb0c.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 12 Nov 2024 00:52:41 GMT
etag: "0x8DD02B4500C5DFD"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 5398451
x-served-by: cache-iad-kiad7000164-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 22, 48191
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 7a9166b5df98acd4091150190240c1cb83946ad3
content-length: 4311
GET

https://github.githubassets.com/assets/vendors-node_modules_github_auto-complete-element_dist_index_js-node_modules_github_catalyst_-8e9f78-a90ac05d2469.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_auto-complete-element_dist_index_js-node_modules_github_catalyst_-8e9f78-a90ac05d2469.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 11 Mar 2025 02:46:42 GMT
etag: "0x8DD6046F4852561"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 15658
x-served-by: cache-iad-kiad7000085-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 97, 677
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: d3bb4a66357d23854d34582f9d5d9dd74cf4023b
content-length: 6810
GET

https://github.githubassets.com/assets/vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-b5f1d7-a1760ffda83d.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-b5f1d7-a1760ffda83d.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Mon, 25 Nov 2024 15:32:27 GMT
etag: "0x8DD0D665E0F9ED8"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 4297371
x-served-by: cache-iad-kcgs7200078-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 15, 48310
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 028f0a2fb63c37112ddf313d8bf3e3e83ca246f8
content-length: 5379
GET

https://github.githubassets.com/assets/vendors-node_modules_github_markdown-toolbar-element_dist_index_js-ceef33f593fa.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_markdown-toolbar-element_dist_index_js-ceef33f593fa.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 11 Mar 2025 23:23:08 GMT
etag: "0x8DD60F3AEDDF29A"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 15659
x-served-by: cache-iad-kiad7000026-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 97, 687
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 4b410d2589a644eadfd712c5aac57a1221ec41c4
content-length: 27648
GET

https://github.githubassets.com/assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_primer_view-co-c44a69-8c52cf4cd0d3.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_primer_view-co-c44a69-8c52cf4cd0d3.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 10 Dec 2024 19:56:20 GMT
etag: "0x8DD1954B7817C15"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 4272804
x-served-by: cache-iad-kjyo7100066-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 19, 48310
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: c92cf60698e40767f75af26d7b4fa94b59a8f8f4
content-length: 3683
GET

https://github.githubassets.com/assets/github-elements-394f8eb34f19.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/github-elements-394f8eb34f19.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 19:47:28 GMT
etag: "0x8DD63310D31F486"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 66036
x-served-by: cache-iad-kjyo7100171-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 90, 4513
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 4202dc934b7d798f56da6f1453b03b4306ed50d5
content-length: 6915
GET

https://github.githubassets.com/assets/element-registry-469992787dba.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/element-registry-469992787dba.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Mon, 24 Feb 2025 18:43:20 GMT
etag: "0x8DD55031C53893A"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1890944
x-served-by: cache-iad-kiad7000146-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 81, 53540
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 376b251df8cf6262ee10260ba4e07078eb0a0143
content-length: 3112
GET

https://github.githubassets.com/assets/vendors-node_modules_braintree_browser-detection_dist_browser-detection_js-node_modules_githu-bb80ec-72267f4e3ff9.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_braintree_browser-detection_dist_browser-detection_js-node_modules_githu-bb80ec-72267f4e3ff9.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 18 Mar 2025 18:30:08 GMT
etag: "0x8DD664AE935D109"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 11536
x-served-by: cache-iad-kjyo7100058-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 20, 507
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: fa03759f8fbee0e0ecceffee20e97450047bb587
content-length: 61558
GET

https://github.githubassets.com/assets/vendors-node_modules_lit-html_lit-html_js-be8cb88f481b.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_lit-html_lit-html_js-be8cb88f481b.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 17:47:06 GMT
etag: "0x8DD63203CFB9E5C"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 352869
x-served-by: cache-iad-kcgs7200076-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 32, 11265
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 2c69337abc9fc9b713efb331019986f449854ac8
content-length: 9613
GET

https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_morphdom_dist_morphdom-e-7c534c-a4a1922eb55f.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_morphdom_dist_morphdom-e-7c534c-a4a1922eb55f.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 18 Mar 2025 17:55:58 GMT
etag: "0x8DD664623956F70"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 7788
x-served-by: cache-iad-kcgs7200047-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 41, 302
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 899a0a9800b5146562a74ff0010d0103de69c283
content-length: 8089
GET

https://github.githubassets.com/assets/vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-a03ee12d659a.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-a03ee12d659a.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 15 Jan 2025 21:47:51 GMT
etag: "0x8DD35AE42915564"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 4285356
x-served-by: cache-iad-kcgs7200062-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 26, 49884
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: b63b14cdd32a765efdf4625151e03d8e94f44371
content-length: 4972
GET

https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-893f9f-6cf3320416b8.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-893f9f-6cf3320416b8.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 12 Nov 2024 00:52:41 GMT
etag: "0x8DD02B4500E579D"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 4272805
x-served-by: cache-iad-kjyo7100066-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 48285
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 20af98dddd171c4af6fdd15f1bf5c38cad1b2515
content-length: 3918
GET

https://github.githubassets.com/assets/vendors-node_modules_color-convert_index_js-e3180fe3bcb3.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_color-convert_index_js-e3180fe3bcb3.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 28 Jan 2025 01:30:47 GMT
etag: "0x8DD3F3B64406EA2"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 4171722
x-served-by: cache-iad-kjyo7100087-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 10, 49550
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 020d54b493be48a29965617b508cfb03866d6946
content-length: 16517
GET

https://github.githubassets.com/assets/vendors-node_modules_github_quote-selection_dist_index_js-node_modules_github_session-resume_-69cfcc-b9c76c3f220a.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_quote-selection_dist_index_js-node_modules_github_session-resume_-69cfcc-b9c76c3f220a.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 17:29:27 GMT
etag: "0x8DD631DC5B36648"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 352869
x-served-by: cache-iad-kjyo7100064-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 32, 11459
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: c2c326f040f46e4ebfad284ad463407b3dbebf61
content-length: 5123
GET

https://github.githubassets.com/assets/ui_packages_updatable-content_updatable-content_ts-2a55124d5c52.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/ui_packages_updatable-content_updatable-content_ts-2a55124d5c52.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 12 Nov 2024 00:52:41 GMT
etag: "0x8DD02B44FAF168F"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 2472066
x-served-by: cache-iad-kiad7000037-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 5, 48330
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: d80ed08dbc6858c8baf2a6b724fc36971de57360
content-length: 2385
GET

https://github.githubassets.com/assets/app_assets_modules_github_behaviors_task-list_ts-app_assets_modules_github_sso_ts-ui_packages-900dde-768abe60b1f8.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/app_assets_modules_github_behaviors_task-list_ts-app_assets_modules_github_sso_ts-ui_packages-900dde-768abe60b1f8.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 21:43:23 GMT
etag: "0x8DD63413E9D2A2F"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 11536
x-served-by: cache-iad-kiad7000037-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 20, 503
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 24618477d31954a3b62946574af208d33e185609
content-length: 18654
GET

https://github.githubassets.com/assets/app_assets_modules_github_sticky-scroll-into-view_ts-3e000c5d31a9.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/app_assets_modules_github_sticky-scroll-into-view_ts-3e000c5d31a9.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Thu, 08 Aug 2024 18:12:13 GMT
etag: "0x8DCB7D5A12F3F7D"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 4868061
x-served-by: cache-iad-kcgs7200153-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 48292
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 0561925951dbec86aaa8e0126aa8e229ab9443f2
content-length: 3816
GET

https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-87a4ae-c8be3927cda8.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-87a4ae-c8be3927cda8.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Mon, 24 Feb 2025 18:43:21 GMT
etag: "0x8DD55031CA06860"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1890944
x-served-by: cache-iad-kiad7000106-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 82, 53714
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 4d6aa3c74ecc088933afad823d55dcb9360f98b5
content-length: 3363
GET

https://github.githubassets.com/assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-e429cff6ceb1.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-e429cff6ceb1.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 12 Nov 2024 00:52:40 GMT
etag: "0x8DD02B44F3EF886"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 4889786
x-served-by: cache-iad-kcgs7200145-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 48501
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: ed8b00eb5014cfe122851482169b49b52a4f742a
content-length: 4851
GET

https://github.githubassets.com/assets/behaviors-b90baffc54d6.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/behaviors-b90baffc54d6.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 17:29:27 GMT
etag: "0x8DD631DC5B55FCF"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 352869
x-served-by: cache-iad-kjyo7100077-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 32, 11340
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 4cb403e176c8a540d5ebc9cb36fda0b0e6b3f0c6
content-length: 19246
GET

https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-f6223d90c7ba.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-f6223d90c7ba.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 05 Mar 2025 20:20:04 GMT
etag: "0x8DD5C231DC98B21"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1114779
x-served-by: cache-iad-kjyo7100096-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 135, 33701
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 73937c51f55af44222b8a3dc6aee0b98afbf0f3e
content-length: 3409
GET

https://github.githubassets.com/assets/notifications-global-01e85cd1be94.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/notifications-global-01e85cd1be94.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 05 Mar 2025 20:19:48 GMT
etag: "0x8DD5C23140C73E2"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1114779
x-served-by: cache-iad-kcgs7200084-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 135, 33535
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 96225b1eeb0d6f1d87f7aeb6af923dc37edeee9b
content-length: 4510
GET

https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_github_catalyst_lib_inde-dbbea9-26cce2010167.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_github_catalyst_lib_inde-dbbea9-26cce2010167.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 05 Mar 2025 23:32:18 GMT
etag: "0x8DD5C3DF81AF6EC"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 537543
x-served-by: cache-iad-kcgs7200102-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 49, 5640
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 7709128fa02229543229c7d2cde0eb6fdb832891
content-length: 5703
GET

https://github.githubassets.com/assets/code-menu-1c0aedc134b1.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/code-menu-1c0aedc134b1.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Mon, 10 Mar 2025 21:10:47 GMT
etag: "0x8DD6018079A3B47"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 540008
x-served-by: cache-iad-kcgs7200054-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 29, 10800
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 69c0fe2d85d0448f921b9aa0e05636b1c96defa9
content-length: 2442
GET

https://github.githubassets.com/assets/primer-react-c193b47d6fcb.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/primer-react-c193b47d6fcb.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 12 Feb 2025 21:20:49 GMT
etag: "0x8DD4BAB1F42AF08"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 2792983
x-served-by: cache-iad-kiad7000068-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 44212
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 11314974d86c775438c6b77097fc573b99776f8e
content-length: 5570
GET

https://github.githubassets.com/assets/react-core-8d75451d837a.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/react-core-8d75451d837a.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 18 Mar 2025 18:30:15 GMT
etag: "0x8DD664AEDAF4B89"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 11527
x-served-by: cache-iad-kjyo7100095-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 10, 147
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 83a8da028113125990a64529234b9cbc6ff636af
content-length: 70277
GET

https://github.githubassets.com/assets/react-lib-f1bca44e0926.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/react-lib-f1bca44e0926.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Thu, 27 Feb 2025 14:26:12 GMT
etag: "0x8DD573AAFCBC505"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1634252
x-served-by: cache-iad-kjyo7100115-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 43, 47200
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 4bd510c1412996688f7245cf7d7afe5cde46f4a2
content-length: 6337
GET

https://github.githubassets.com/assets/octicons-react-611691cca2f6.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/octicons-react-611691cca2f6.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Thu, 20 Feb 2025 22:50:49 GMT
etag: "0x8DD52010547BC29"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 2178422
x-served-by: cache-iad-kiad7000091-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 2730, 43849
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 29d4aa5f6fd7c85d0974f874b805499b58489718
content-length: 5322
GET

https://github.githubassets.com/assets/vendors-node_modules_emotion_is-prop-valid_dist_emotion-is-prop-valid_esm_js-node_modules_emo-62da9f-2df2f32ec596.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_emotion_is-prop-valid_dist_emotion-is-prop-valid_esm_js-node_modules_emo-62da9f-2df2f32ec596.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Mon, 24 Feb 2025 18:43:37 GMT
etag: "0x8DD5503266F0C88"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1890539
x-served-by: cache-iad-kjyo7100164-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 31, 44913
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: a95e413e29bb2da7076d78fc7ae222304896afb6
content-length: 4156
GET

https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_stacktrace-parser_dist_s-e7dcdd-9a233856b02c.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_stacktrace-parser_dist_s-e7dcdd-9a233856b02c.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 19 Nov 2024 17:47:26 GMT
etag: "0x8DD08C23B22EDF8"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 2462594
x-served-by: cache-iad-kiad7000141-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 31, 48489
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: b37367820f6fc03a34de9de8a5e146af8f0710b6
content-length: 4143
GET

https://github.githubassets.com/assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover-fn_js-55fea94174bf.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover-fn_js-55fea94174bf.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 21 Feb 2025 22:10:49 GMT
etag: "0x8DD52C49957C2F5"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1890944
x-served-by: cache-iad-kjyo7100035-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 41, 33931
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: ebb9c3ff6445a76d201fd20cb580b4337576a547
content-length: 3532
GET

https://github.githubassets.com/assets/vendors-node_modules_dompurify_dist_purify_es_mjs-dd1d3ea6a436.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_dompurify_dist_purify_es_mjs-dd1d3ea6a436.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Mon, 24 Feb 2025 18:43:33 GMT
etag: "0x8DD55032404E23B"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1890944
x-served-by: cache-iad-kiad7000020-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 82, 53788
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: efb5f7006c24fc4481845bc8948d8f2d816f87bd
content-length: 3083
GET

https://github.githubassets.com/assets/vendors-node_modules_lodash-es__Stack_js-node_modules_lodash-es__Uint8Array_js-node_modules_l-4faaa6-4a736fde5c2f.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_lodash-es__Stack_js-node_modules_lodash-es__Uint8Array_js-node_modules_l-4faaa6-4a736fde5c2f.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 07 Jan 2025 20:44:44 GMT
etag: "0x8DD2F5C1DF89D77"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 4263394
x-served-by: cache-iad-kiad7000074-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 30, 50875
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 5d32c22d42bd9da7c409fb130e430bd40a9a02fc
content-length: 90082
GET

https://github.githubassets.com/assets/vendors-node_modules_lodash-es__baseIsEqual_js-8929eb9718d5.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_lodash-es__baseIsEqual_js-8929eb9718d5.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 18 Mar 2025 18:30:15 GMT
etag: "0x8DD664AEDB70B01"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 11536
x-served-by: cache-iad-kiad7000104-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 20, 509
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 06b1da2d0b93f2d349f38bc217f830388a5d506f
content-length: 46476
GET

https://github.githubassets.com/assets/vendors-node_modules_react-intersection-observer_react-intersection-observer_modern_mjs-node_-b27033-ba82cef135e3.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_react-intersection-observer_react-intersection-observer_modern_mjs-node_-b27033-ba82cef135e3.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 12 Feb 2025 21:20:56 GMT
etag: "0x8DD4BAB23D5B1F6"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 2792983
x-served-by: cache-iad-kjyo7100091-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 51476
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: e20206df4eec96db13192ee406ffbcc20b4cf75d
content-length: 56524
GET

https://github.githubassets.com/assets/vendors-node_modules_github_hydro-analytics-client_dist_analytics-client_js-node_modules_gith-23d21c-98fe23e2e322.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_hydro-analytics-client_dist_analytics-client_js-node_modules_gith-23d21c-98fe23e2e322.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Mon, 10 Mar 2025 17:19:19 GMT
etag: "0x8DD5FF7B138D824"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 440243
x-served-by: cache-iad-kjyo7100033-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 95, 14062
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: c3c466b9ba22a1a08b93916390479f07faadc987
content-length: 112652
GET

https://github.githubassets.com/assets/ui_packages_aria-live_aria-live_ts-ui_packages_promise-with-resolvers-polyfill_promise-with-r-17c672-34345cb18aac.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/ui_packages_aria-live_aria-live_ts-ui_packages_promise-with-resolvers-polyfill_promise-with-r-17c672-34345cb18aac.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Mon, 25 Nov 2024 15:32:27 GMT
etag: "0x8DD0D665E7C17D4"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 4282170
x-served-by: cache-iad-kcgs7200094-IAD, cache-lcy-eglc8600034-LCY
x-cache: MISS, HIT
x-cache-hits: 0, 30229
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 68435bfd75dd26be6483577b32840164b31f1811
content-length: 2646
GET

https://github.githubassets.com/assets/ui_packages_paths_index_ts-9300589383c3.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/ui_packages_paths_index_ts-9300589383c3.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 28 Feb 2025 16:44:21 GMT
etag: "0x8DD581726D218CC"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1099158
x-served-by: cache-iad-kiad7000063-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 77, 24672
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 2a8866c8b57626654f816890a68c286459eb1a96
content-length: 5552
GET

https://github.githubassets.com/assets/ui_packages_ref-selector_RefSelector_tsx-7496afc3784d.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/ui_packages_ref-selector_RefSelector_tsx-7496afc3784d.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 19 Feb 2025 17:02:34 GMT
etag: "0x8DD510734B3091A"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 2338392
x-served-by: cache-iad-kjyo7100158-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 46, 31257
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: c30eb88e42e19e7063077433b7e4090f4c262634
content-length: 6468
GET

https://github.githubassets.com/assets/ui_packages_commit-attribution_index_ts-ui_packages_commit-checks-status_index_ts-ui_packages-7094d4-15017f02e61c.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/ui_packages_commit-attribution_index_ts-ui_packages_commit-checks-status_index_ts-ui_packages-7094d4-15017f02e61c.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Thu, 13 Mar 2025 15:43:50 GMT
etag: "0x8DD6245D9FBB4C0"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 116063
x-served-by: cache-iad-kjyo7100083-IAD, cache-lcy-eglc8600034-LCY
x-cache: MISS, HIT
x-cache-hits: 0, 1397
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: db0dd42cf37775e07b38e598b784ddc678c44030
content-length: 3067
GET

https://github.githubassets.com/assets/ui_packages_diffs_diff-parts_ts-b05d9274ce63.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/ui_packages_diffs_diff-parts_ts-b05d9274ce63.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 10:08:09 GMT
etag: "0x8DD62E01F926FA5"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 391602
x-served-by: cache-iad-kjyo7100098-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 12296
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: e1a04379967c4db8c7b144b5645b2a3c01609991
content-length: 7292
GET

https://github.githubassets.com/assets/ui_packages_code-view-shared_hooks_shortcuts_ts-ui_packages_code-view-shared_utilities_styles-0dc246-f8753c5db08d.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/ui_packages_code-view-shared_hooks_shortcuts_ts-ui_packages_code-view-shared_utilities_styles-0dc246-f8753c5db08d.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Thu, 27 Feb 2025 14:26:15 GMT
etag: "0x8DD573AB1A5ED59"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1634252
x-served-by: cache-iad-kjyo7100051-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 54, 36487
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: e339eaf59acee2d9658f17ff392cabf682bea6d7
content-length: 3388
GET

https://github.githubassets.com/assets/ui_packages_app-uuid_app-uuid_ts-ui_packages_document-metadata_document-metadata_ts-ui_packag-4d8de9-59f6285388bd.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/ui_packages_app-uuid_app-uuid_ts-ui_packages_document-metadata_document-metadata_ts-ui_packag-4d8de9-59f6285388bd.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 14 Jan 2025 20:31:31 GMT
etag: "0x8DD34DA6E0E2A39"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 4125928
x-served-by: cache-iad-kiad7000090-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 37, 23723
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 97f1592f8229972938b67d06cacc22b195c60720
content-length: 2138
GET

https://github.githubassets.com/assets/ui_packages_code-view-shared_hooks_use-canonical-object_ts-ui_packages_code-view-shared_hooks-a83ec0-5ee2b562b57f.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/ui_packages_code-view-shared_hooks_use-canonical-object_ts-ui_packages_code-view-shared_hooks-a83ec0-5ee2b562b57f.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 12 Mar 2025 21:22:11 GMT
etag: "0x8DD61ABF3F5C59A"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 440237
x-served-by: cache-iad-kcgs7200114-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 56, 9085
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: a27e2decc0af1091d36eb1f4567faddd4a811ab8
content-length: 7510
GET

https://github.githubassets.com/assets/app_assets_modules_github_blob-anchor_ts-ui_packages_code-nav_code-nav_ts-ui_packages_filter--8253c1-91468a3354f9.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/app_assets_modules_github_blob-anchor_ts-ui_packages_code-nav_code-nav_ts-ui_packages_filter--8253c1-91468a3354f9.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 13:41:37 GMT
etag: "0x8DD62FDF1AC89D7"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 376706
x-served-by: cache-iad-kjyo7100023-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 23, 7928
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 32cb10deaa6a5a332c0911d9b8e4ae81435c6e6d
content-length: 14921
GET

https://github.githubassets.com/assets/react-code-view-98cc4e50e73a.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/react-code-view-98cc4e50e73a.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Thu, 13 Mar 2025 15:43:50 GMT
etag: "0x8DD6245D9D78C8B"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 116062
x-served-by: cache-iad-kiad7000150-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 18, 2522
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 5bb593ce5dad671774f77074711ec9a5de60c1b9
content-length: 3857
GET

https://github.githubassets.com/assets/notifications-subscriptions-menu-58a0c58bfee4.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/notifications-subscriptions-menu-58a0c58bfee4.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Mon, 17 Mar 2025 21:35:04 GMT
etag: "0x8DD659B94DD050D"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 11527
x-served-by: cache-iad-kiad7000038-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 11, 145
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 61fe84ec10c7111b095611f50f5d60463383d737
content-length: 15275
GET

https://github.githubassets.com/assets/ui_packages_ui-commands_ui-commands_ts-97496b0f52ba.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/ui_packages_ui-commands_ui-commands_ts-97496b0f52ba.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 19 Feb 2025 16:42:14 GMT
etag: "0x8DD51045DA82210"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 2286628
x-served-by: cache-iad-kcgs7200128-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 5, 51605
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 64a5bf70ce437a45ef9de0e334b662f5204832bb
content-length: 6524
GET

https://github.githubassets.com/assets/keyboard-shortcuts-dialog-ac448fe050d6.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/keyboard-shortcuts-dialog-ac448fe050d6.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Mon, 16 Sep 2024 23:19:54 GMT
etag: "0x8DCD6A6128E8C4A"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 2459535
x-served-by: cache-iad-kiad7000157-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 49, 23384
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: dc7cab7a542e8449a5e1e13758394a38b3cc13b5
content-length: 2209
GET

https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd67-56e2d9924e94.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd67-56e2d9924e94.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 12 Nov 2024 14:39:55 GMT
etag: "0x8DD0327E025E5FB"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 3071660
x-served-by: cache-iad-kcgs7200172-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 31, 48559
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 8c37c6b2a42912940fa3da60dd2bf2d6b63170ec
content-length: 3077
GET

https://github.githubassets.com/assets/sessions-730dca81d0a2.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/sessions-730dca81d0a2.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 18 Feb 2025 12:21:19 GMT
etag: "0x8DD5016BFEDEAE3"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:24 GMT
age: 1661900
x-served-by: cache-iad-kcgs7200153-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 32, 35743
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 6eaedc8230a184d70b3b48d4e83419801026e550
content-length: 8171
GET

https://github.githubassets.com/assets/chunk-app_components_primer_experimental_select-panel-element_ts-dbc875e76b97.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/chunk-app_components_primer_experimental_select-panel-element_ts-dbc875e76b97.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 12 Feb 2025 21:20:51 GMT
etag: "0x8DD4BAB206F2F47"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:25 GMT
age: 2792983
x-served-by: cache-iad-kjyo7100175-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 47232
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 4d6c53976a16a0038971da3fbad1071f192808b8
content-length: 544
GET

https://github.githubassets.com/assets/chunk-app_components_primer_experimental_toggle-switch-element_ts-670c71d392c6.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/chunk-app_components_primer_experimental_toggle-switch-element_ts-670c71d392c6.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Thu, 13 Feb 2025 15:14:49 GMT
etag: "0x8DD4C4128E82E39"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:25 GMT
age: 2792983
x-served-by: cache-iad-kjyo7100044-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 47795
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 83c4411c659c3832f9363cb638c29f2b40252cd2
content-length: 7780
GET

https://github.githubassets.com/assets/chunk-app_components_search_custom-scopes-element_ts-abc100eaa2cb.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/chunk-app_components_search_custom-scopes-element_ts-abc100eaa2cb.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 12 Feb 2025 21:20:51 GMT
etag: "0x8DD4BAB2073226E"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:25 GMT
age: 2792982
x-served-by: cache-iad-kcgs7200119-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 43844
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: a52fe1c191b61da2916a48d8b0114f958bc28e1f
content-length: 4101
GET

https://github.githubassets.com/assets/chunk-vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_github_combobox-nav_dist-b7767a-9ad7d4eda3d9.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/chunk-vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_github_combobox-nav_dist-b7767a-9ad7d4eda3d9.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 06 Dec 2024 19:19:22 GMT
etag: "0x8DD162AE3C55516"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:25 GMT
age: 7730082
x-served-by: cache-iad-kiad7000044-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 13, 42537
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: dc1eccf4ef7130b00d5f2339556833cd0b298b1d
content-length: 6323
GET

https://github.githubassets.com/assets/ui_packages_query-builder-element_query-builder-element_ts-b492d6900d5e.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/ui_packages_query-builder-element_query-builder-element_ts-b492d6900d5e.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 07 Mar 2025 02:09:02 GMT
etag: "0x8DD5D1D07C1610E"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:25 GMT
age: 976282
x-served-by: cache-iad-kcgs7200022-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 25071
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 3897a30b66166498b7387b31bba431a2bb05bed6
content-length: 7505
GET

https://github.githubassets.com/assets/chunk-ui_packages_hydro-analytics_hydro-analytics_ts-ui_packages_jump-to-element_model_ts-880f27a93f7b.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/chunk-ui_packages_hydro-analytics_hydro-analytics_ts-ui_packages_jump-to-element_model_ts-880f27a93f7b.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Thu, 13 Feb 2025 15:14:50 GMT
etag: "0x8DD4C41292E5E2A"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:25 GMT
age: 2792982
x-served-by: cache-iad-kjyo7100100-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 43724
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 62270c142cf6c611311c28bf82505243338f050c
content-length: 4438
GET

https://github.githubassets.com/assets/chunk-app_components_search_qbsearch-input-element_ts-cf531d29cf91.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/chunk-app_components_search_qbsearch-input-element_ts-cf531d29cf91.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Mon, 10 Mar 2025 20:02:55 GMT
etag: "0x8DD600E8BF8D0F4"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:25 GMT
age: 613231
x-served-by: cache-iad-kcgs7200120-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 14, 17250
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 62302a98e28bafb510c96968fd52243b55d76dcd
content-length: 17020
GET

https://github.githubassets.com/assets/chunk-ui_packages_cookie-consent-link-element_element-entry_ts-8ca582ddd98a.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/chunk-ui_packages_cookie-consent-link-element_element-entry_ts-8ca582ddd98a.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 12 Feb 2025 21:20:51 GMT
etag: "0x8DD4BAB20A937F6"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:25 GMT
age: 2792983
x-served-by: cache-iad-kcgs7200107-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 46398
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 888efd8ebf1ed017872a4f504fd3786ada40f61e
content-length: 2913
GET

https://github.githubassets.com/assets/chunk-ui_packages_ghcc-consent-element_element-entry_ts-04338159da93.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/chunk-ui_packages_ghcc-consent-element_element-entry_ts-04338159da93.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 12 Feb 2025 21:20:51 GMT
etag: "0x8DD4BAB20A91111"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:25 GMT
age: 2792983
x-served-by: cache-iad-kiad7000059-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 46704
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 5be835f49b9ebf28d3259633a76d5f2af1df3b9a
content-length: 3160
GET

https://github.githubassets.com/assets/chunk-vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_github_combobox-nav_dist-5f477b-eeb221e8a5a3.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/chunk-vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_github_combobox-nav_dist-5f477b-eeb221e8a5a3.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Fri, 06 Dec 2024 19:19:22 GMT
etag: "0x8DD162AE3BAD98C"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:25 GMT
age: 4287852
x-served-by: cache-iad-kiad7000114-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 13, 42440
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 2ae6f60974deb68a2611019a01e3af20e50a5bae
content-length: 5020
GET

https://github.githubassets.com/assets/chunk-ui_packages_hydro-analytics_hydro-analytics_ts-ui_packages_query-builder-element_element-entry_ts-37a12a0ee62c.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/chunk-ui_packages_hydro-analytics_hydro-analytics_ts-ui_packages_query-builder-element_element-entry_ts-37a12a0ee62c.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Thu, 13 Feb 2025 15:14:50 GMT
etag: "0x8DD4C41292FE316"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:25 GMT
age: 2097221
x-served-by: cache-iad-kcgs7200097-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 43579
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: d6b9e9445e81c3695bac3417f2049ee5c1cecd7b
content-length: 2521
GET

https://github.githubassets.com/assets/chunk-ui_packages_webauthn-get-element_element-entry_ts-c4e5a9b4f95a.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/chunk-ui_packages_webauthn-get-element_element-entry_ts-c4e5a9b4f95a.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Wed, 12 Feb 2025 21:20:51 GMT
etag: "0x8DD4BAB20C138E3"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:25 GMT
age: 2792984
x-served-by: cache-iad-kiad7000148-IAD, cache-lcy-eglc8600034-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 46840
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 1e29c12e9c7ccd7be52d42ce3b93c05eb267c68d
content-length: 2844
DNS

user-images.githubusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

user-images.githubusercontent.com

IN A

Response

user-images.githubusercontent.com

IN A

185.199.108.133

user-images.githubusercontent.com

IN A

185.199.110.133

user-images.githubusercontent.com

IN A

185.199.109.133

user-images.githubusercontent.com

IN A

185.199.111.133
DNS

user-images.githubusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

user-images.githubusercontent.com

IN Unknown

Response
DNS

github-cloud.s3.amazonaws.com

msedge.exe

Remote address:

8.8.8.8:53

Request

github-cloud.s3.amazonaws.com

IN A

Response

github-cloud.s3.amazonaws.com

IN CNAME

s3-1-w.amazonaws.com

s3-1-w.amazonaws.com

IN CNAME

s3-w.us-east-1.amazonaws.com

s3-w.us-east-1.amazonaws.com

IN A

52.216.171.163

s3-w.us-east-1.amazonaws.com

IN A

52.216.152.100

s3-w.us-east-1.amazonaws.com

IN A

3.5.12.190

s3-w.us-east-1.amazonaws.com

IN A

3.5.11.194

s3-w.us-east-1.amazonaws.com

IN A

16.182.38.249

s3-w.us-east-1.amazonaws.com

IN A

16.15.216.47

s3-w.us-east-1.amazonaws.com

IN A

3.5.30.23

s3-w.us-east-1.amazonaws.com

IN A

52.217.202.73
DNS

github-cloud.s3.amazonaws.com

msedge.exe

Remote address:

8.8.8.8:53

Request

github-cloud.s3.amazonaws.com

IN Unknown

Response

github-cloud.s3.amazonaws.com

IN CNAME

s3-1-w.amazonaws.com

s3-1-w.amazonaws.com

IN CNAME

s3-w.us-east-1.amazonaws.com
GET

https://github.com/Da2dalus/The-MALWARE-Repo/security/overall-count

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/security/overall-count HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: text/fragment+html
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:25 GMT
content-type: text/fragment+html; charset=utf-8
content-length: 0
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
cache-control: max-age=14400, private
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
accept-ranges: bytes
x-github-request-id: 1097:38C8BA:819BD0:99E429:67DA015D
GET

https://github.com/Da2dalus/The-MALWARE-Repo/refs?type=branch

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/refs?type=branch HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:25 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"adc2c0d060742993a54f31416bc951e3"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 79
x-github-request-id: 1097:38C8BA:819BED:99E44A:67DA015D
GET

https://github.com/Da2dalus/The-MALWARE-Repo/latest-commit/master/Trojan/Mobile_Legends_Adventure.apk

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/latest-commit/master/Trojan/Mobile_Legends_Adventure.apk HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
github-verified-fetch: true
content-type: application/json
dnt: 1
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:25 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"5185db155c3506b14ff9569056b0e747"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 448
x-github-request-id: 1097:38C8BA:819BEE:99E44B:67DA015D
GET

https://github.com/Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Trojan/Mobile_Legends_Adventure.apk

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Trojan/Mobile_Legends_Adventure.apk HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
github-verified-fetch: true
content-type: application/json
dnt: 1
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:25 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"3b1ec0bc5e0864a5815defaffc90db22"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 181
x-github-request-id: 1097:38C8BA:819BEE:99E44C:67DA015D
DNS

collector.github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

collector.github.com

IN A

Response

collector.github.com

IN CNAME

glb-db52c2cf8be544.github.com

glb-db52c2cf8be544.github.com

IN A

140.82.114.22
DNS

collector.github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

collector.github.com

IN Unknown

Response

collector.github.com

IN CNAME

glb-db52c2cf8be544.github.com
DNS

edge.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

edge.microsoft.com

IN A

Response

edge.microsoft.com

IN CNAME

edge-domain.trafficmanager.net

edge-domain.trafficmanager.net

IN CNAME

edge-microsoft-com.dual-a-0036.a-msedge.net

edge-microsoft-com.dual-a-0036.a-msedge.net

IN CNAME

dual-a-0036.a-msedge.net

dual-a-0036.a-msedge.net

IN A

204.79.197.239

dual-a-0036.a-msedge.net

IN A

13.107.21.239
DNS

edge.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

edge.microsoft.com

IN Unknown

Response

edge.microsoft.com

IN CNAME

edge-domain.trafficmanager.net

edge-domain.trafficmanager.net

IN CNAME

edge-microsoft-com.ax-0002.ax-msedge.net
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1108
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:26 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.003242
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: 9233:3C7175:1C6C84D:22A19ED:67DA015D
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1074
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:26 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.003068
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: 9233:3C7175:1C6C85E:22A1A13:67DA015E
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 3998
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:26 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.003493
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: 9233:3C7175:1C6C864:22A1A19:67DA015E
GET

https://edge.microsoft.com/autofillservice/core/page/-4458411082827526514/-3028829078604268615%7C6406379592175567390?GroupingThreshold=60&CIdAlgoVersion=2

msedge.exe

Remote address:

204.79.197.239:443

Request

GET /autofillservice/core/page/-4458411082827526514/-3028829078604268615%7C6406379592175567390?GroupingThreshold=60&CIdAlgoVersion=2 HTTP/2.0
host: edge.microsoft.com
x-client-data: COXnygE=
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=4, i

Response

HTTP/2.0 200

cache-control: max-age=691200
content-length: 544
content-type: application/json; charset=utf-8
x-cache: TCP_HIT
x-msedge-ref: Ref A: F44B8C404CF041A799C96748BAE31A5A Ref B: FRA31EDGE0819 Ref C: 2025-03-18T23:27:25Z
date: Tue, 18 Mar 2025 23:27:25 GMT
GET

https://edge.microsoft.com/autofillservice/core/page/-4458411082827526514/6406379592175567390?GroupingThreshold=60&CIdAlgoVersion=2

msedge.exe

Remote address:

204.79.197.239:443

Request

GET /autofillservice/core/page/-4458411082827526514/6406379592175567390?GroupingThreshold=60&CIdAlgoVersion=2 HTTP/2.0
host: edge.microsoft.com
x-client-data: COXnygE=
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=4, i

Response

HTTP/2.0 200

cache-control: max-age=691200
content-length: 376
content-type: application/json; charset=utf-8
x-cache: TCP_HIT
x-msedge-ref: Ref A: 82A1C439F668472A8DC58AD3950B1105 Ref B: FRA31EDGE0819 Ref C: 2025-03-18T23:27:25Z
date: Tue, 18 Mar 2025 23:27:25 GMT
GET

https://github.githubassets.com/assets/chunk-vendors-node_modules_consent-banner_dist_consent-banner_js-362ca569b596.js

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/chunk-vendors-node_modules_consent-banner_dist_consent-banner_js-362ca569b596.js HTTP/2.0
host: github.githubassets.com
origin: https://github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: application/javascript
last-modified: Tue, 12 Nov 2024 00:52:32 GMT
etag: "0x8DD02B44AD10969"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-encoding: br
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:25 GMT
age: 1836830
x-served-by: cache-iad-kjyo7100146-IAD, cache-lcy-eglc8600097-LCY
x-cache: HIT, HIT
x-cache-hits: 1, 2323
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 0b119ff965c4acac75ebc9810adc83f19e22fd8d
content-length: 9421
GET

https://github.com/Da2dalus/The-MALWARE-Repo/refs?type=branch

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/refs?type=branch HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
if-none-match: W/"adc2c0d060742993a54f31416bc951e3"
priority: u=1, i

Response

HTTP/2.0 304

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:25 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"adc2c0d060742993a54f31416bc951e3"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
x-github-request-id: 744F:3C3CBA:80CDC5:99175B:67DA015D
GET

https://github.com/manifest.json

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /manifest.json HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: manifest
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=2

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:25 GMT
content-type: application/manifest+json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
cache-control: max-age=604800, public
etag: W/"c75e05794d72230a695e880f1a6c83a4"
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 474
x-github-request-id: 744F:3C3CBA:80CDD1:991768:67DA015D
GET

https://github.com/Da2dalus/The-MALWARE-Repo/refs?type=branch

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/refs?type=branch HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
if-none-match: W/"adc2c0d060742993a54f31416bc951e3"
priority: u=1, i

Response

HTTP/2.0 304

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:25 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"adc2c0d060742993a54f31416bc951e3"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
x-github-request-id: 744F:3C3CBA:80CDD3:99176A:67DA015E
GET

https://avatars.githubusercontent.com/u/63458929?v=4&size=40

msedge.exe

Remote address:

185.199.108.133:443

Request

GET /u/63458929?v=4&size=40 HTTP/2.0
host: avatars.githubusercontent.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
sec-fetch-storage-access: active
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=1, i

Response

HTTP/2.0 200

cache-control: max-age=300
content-security-policy: default-src 'none'
content-type: image/png
etag: "e25efc2f3c542a995df70f85198b7fd6184be4700ec9756e00c0a8fd9e7a124c"
last-modified: Mon, 16 Mar 2015 15:33:32 GMT
strict-transport-security: max-age=31557600
timing-allow-origin: https://github.com
x-content-type-options: nosniff
x-frame-options: deny
x-github-tenant:
x-xss-protection: 1; mode=block
x-github-request-id: 5A0A:146538:16C03:2BE30:67D94618
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:25 GMT
via: 1.1 varnish
x-served-by: cache-lcy-eglc8600086-LCY
x-cache: HIT
x-cache-hits: 0
x-timer: S1742340446.973231,VS0,VE1
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: bab2de9d04558856bc75fbe312a7f982dd771247
expires: Tue, 18 Mar 2025 23:32:25 GMT
source-age: 47941
vary: Authorization,Accept-Encoding
content-length: 1505
DNS

api.github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

api.github.com

IN A

Response

api.github.com

IN A

20.26.156.210
DNS

api.github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

api.github.com

IN Unknown

Response
GET

https://github.githubassets.com/favicons/favicon.svg

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /favicons/favicon.svg HTTP/2.0
host: github.githubassets.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
sec-fetch-storage-access: active
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=1, i

Response

HTTP/2.0 200

cache-control: public, max-age=31536000, immutable
content-type: image/png
content-md5: YDrNCDxuYozaAYS2sPzvIQ==
last-modified: Wed, 14 Aug 2024 19:49:39 GMT
etag: "0x8DCBC9A3C0EF02F"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:26 GMT
age: 1274666
x-served-by: cache-iad-kiad7000023-IAD, cache-lcy-eglc8600069-LCY
x-cache: HIT, HIT
x-cache-hits: 381, 716
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 2203e176e77c1ac6de77a0b68cf82f9bab080400
content-length: 14426
GET

https://github.githubassets.com/assets/apple-touch-icon-144x144-b882e354c005.png

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /assets/apple-touch-icon-144x144-b882e354c005.png HTTP/2.0
host: github.githubassets.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
sec-fetch-storage-access: active
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=1, i

Response

HTTP/2.0 200

content-type: image/svg+xml
content-md5: bYAvaN8MCaSZfP0o7q/Z/w==
last-modified: Wed, 14 Aug 2024 19:18:58 GMT
etag: "0x8DCBC95F2647EDF"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:26 GMT
age: 131
x-served-by: cache-iad-kiad7000081-IAD, cache-lcy-eglc8600069-LCY
x-cache: HIT, HIT
x-cache-hits: 882833, 1
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: cd225bb8b984f0f7fede2cba4811758e4ef98558
content-length: 959
GET

https://github.githubassets.com/favicons/favicon.png

msedge.exe

Remote address:

185.199.111.154:443

Request

GET /favicons/favicon.png HTTP/2.0
host: github.githubassets.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
sec-fetch-storage-access: active
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=1, i

Response

HTTP/2.0 200

content-type: image/png
content-md5: NG4JRxNi8pB1EKMYEhKc0g==
last-modified: Wed, 14 Aug 2024 19:18:46 GMT
etag: "0x8DCBC95EB57AC96"
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:26 GMT
age: 44
x-served-by: cache-iad-kiad7000070-IAD, cache-lcy-eglc8600069-LCY
x-cache: HIT, HIT
x-cache-hits: 4222547, 1
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-fastly-request-id: 733ff9d7e2258020f9f36e620f23a8627068ab6a
content-length: 958
POST

https://api.github.com/_private/browser/stats

msedge.exe

Remote address:

20.26.156.210:443

Request

POST /_private/browser/stats HTTP/2.0
host: api.github.com
content-length: 5407
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 200

date: Tue, 18 Mar 2025 23:27:26 GMT
content-type: text/plain
content-length: 0
cache-control: no-cache
x-ratelimit-limit: 60
x-ratelimit-remaining: 60
x-ratelimit-reset: 1742344046
x-ratelimit-used: 0
x-ratelimit-resource: core
x-github-media-type: github.v3; format=json
x-github-api-version-selected: 2022-11-28
access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'
vary: Accept-Encoding, Accept, X-Requested-With
server: github.com
x-github-request-id: FDC3:340435:48A7E4:5B3E02:67DA015E
DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A

Response

g.bing.com

IN CNAME

g-bing-com.ax-0001.ax-msedge.net

g-bing-com.ax-0001.ax-msedge.net

IN CNAME

ax-0001.ax-msedge.net

ax-0001.ax-msedge.net

IN A

150.171.27.10

ax-0001.ax-msedge.net

IN A

150.171.28.10
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0d4c7638a2a74bbfa3149156d7bd926c&localId=w:BDEEEA66-9FF9-032D-B4CB-199BE88F3227&deviceId=6896216899373042&anid=

Remote address:

150.171.27.10:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0d4c7638a2a74bbfa3149156d7bd926c&localId=w:BDEEEA66-9FF9-032D-B4CB-199BE88F3227&deviceId=6896216899373042&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=0AD4B1070011639639AAA4B4019A6230; domain=.bing.com; expires=Sun, 12-Apr-2026 23:27:26 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D9F0AEB72E154E848B097E8019566B3B Ref B: FRA31EDGE0207 Ref C: 2025-03-18T23:27:26Z
date: Tue, 18 Mar 2025 23:27:26 GMT
GET

https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0d4c7638a2a74bbfa3149156d7bd926c&localId=w:BDEEEA66-9FF9-032D-B4CB-199BE88F3227&deviceId=6896216899373042&anid=

Remote address:

150.171.27.10:443

Request

GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0d4c7638a2a74bbfa3149156d7bd926c&localId=w:BDEEEA66-9FF9-032D-B4CB-199BE88F3227&deviceId=6896216899373042&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0AD4B1070011639639AAA4B4019A6230

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=9ZkySoqS6oKifL9IPavb87e2EMO0de266G7Y53seaKk; domain=.bing.com; expires=Sun, 12-Apr-2026 23:27:26 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CD5727B6965745CC8E42FEBD6E04D40E Ref B: FRA31EDGE0207 Ref C: 2025-03-18T23:27:26Z
date: Tue, 18 Mar 2025 23:27:26 GMT
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0d4c7638a2a74bbfa3149156d7bd926c&localId=w:BDEEEA66-9FF9-032D-B4CB-199BE88F3227&deviceId=6896216899373042&anid=

Remote address:

150.171.27.10:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0d4c7638a2a74bbfa3149156d7bd926c&localId=w:BDEEEA66-9FF9-032D-B4CB-199BE88F3227&deviceId=6896216899373042&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0AD4B1070011639639AAA4B4019A6230; MSPTC=9ZkySoqS6oKifL9IPavb87e2EMO0de266G7Y53seaKk

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7B35B7C05F594D8C865A4E2CB0374107 Ref B: FRA31EDGE0207 Ref C: 2025-03-18T23:27:27Z
date: Tue, 18 Mar 2025 23:27:26 GMT
GET

https://edge.microsoft.com/extensionwebstorebase/v1/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=edgecrx&prodchannel=&prodversion=133.0.3065.69&lang=en-US&acceptformat=crx3,puff&x=id%3Djmjflgjpcpepeafmmgdpfkogkghcpiha%26v%3D1.2.1%26installedby%3Dother%26uc%26ping%3Dr%253D5%2526e%253D1

msedge.exe

Remote address:

13.107.21.239:443

Request

GET /extensionwebstorebase/v1/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=edgecrx&prodchannel=&prodversion=133.0.3065.69&lang=en-US&acceptformat=crx3,puff&x=id%3Djmjflgjpcpepeafmmgdpfkogkghcpiha%26v%3D1.2.1%26installedby%3Dother%26uc%26ping%3Dr%253D5%2526e%253D1 HTTP/2.0
host: edge.microsoft.com
edgefeatureflags: {"ExtensionUseNewStoreKeys":true,"UseHttpsForDownload":true}
update-interactivity: bg
ms-cv: q0F6JmNd7kgAha9Io2Yp1N
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=4, i

Response

HTTP/2.0 200

cache-control: public, max-age=3600
content-length: 265
content-type: application/json; charset=utf-8
x-cache: TCP_HIT
x-frame-options: sameorigin
x-msedge-ref: Ref A: 1D5E7B15BA6845C084C10F23CCED935C Ref B: FRA31EDGE0422 Ref C: 2025-03-18T23:27:28Z
date: Tue, 18 Mar 2025 23:27:28 GMT
GET

https://edge.microsoft.com/entityextractiontemplates/api/v1/assets/find-assets?name=domains_config_gz&version=3.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362

msedge.exe

Remote address:

13.107.21.239:443

Request

GET /entityextractiontemplates/api/v1/assets/find-assets?name=domains_config_gz&version=3.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/2.0
host: edge.microsoft.com
edge-asset-group: EntityExtractionDomainsConfig
sec-mesh-client-edge-version: 133.0.3065.69
sec-mesh-client-edge-channel: stable
sec-mesh-client-os: Windows
sec-mesh-client-os-version: 10.0.19041
sec-mesh-client-arch: x86_64
sec-mesh-client-webview: 0
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=4, i

Response

HTTP/2.0 200

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-length: 413
content-type: text/xml; charset=utf-8
x-cache: CONFIG_NOCACHE
x-msedge-ref: Ref A: CC0037ECF3174EA1832D47F0CFDBAA49 Ref B: FRA31EDGE0422 Ref C: 2025-03-18T23:27:28Z
date: Tue, 18 Mar 2025 23:27:28 GMT
GET

https://edge.microsoft.com/entityextractiontemplates/api/v1/assets/find-assets?name=arbitration_priority_list&version=24.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362

msedge.exe

Remote address:

13.107.21.239:443

Request

GET /entityextractiontemplates/api/v1/assets/find-assets?name=arbitration_priority_list&version=24.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/2.0
host: edge.microsoft.com
edge-asset-group: ArbitrationService
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=4, i

Response

HTTP/2.0 200

cache-control: public, max-age=3600
content-length: 266
content-type: application/json; charset=utf-8
x-cache: TCP_HIT
x-frame-options: sameorigin
x-msedge-ref: Ref A: 2E35AE0C4B664317B4263A88F77233F2 Ref B: FRA31EDGE0422 Ref C: 2025-03-18T23:27:28Z
date: Tue, 18 Mar 2025 23:27:28 GMT
GET

https://edge.microsoft.com/entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362

msedge.exe

Remote address:

13.107.21.239:443

Request

GET /entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/2.0
host: edge.microsoft.com
edge-asset-group: Shoreline
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=4, i

Response

HTTP/2.0 200

cache-control: public, max-age=3600
content-length: 271
content-type: application/json; charset=utf-8
x-cache: TCP_HIT
x-frame-options: sameorigin
x-msedge-ref: Ref A: 1B05316072164846A17E290C1EA5F2F8 Ref B: FRA31EDGE0422 Ref C: 2025-03-18T23:27:28Z
date: Tue, 18 Mar 2025 23:27:28 GMT
GET

https://www.bing.com/api/shopping/v1/user/shoppingsettings?EnabledServiceFeaturesv2=edgeServerUX.shopping.aablockth,edgeServerUX.shopping.disableCashbackOnCouponCopy,edgeServerUX.shopping.enableColdStartCohort,edgeServerUX.shopping.msEdgeShoppingCashbackDismissTimeout2s,edgeServerUX.shopping.snDataFromOS,edgeServerUX.shopping.useExpSNData

msedge.exe

Remote address:

88.221.135.26:443

Request

GET /api/shopping/v1/user/shoppingsettings?EnabledServiceFeaturesv2=edgeServerUX.shopping.aablockth,edgeServerUX.shopping.disableCashbackOnCouponCopy,edgeServerUX.shopping.enableColdStartCohort,edgeServerUX.shopping.msEdgeShoppingCashbackDismissTimeout2s,edgeServerUX.shopping.snDataFromOS,edgeServerUX.shopping.useExpSNData HTTP/2.0
host: www.bing.com
cookie: ANON=
cookie: MUID=
cookie: _RwBf=
cookie:
x-client-data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiLTY5MjMwMjcxODcxMTMzNTIzODkiLCI2Ijoic3RhYmxlIiwiOSI6ImRlc2t0b3AifQ==
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
sec-fetch-storage-access: active
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zsdch, zstd
accept-language: en-US,en;q=0.9
priority: u=4, i

Response

HTTP/2.0 200

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-type: application/json; charset=utf-8
content-encoding: br
vary: Accept-Encoding
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B79B730095D842F784AD2E02F79A3B68 Ref B: LON04EDGE0908 Ref C: 2025-03-18T23:27:28Z
date: Tue, 18 Mar 2025 23:27:28 GMT
content-length: 425
set-cookie: _EDGE_S=F=1&SID=09C35656DC326ECF0DE443E5DD896FBC; path=/; httponly; domain=bing.com
set-cookie: _EDGE_V=1; path=/; httponly; expires=Sun, 12-Apr-2026 23:27:28 GMT; domain=bing.com
set-cookie: MUID=12C2B7F1CEFF66133D81A242CF4467AA; samesite=none; path=/; secure; expires=Sun, 12-Apr-2026 23:27:28 GMT; domain=bing.com
set-cookie: MUIDB=12C2B7F1CEFF66133D81A242CF4467AA; path=/; httponly; expires=Sun, 12-Apr-2026 23:27:28 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.45367a5c.1742340448.5f8ff98
DNS

edge.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

edge.microsoft.com

IN A

Response

edge.microsoft.com

IN CNAME

edge-domain.trafficmanager.net

edge-domain.trafficmanager.net

IN CNAME

edge-microsoft-com.dual-a-0036.a-msedge.net

edge-microsoft-com.dual-a-0036.a-msedge.net

IN CNAME

dual-a-0036.a-msedge.net

dual-a-0036.a-msedge.net

IN A

204.79.197.239

dual-a-0036.a-msedge.net

IN A

13.107.21.239
DNS

edge.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

edge.microsoft.com

IN Unknown

Response

edge.microsoft.com

IN CNAME

edge-domain.trafficmanager.net

edge-domain.trafficmanager.net

IN CNAME

edge-microsoft-com.dual-a-0036.a-msedge.net
GET

https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist

msedge.exe

Remote address:

204.79.197.239:443

Request

GET /abusiveadblocking/api/v1/blocklist HTTP/2.0
host: edge.microsoft.com
if-none-match: "5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B"
sec-mesh-client-edge-version: 133.0.3065.69
sec-mesh-client-edge-channel: stable
sec-mesh-client-os: Windows
sec-mesh-client-os-version: 10.0.19041
sec-mesh-client-arch: x86_64
sec-mesh-client-webview: 0
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
sec-fetch-storage-access: active
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
priority: u=4, i

Response

HTTP/2.0 304

cache-control: public, max-age=43200
content-type: application/json; charset=utf-8
content-encoding: gzip
etag: "5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B"
vary: Accept-Encoding
x-cache: TCP_HIT
x-mesh-client-ttl: 72
strict-transport-security: max-age=0
x-msedge-ref: Ref A: ABDA4F3390364EF5A1E46B0FA17636BC Ref B: FRA31EDGE0821 Ref C: 2025-03-18T23:27:28Z
date: Tue, 18 Mar 2025 23:27:27 GMT
DNS

edgeassetservice.azureedge.net

msedge.exe

Remote address:

8.8.8.8:53

Request

edgeassetservice.azureedge.net

IN A

Response

edgeassetservice.azureedge.net

IN CNAME

edgeassetservice.afd.azureedge.net

edgeassetservice.afd.azureedge.net

IN CNAME

azureedge-t-prod.trafficmanager.net

azureedge-t-prod.trafficmanager.net

IN CNAME

shed.dual-low.s-part-0036.t-0009.t-msedge.net

shed.dual-low.s-part-0036.t-0009.t-msedge.net

IN CNAME

s-part-0036.t-0009.t-msedge.net

s-part-0036.t-0009.t-msedge.net

IN A

13.107.246.64
DNS

edgeassetservice.azureedge.net

msedge.exe

Remote address:

8.8.8.8:53

Request

edgeassetservice.azureedge.net

IN Unknown

Response

edgeassetservice.azureedge.net

IN CNAME

edgeassetservice.afd.azureedge.net

edgeassetservice.afd.azureedge.net

IN CNAME

azureedge-t-prod.trafficmanager.net

azureedge-t-prod.trafficmanager.net

IN CNAME

shed.dual-low.s-part-0036.t-0009.t-msedge.net

shed.dual-low.s-part-0036.t-0009.t-msedge.net

IN CNAME

s-part-0036.t-0009.t-msedge.net
GET

https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/24.0.4/asset?assetgroup=ArbitrationService

msedge.exe

Remote address:

13.107.246.64:443

Request

GET /assets/arbitration_priority_list/24.0.4/asset?assetgroup=ArbitrationService HTTP/2.0
host: edgeassetservice.azureedge.net
edge-asset-group: ArbitrationService
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=4, i

Response

HTTP/2.0 200

date: Tue, 18 Mar 2025 23:27:29 GMT
content-type: application/octet-stream
content-length: 20242
last-modified: Sun, 16 Mar 2025 22:10:13 GMT
etag: 0x8DD64D753397D69
x-ms-request-id: a6021f38-101e-005a-45ca-966e86000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
x-azure-ref: 20250318T232729Z-r15d84578dctg8w8hC1FRAxcvs00000005r000000000fqm6
cache-control: public, max-age=604800
x-fd-int-roxy-purgeid: 69316365
x-cache: TCP_HIT
accept-ranges: bytes
POST

https://api.github.com/_private/browser/stats

msedge.exe

Remote address:

20.26.156.210:443

Request

POST /_private/browser/stats HTTP/2.0
host: api.github.com
content-length: 148
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 200

date: Tue, 18 Mar 2025 23:27:31 GMT
content-type: text/plain
content-length: 0
cache-control: no-cache
x-ratelimit-limit: 60
x-ratelimit-remaining: 60
x-ratelimit-reset: 1742344051
x-ratelimit-used: 0
x-ratelimit-resource: core
x-github-media-type: github.v3; format=json
x-github-api-version-selected: 2022-11-28
access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'
vary: Accept-Encoding, Accept, X-Requested-With
server: github.com
x-github-request-id: F8C0:371A45:4FB80A:624F8E:67DA0163
POST

https://api.github.com/_private/browser/stats

msedge.exe

Remote address:

20.26.156.210:443

Request

POST /_private/browser/stats HTTP/2.0
host: api.github.com
content-length: 598
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 200

date: Tue, 18 Mar 2025 23:27:39 GMT
content-type: text/plain
content-length: 0
cache-control: no-cache
x-ratelimit-limit: 60
x-ratelimit-remaining: 60
x-ratelimit-reset: 1742344059
x-ratelimit-used: 0
x-ratelimit-resource: core
x-github-media-type: github.v3; format=json
x-github-api-version-selected: 2022-11-28
access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'
vary: Accept-Encoding, Accept, X-Requested-With
server: github.com
x-github-request-id: F8C0:371A45:4FBA24:625255:67DA0163
POST

https://api.github.com/_private/browser/stats

msedge.exe

Remote address:

20.26.156.210:443

Request

POST /_private/browser/stats HTTP/2.0
host: api.github.com
content-length: 1419
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 200

date: Tue, 18 Mar 2025 23:27:49 GMT
content-type: text/plain
content-length: 0
cache-control: no-cache
x-ratelimit-limit: 60
x-ratelimit-remaining: 60
x-ratelimit-reset: 1742344069
x-ratelimit-used: 0
x-ratelimit-resource: core
x-github-media-type: github.v3; format=json
x-github-api-version-selected: 2022-11-28
access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'
vary: Accept-Encoding, Accept, X-Requested-With
server: github.com
x-github-request-id: F8C0:371A45:4FBD9F:6256DE:67DA016B
POST

https://api.github.com/_private/browser/stats

msedge.exe

Remote address:

20.26.156.210:443

Request

POST /_private/browser/stats HTTP/2.0
host: api.github.com
content-length: 314
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 200

date: Tue, 18 Mar 2025 23:27:56 GMT
content-type: text/plain
content-length: 0
cache-control: no-cache
x-ratelimit-limit: 60
x-ratelimit-remaining: 60
x-ratelimit-reset: 1742344076
x-ratelimit-used: 0
x-ratelimit-resource: core
x-github-media-type: github.v3; format=json
x-github-api-version-selected: 2022-11-28
access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'
vary: Accept-Encoding, Accept, X-Requested-With
server: github.com
x-github-request-id: F8C0:371A45:4FBFDB:6259DF:67DA0175
POST

https://api.github.com/_private/browser/stats

msedge.exe

Remote address:

20.26.156.210:443

Request

POST /_private/browser/stats HTTP/2.0
host: api.github.com
content-length: 639
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 200

date: Tue, 18 Mar 2025 23:28:19 GMT
content-type: text/plain
content-length: 0
cache-control: no-cache
x-ratelimit-limit: 60
x-ratelimit-remaining: 60
x-ratelimit-reset: 1742344099
x-ratelimit-used: 0
x-ratelimit-resource: core
x-github-media-type: github.v3; format=json
x-github-api-version-selected: 2022-11-28
access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'
vary: Accept-Encoding, Accept, X-Requested-With
server: github.com
x-github-request-id: F8C0:371A45:4FC690:6262FB:67DA017C
POST

https://api.github.com/_private/browser/stats

msedge.exe

Remote address:

20.26.156.210:443

Request

POST /_private/browser/stats HTTP/2.0
host: api.github.com
content-length: 276
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 200

date: Tue, 18 Mar 2025 23:28:40 GMT
content-type: text/plain
content-length: 0
cache-control: no-cache
x-ratelimit-limit: 60
x-ratelimit-remaining: 60
x-ratelimit-reset: 1742344120
x-ratelimit-used: 0
x-ratelimit-resource: core
x-github-media-type: github.v3; format=json
x-github-api-version-selected: 2022-11-28
access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'
vary: Accept-Encoding, Accept, X-Requested-With
server: github.com
x-github-request-id: F8C0:371A45:4FCB8F:6269FA:67DA0193
POST

https://api.github.com/_private/browser/stats

msedge.exe

Remote address:

20.26.156.210:443

Request

POST /_private/browser/stats HTTP/2.0
host: api.github.com
content-length: 317
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 200

date: Tue, 18 Mar 2025 23:28:47 GMT
content-type: text/plain
content-length: 0
cache-control: no-cache
x-ratelimit-limit: 60
x-ratelimit-remaining: 60
x-ratelimit-reset: 1742344127
x-ratelimit-used: 0
x-ratelimit-resource: core
x-github-media-type: github.v3; format=json
x-github-api-version-selected: 2022-11-28
access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'
vary: Accept-Encoding, Accept, X-Requested-With
server: github.com
x-github-request-id: F8C0:371A45:4FCD68:626C9D:67DA01A8
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 2902
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:32 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.002037
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E23D57:24591E8:67DA0164
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 2978
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:34 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.004147
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E2400D:2459585:67DA0164
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 2732
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:34 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.002368
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E24028:24595AC:67DA0166
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1176
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:39 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.002240
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E24798:245A009:67DA0166
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1039
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:39 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.002263
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E248D7:245A1CB:67DA016B
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1160
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:39 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.002015
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E248D7:245A1CC:67DA016B
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 3593
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:40 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.002837
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E248F6:245A1F9:67DA016B
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 3330
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:41 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.002550
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E24AE3:245A49B:67DA016C
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 2926
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:41 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.003032
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E24B6A:245A554:67DA016D
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 2924
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:43 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.002386
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E24E42:245A950:67DA016D
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 3331
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:44 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.005205
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E24F4F:245AAD7:67DA016F
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 2922
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:46 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.128816
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E25158:245ADAE:67DA0170
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1272
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:50 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.001941
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E2583E:245B761:67DA0172
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1129
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:51 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.002387
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E258F6:245B83D:67DA0176
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1140
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:51 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.003328
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E25901:245B852:67DA0177
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 3617
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:51 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.033597
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E25918:245B877:67DA0177
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1308
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:27:54 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.001923
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E25D01:245BDBE:67DA0177
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 2911
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:28:19 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.003107
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E2819D:245F13D:67DA017A
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 2977
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:28:40 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.132124
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E29E8A:24619EE:67DA0193
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1257
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:28:41 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.003499
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E29F1C:2461AC5:67DA01A8
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1159
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:28:42 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.003022
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E2A0B6:2461CFA:67DA01A9
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1149
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:28:42 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.003803
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E2A0B9:2461CFD:67DA01AA
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 2769
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:28:42 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.002463
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E2A0D0:2461D15:67DA01AA
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1292
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:28:45 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.002189
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E2A56C:2462394:67DA01AA
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 2762
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:28:59 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.002558
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E2B94D:2463F41:67DA01AD
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1241
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:29:27 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.003082
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E2E235:2467857:67DA01BB
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1148
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:29:28 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.003059
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E2E2B1:246790B:67DA01D7
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1137
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:29:28 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.003460
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E2E2B3:2467910:67DA01D8
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 2845
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:29:28 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.002215
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E2E2BC:2467921:67DA01D8
POST

https://collector.github.com/github/collect

msedge.exe

Remote address:

140.82.114.22:443

Request

POST /github/collect HTTP/2.0
host: collector.github.com
content-length: 1276
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 204

date: Tue, 18 Mar 2025 23:29:30 GMT
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache
x-runtime: 0.003513
strict-transport-security: max-age=631138519
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-github-backend: Kubernetes
x-github-request-id: F8A5:2FEE5:1E2E5A0:2467D28:67DA01D8
GET

https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/tree/master/Ransomware HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-react-router: json
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
dnt: 1
x-github-target: dotcom
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:39 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"50c7df309f1f9a68e14f6e382513da26"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 1456
x-github-request-id: E476:0A0A:717C38:87A55F:67DA016B
GET

https://github.com/Da2dalus/The-MALWARE-Repo/latest-commit/master/Ransomware

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/latest-commit/master/Ransomware HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
github-verified-fetch: true
content-type: application/json
dnt: 1
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:39 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"bb234f79843f6b8448edb04cacc8b10c"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 1140
x-github-request-id: E476:0A0A:717C77:87A5AF:67DA016B
GET

https://github.com/Da2dalus/The-MALWARE-Repo/tree-commit-info/master/Ransomware

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/tree-commit-info/master/Ransomware HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
github-verified-fetch: true
content-type: application/json
dnt: 1
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:39 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"daa8cdc28e2a92e29b5b249ec65db5d2"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 442
x-github-request-id: E476:0A0A:717C77:87A5AE:67DA016B
GET

https://github.com/Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Ransomware

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Ransomware HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
github-verified-fetch: true
content-type: application/json
dnt: 1
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:39 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"3b1ec0bc5e0864a5815defaffc90db22"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 181
x-github-request-id: E476:0A0A:717C77:87A5B0:67DA016B
GET

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-react-router: json
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
dnt: 1
x-github-target: dotcom
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:51 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"9ca52382f9a853eda6bd9ef2c9f74325"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 2202
x-github-request-id: E476:0A0A:718102:87ABD8:67DA016B
GET

https://github.com/Da2dalus/The-MALWARE-Repo/latest-commit/master/Ransomware/CryptoLocker.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/latest-commit/master/Ransomware/CryptoLocker.exe HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
github-verified-fetch: true
content-type: application/json
dnt: 1
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:51 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"daa8cdc28e2a92e29b5b249ec65db5d2"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 442
x-github-request-id: E476:0A0A:718157:87AC23:67DA0176
GET

https://github.com/Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Ransomware/CryptoLocker.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Ransomware/CryptoLocker.exe HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
github-verified-fetch: true
content-type: application/json
dnt: 1
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:51 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"3b1ec0bc5e0864a5815defaffc90db22"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 181
x-github-request-id: E476:0A0A:718157:87AC25:67DA0177
GET

https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/CryptoLocker.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/CryptoLocker.exe HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
turbo-visit: true
x-react-app-name: react-code-view
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: text/html, application/xhtml+xml, application/json
dnt: 1
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 302

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:54 GMT
content-type: text/html; charset=utf-8
content-length: 0
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
access-control-allow-origin:
location: https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/CryptoLocker.exe
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
x-github-request-id: E476:0A0A:7182FF:87AE31:67DA0177
GET

https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/CryptoLocker.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/CryptoLocker.exe HTTP/2.0
host: github.com
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=0, i

Response

HTTP/2.0 302

server: GitHub.com
date: Tue, 18 Mar 2025 23:27:55 GMT
content-type: text/html; charset=utf-8
content-length: 0
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
access-control-allow-origin:
location: https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/CryptoLocker.exe
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
x-github-request-id: E476:0A0A:7183DE:87AF3C:67DA0179
GET

https://edge.microsoft.com/autofillservice/core/page/-4458411082827526514/-3028829078604268615?GroupingThreshold=60&CIdAlgoVersion=2

msedge.exe

Remote address:

204.79.197.239:443

Request

GET /autofillservice/core/page/-4458411082827526514/-3028829078604268615?GroupingThreshold=60&CIdAlgoVersion=2 HTTP/2.0
host: edge.microsoft.com
x-client-data: COXnygE=
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=4, i

Response

HTTP/2.0 200

cache-control: max-age=691200
content-length: 193
content-type: application/json; charset=utf-8
x-cache: TCP_HIT
x-msedge-ref: Ref A: 2F64B611EC9D4482B747BB1DE3AC7F9D Ref B: FRA31EDGE0420 Ref C: 2025-03-18T23:27:40Z
date: Tue, 18 Mar 2025 23:27:39 GMT
GET

https://avatars.githubusercontent.com/u/123590232?v=4&size=40

msedge.exe

Remote address:

185.199.108.133:443

Request

GET /u/123590232?v=4&size=40 HTTP/2.0
host: avatars.githubusercontent.com
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
sec-ch-ua-mobile: ?0
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
sec-fetch-storage-access: active
referer: https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=1, i

Response

HTTP/2.0 200

cache-control: max-age=300
content-security-policy: default-src 'none'
content-type: image/jpeg
etag: "7092780138ee29ef74ab07ab33208aed411686853b3bcef4814b6c7687153094"
last-modified: Thu, 20 Jul 2023 19:54:24 GMT
strict-transport-security: max-age=31557600
timing-allow-origin: https://github.com
x-content-type-options: nosniff
x-frame-options: deny
x-github-tenant:
x-xss-protection: 1; mode=block
x-github-request-id: 6DEB:118F29:44913A:992EE4:67D4897F
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:41 GMT
via: 1.1 varnish
x-served-by: cache-lon420126-LON
x-cache: HIT
x-cache-hits: 0
x-timer: S1742340462.787245,VS0,VE1
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: f84fe2aa7728c46dab04e0141d590e08e35fa880
expires: Tue, 18 Mar 2025 23:32:41 GMT
source-age: 358381
vary: Authorization,Accept-Encoding
content-length: 1014
DNS

edge-consumer-static.azureedge.net

msedge.exe

Remote address:

8.8.8.8:53

Request

edge-consumer-static.azureedge.net

IN A

Response

edge-consumer-static.azureedge.net

IN CNAME

edge-consumer-static.afd.azureedge.net

edge-consumer-static.afd.azureedge.net

IN CNAME

azureedge-t-prod.trafficmanager.net

azureedge-t-prod.trafficmanager.net

IN CNAME

shed.dual-low.s-part-0036.t-0009.t-msedge.net

shed.dual-low.s-part-0036.t-0009.t-msedge.net

IN CNAME

s-part-0036.t-0009.t-msedge.net

s-part-0036.t-0009.t-msedge.net

IN A

13.107.246.64
DNS

edge-consumer-static.azureedge.net

msedge.exe

Remote address:

8.8.8.8:53

Request

edge-consumer-static.azureedge.net

IN Unknown
GET

https://edge-consumer-static.azureedge.net/mouse-gesture/config.json

msedge.exe

Remote address:

13.107.246.64:443

Request

GET /mouse-gesture/config.json HTTP/2.0
host: edge-consumer-static.azureedge.net
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
sec-fetch-storage-access: active
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
priority: u=4, i

Response

HTTP/2.0 200

date: Tue, 18 Mar 2025 23:27:53 GMT
content-type: application/json
content-length: 101
last-modified: Tue, 24 Oct 2023 08:27:00 GMT
etag: 0x8DBD46AFE482320
x-ms-request-id: 574e6a06-701e-0065-50e6-951c33000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
x-azure-ref: 20250318T232753Z-r15d84578dcxdptjhC1FRA2w1n0000000aag000000002gb7
cache-control: public, max-age=432000
x-fd-int-roxy-purgeid: 83582882
x-cache: TCP_HIT
accept-ranges: bytes
DNS

raw.githubusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

raw.githubusercontent.com

IN A
DNS

raw.githubusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

raw.githubusercontent.com

IN Unknown
DNS

raw.githubusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

raw.githubusercontent.com

IN A

Response

raw.githubusercontent.com

IN A

185.199.110.133

raw.githubusercontent.com

IN A

185.199.108.133

raw.githubusercontent.com

IN A

185.199.109.133

raw.githubusercontent.com

IN A

185.199.111.133
DNS

raw.githubusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

raw.githubusercontent.com

IN Unknown

Response
OPTIONS

https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/CryptoLocker.exe

msedge.exe

Remote address:

185.199.110.133:443

Request

OPTIONS /Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/CryptoLocker.exe HTTP/2.0
host: raw.githubusercontent.com
accept: */*
access-control-request-method: GET
access-control-request-headers: turbo-visit,x-react-app-name
origin: https://github.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=1, i

Response

HTTP/2.0 403

cache-control: no-cache
content-type: text/html; charset=utf-8
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 0
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; img-src data:;
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:55 GMT
via: 1.1 varnish
x-served-by: cache-lcy-eglc8600075-LCY
x-cache: MISS
x-cache-hits: 0
x-timer: S1742340475.441023,VS0,VE2
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: a3823ed7b92fdf7704f24b027407a30d68d4a2c5
expires: Tue, 18 Mar 2025 23:32:55 GMT
vary: Authorization,Accept-Encoding
OPTIONS

https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/WannaCry.exe

msedge.exe

Remote address:

185.199.110.133:443

Request

OPTIONS /Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/WannaCry.exe HTTP/2.0
host: raw.githubusercontent.com
accept: */*
access-control-request-method: GET
access-control-request-headers: turbo-visit,x-react-app-name
origin: https://github.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=1, i

Response

HTTP/2.0 403

cache-control: no-cache
content-type: text/html; charset=utf-8
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 0
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; img-src data:;
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:28:45 GMT
via: 1.1 varnish
x-served-by: cache-lcy-eglc8600075-LCY
x-cache: MISS
x-cache-hits: 0
x-timer: S1742340526.662545,VS0,VE2
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: 1d408ab6174cbd3153055297326760a125a0b194
expires: Tue, 18 Mar 2025 23:33:45 GMT
vary: Authorization,Accept-Encoding
OPTIONS

https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Trojan/ColorBug.exe

msedge.exe

Remote address:

185.199.110.133:443

Request

OPTIONS /Da2dalus/The-MALWARE-Repo/refs/heads/master/Trojan/ColorBug.exe HTTP/2.0
host: raw.githubusercontent.com
accept: */*
access-control-request-method: GET
access-control-request-headers: turbo-visit,x-react-app-name
origin: https://github.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=1, i

Response

HTTP/2.0 403

cache-control: no-cache
content-type: text/html; charset=utf-8
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 0
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; img-src data:;
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:29:30 GMT
via: 1.1 varnish
x-served-by: cache-lcy-eglc8600075-LCY
x-cache: MISS
x-cache-hits: 0
x-timer: S1742340570.365069,VS0,VE2
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: a40794b47752c70013e7be3a823bd0331d466072
expires: Tue, 18 Mar 2025 23:34:30 GMT
vary: Authorization,Accept-Encoding
DNS

raw.githubusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

raw.githubusercontent.com

IN A

Response

raw.githubusercontent.com

IN A

185.199.109.133

raw.githubusercontent.com

IN A

185.199.110.133

raw.githubusercontent.com

IN A

185.199.108.133

raw.githubusercontent.com

IN A

185.199.111.133
DNS

raw.githubusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

raw.githubusercontent.com

IN Unknown

Response
GET

https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/CryptoLocker.exe

msedge.exe

Remote address:

185.199.109.133:443

Request

GET /Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/CryptoLocker.exe HTTP/2.0
host: raw.githubusercontent.com
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0, i

Response

HTTP/2.0 200

cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: application/octet-stream
etag: W/"4ba6387aded3257b082595e3a55ce5c6371897dfcda7111245c7daf072438189"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: 4C63:6457F:12B5BC:24FB59:67DA017B
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:27:56 GMT
via: 1.1 varnish
x-served-by: cache-lcy-eglc8600086-LCY
x-cache: MISS
x-cache-hits: 0
x-timer: S1742340476.879776,VS0,VE347
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: 18e5f162b56eeca5565a1a1a3b5309ea2381b9ed
expires: Tue, 18 Mar 2025 23:32:56 GMT
source-age: 0
content-length: 346112
GET

https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/WannaCry.exe

msedge.exe

Remote address:

185.199.109.133:443

Request

GET /Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/WannaCry.exe HTTP/2.0
host: raw.githubusercontent.com
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0, i

Response

HTTP/2.0 200

cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: application/octet-stream
etag: W/"8088e0474a4eb95a79a9a931cc793ed2410970e09c542098ce24b8f0be490da9"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: A6F0:146538:11F478:243EB6:67DA01AC
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:28:46 GMT
via: 1.1 varnish
x-served-by: cache-lcy-eglc8600086-LCY
x-cache: MISS
x-cache-hits: 0
x-timer: S1742340526.125460,VS0,VE212
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: 286e66675a1d1dca919d97d56687ac9b388b1121
expires: Tue, 18 Mar 2025 23:33:46 GMT
source-age: 0
content-length: 229376
GET

https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Trojan/ColorBug.exe

msedge.exe

Remote address:

185.199.109.133:443

Request

GET /Da2dalus/The-MALWARE-Repo/refs/heads/master/Trojan/ColorBug.exe HTTP/2.0
host: raw.githubusercontent.com
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0, i

Response

HTTP/2.0 200

cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: application/octet-stream
etag: W/"779d1ff6a612f238cffdb24045717a26bcb10ad0781365185cae585b502a9ac5"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: E775:351451:1297D7:24E605:67DA01DA
accept-ranges: bytes
date: Tue, 18 Mar 2025 23:29:30 GMT
via: 1.1 varnish
x-served-by: cache-lcy-eglc8600086-LCY
x-cache: MISS
x-cache-hits: 0
x-timer: S1742340571.637662,VS0,VE329
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: 85ef08e6d56f470a11943bd1b64cd709ee07d4ab
expires: Tue, 18 Mar 2025 23:34:30 GMT
source-age: 0
content-length: 54784
DNS

static.edge.microsoftapp.net

msedge.exe

Remote address:

8.8.8.8:53

Request

static.edge.microsoftapp.net

IN A

Response

static.edge.microsoftapp.net

IN CNAME

edge-cloud-resource-static.azureedge.net

edge-cloud-resource-static.azureedge.net

IN CNAME

edge-cloud-resource-static.afd.azureedge.net

edge-cloud-resource-static.afd.azureedge.net

IN CNAME

azureedge-t-prod.trafficmanager.net

azureedge-t-prod.trafficmanager.net

IN CNAME

shed.dual-low.s-part-0036.t-0009.t-msedge.net

shed.dual-low.s-part-0036.t-0009.t-msedge.net

IN CNAME

s-part-0036.t-0009.t-msedge.net

s-part-0036.t-0009.t-msedge.net

IN A

13.107.246.64
DNS

static.edge.microsoftapp.net

msedge.exe

Remote address:

8.8.8.8:53

Request

static.edge.microsoftapp.net

IN Unknown

Response

static.edge.microsoftapp.net

IN CNAME

edge-cloud-resource-static.azureedge.net

edge-cloud-resource-static.azureedge.net

IN CNAME

edge-cloud-resource-static.afd.azureedge.net

edge-cloud-resource-static.afd.azureedge.net

IN CNAME

azureedge-t-prod.trafficmanager.net

azureedge-t-prod.trafficmanager.net

IN CNAME

shed.dual-low.s-part-0036.t-0009.t-msedge.net

shed.dual-low.s-part-0036.t-0009.t-msedge.net

IN CNAME

s-part-0036.t-0009.t-msedge.net
HEAD

https://static.edge.microsoftapp.net/default/cloud_config_observers.json

msedge.exe

Remote address:

13.107.246.64:443

Request

HEAD /default/cloud_config_observers.json HTTP/2.0
host: static.edge.microsoftapp.net
pragma: no-cache
cache-control: no-cache
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
priority: u=4, i

Response

HTTP/2.0 200

date: Tue, 18 Mar 2025 23:28:23 GMT
content-type: application/json
content-length: 493
content-md5: 8YCAQXI5ca6uC/Mz9lDhJQ==
last-modified: Tue, 18 Mar 2025 11:39:15 GMT
etag: 0x8DD661182DD7E3A
x-ms-request-id: 52684749-201e-0061-75fa-974d55000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
x-azure-ref: 20250318T232823Z-r15d84578dctwj8shC1FRA83sg00000007sg00000000fqfx
x-fd-int-roxy-purgeid: 83582882
x-cache: TCP_HIT
accept-ranges: bytes
GET

https://static.edge.microsoftapp.net/default/cloud_config_observers.json

msedge.exe

Remote address:

13.107.246.64:443

Request

GET /default/cloud_config_observers.json HTTP/2.0
host: static.edge.microsoftapp.net
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
priority: u=4, i

Response

HTTP/2.0 200

date: Tue, 18 Mar 2025 23:28:23 GMT
content-type: application/json
content-length: 493
last-modified: Tue, 18 Mar 2025 11:39:15 GMT
etag: 0x8DD661182DD7E3A
x-ms-request-id: 5f4cd1fd-a01e-006f-2c00-9864e5000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
x-azure-ref: 20250318T232823Z-r15d84578dctwj8shC1FRA83sg00000007sg00000000fqg7
x-fd-int-roxy-purgeid: 83582882
x-cache: TCP_HIT
accept-ranges: bytes
POST

https://edge.microsoft.com/componentupdater/api/v1/update?cup2key=7:lES827Iqx3Qf_zLWoGB4vYKmJwU3ff4NYSA41dY72f0&cup2hreq=01b5b9f9528cbd0936eac53ea0c5b3c84011d9b6f5c490f516f0710a036a3385

msedge.exe

Remote address:

204.79.197.239:443

Request

POST /componentupdater/api/v1/update?cup2key=7:lES827Iqx3Qf_zLWoGB4vYKmJwU3ff4NYSA41dY72f0&cup2hreq=01b5b9f9528cbd0936eac53ea0c5b3c84011d9b6f5c490f516f0710a036a3385 HTTP/2.0
host: edge.microsoft.com
content-length: 11812
x-microsoft-update-appid: hajigopbbjhghbfimgkfmpenfkclmohk,kmkacjgmmfchkbeglfbjjeidfckbnkca,gllimckfbolmioaaihpppacjccghejen,mkcgfaeepibomfapiapjaceihcojnphg,llmidpclgepbgbgoecnhcmgfhmfplfao,ohckeflnhegojcjlcpbfpciadgikcohk,omnckhpgfmaoelhddliebabpgblmmnjp,eeobbhfgfagbclfofmgbdfoicabjdbkn,lkkdlcloifjinapabfonaibjijloebfb,plbmmhnabegcabfbcejohgjpkamkddhn,jcmcegpcehdchljeldgmmfbgcpnmgedo,mpicjakjneaggahlnmbojhjpnileolnb,ahmaebgpfccdhgidjaidaoojjcijckba,ojblfafjmiikbkepnnolpgbbhejhlcim,jbfaflocpnkhbgcijpkiafdpbjkedane,fgbafbciocncjfbbonhocjaohoknlaco,oankkpibpaokgecfckkdkgaoafllipag,cllppcmmlnkggcmljjfigkcigaajjmid,lfmeghnikdkbonehgjihjebgioakijgn,hjaimielcgmceiphgjjfddlgjklfpdei,fppmbhmldokgmleojlplaaodlkibgikh,pbdgbpmpeenomngainidcjmopnklimmf,ndikpojcjlepofdkaaldkinkjbeeebkl,alpjnmnfbgfkmmpcfpejmmoebdndedno,kpfehajjjbbcifeehjgfgnabifknmdad,pdfjdcjjjegpclfiilihfkmdfndkneei
x-microsoft-update-interactivity: bg
x-microsoft-update-service-cohort: 1415
x-microsoft-update-updater: msedge-133.0.3065.69
content-type: application/json
sec-mesh-client-edge-version: 133.0.3065.69
sec-mesh-client-edge-channel: stable
sec-mesh-client-os: Windows
sec-mesh-client-os-version: 10.0.19041
sec-mesh-client-arch: x86_64
sec-mesh-client-webview: 0
x-client-data: COXnygE=
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
priority: u=4, i

Response

HTTP/2.0 200

cache-control: no-store, must-revalidate, no-cache, max-age=0
pragma: no-cache
content-length: 4373
content-type: application/json
content-encoding: gzip
expires: Mon, 01 Jan 1990 00:00:00 GMT
etag: 3046022100819684D725DC73E7C9CA8BE0A0354749F6C0680930EDC6CDFBA9BDBD7CAD9A1B022100E4181BB86006562CD271DC156BEC23CE39564F5342D47B648E61C18A4C32F983:01b5b9f9528cbd0936eac53ea0c5b3c84011d9b6f5c490f516f0710a036a3385
x-frame-options: sameorigin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-cup-server-proof: 3046022100819684D725DC73E7C9CA8BE0A0354749F6C0680930EDC6CDFBA9BDBD7CAD9A1B022100E4181BB86006562CD271DC156BEC23CE39564F5342D47B648E61C18A4C32F983:01b5b9f9528cbd0936eac53ea0c5b3c84011d9b6f5c490f516f0710a036a3385
x-cache: CONFIG_NOCACHE
x-msedge-ref: Ref A: 43BEADB611934B79843C2B63FC91B911 Ref B: FRA31EDGE0712 Ref C: 2025-03-18T23:28:24Z
date: Tue, 18 Mar 2025 23:28:23 GMT
POST

https://edge.microsoft.com/componentupdater/api/v1/update

msedge.exe

Remote address:

204.79.197.239:443

Request

POST /componentupdater/api/v1/update HTTP/2.0
host: edge.microsoft.com
content-length: 1454
x-microsoft-update-service-cohort: 1415
content-type: application/json
sec-mesh-client-edge-version: 133.0.3065.69
sec-mesh-client-edge-channel: stable
sec-mesh-client-os: Windows
sec-mesh-client-os-version: 10.0.19041
sec-mesh-client-arch: x86_64
sec-mesh-client-webview: 0
x-client-data: COXnygE=
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
priority: u=4, i

Response

HTTP/2.0 200

cache-control: no-store, must-revalidate, no-cache, max-age=0
pragma: no-cache
content-length: 180
content-type: application/json
content-encoding: gzip
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-frame-options: sameorigin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-cache: CONFIG_NOCACHE
x-msedge-ref: Ref A: 6731E2369B104DABB39F652DEC271370 Ref B: FRA31EDGE0712 Ref C: 2025-03-18T23:28:52Z
date: Tue, 18 Mar 2025 23:28:52 GMT
POST

https://edge.microsoft.com/componentupdater/api/v1/update

msedge.exe

Remote address:

204.79.197.239:443

Request

POST /componentupdater/api/v1/update HTTP/2.0
host: edge.microsoft.com
content-length: 1360
x-microsoft-update-service-cohort: 1415
content-type: application/json
sec-mesh-client-edge-version: 133.0.3065.69
sec-mesh-client-edge-channel: stable
sec-mesh-client-os: Windows
sec-mesh-client-os-version: 10.0.19041
sec-mesh-client-arch: x86_64
sec-mesh-client-webview: 0
x-client-data: COXnygE=
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
priority: u=4, i

Response

HTTP/2.0 200

cache-control: no-store, must-revalidate, no-cache, max-age=0
pragma: no-cache
content-length: 180
content-type: application/json
content-encoding: gzip
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-frame-options: sameorigin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-cache: CONFIG_NOCACHE
x-msedge-ref: Ref A: 5B7165CF517542F78C3E769E2E050E21 Ref B: FRA31EDGE0712 Ref C: 2025-03-18T23:29:25Z
date: Tue, 18 Mar 2025 23:29:24 GMT
DNS

edge-mobile-static.azureedge.net

msedge.exe

Remote address:

8.8.8.8:53

Request

edge-mobile-static.azureedge.net

IN A

Response

edge-mobile-static.azureedge.net

IN CNAME

edge-mobile-static.afd.azureedge.net

edge-mobile-static.afd.azureedge.net

IN CNAME

azureedge-t-prod.trafficmanager.net

azureedge-t-prod.trafficmanager.net

IN CNAME

shed.dual-low.s-part-0036.t-0009.t-msedge.net

shed.dual-low.s-part-0036.t-0009.t-msedge.net

IN CNAME

s-part-0036.t-0009.t-msedge.net

s-part-0036.t-0009.t-msedge.net

IN A

13.107.246.64
DNS

edge-mobile-static.azureedge.net

msedge.exe

Remote address:

8.8.8.8:53

Request

edge-mobile-static.azureedge.net

IN Unknown

Response

edge-mobile-static.azureedge.net

IN CNAME

edge-mobile-static.afd.azureedge.net

edge-mobile-static.afd.azureedge.net

IN CNAME

azureedge-t-prod.trafficmanager.net

azureedge-t-prod.trafficmanager.net

IN CNAME

shed.dual-low.s-part-0036.t-0009.t-msedge.net
GET

https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-US&setchannel=stable

msedge.exe

Remote address:

13.107.246.64:443

Request

GET /eccp/get?settenant=edge-config&setplatform=win&setmkt=en-US&setchannel=stable HTTP/2.0
host: edge-mobile-static.azureedge.net
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept-encoding: gzip, deflate, br, zstd
priority: u=4, i

Response

HTTP/2.0 200

date: Tue, 18 Mar 2025 23:28:24 GMT
content-type: application/json
vary: Accept-Encoding
last-modified: Tue, 18 Mar 2025 11:39:36 GMT
x-ms-request-id: 7d030124-e01e-003e-39fa-97d5e5000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
x-azure-ref: 20250318T232824Z-r15d84578dcbmgpshC1FRAnams000000099g0000000039nn
x-fd-int-roxy-purgeid: 83582882
x-cache: TCP_HIT
content-encoding: br
DNS

c.pki.goog

Remote address:

8.8.8.8:53

Request

c.pki.goog

IN A

Response

c.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.180.3
GET

http://c.pki.goog/r/r1.crl

Remote address:

142.250.180.3:80

Request

GET /r/r1.crl HTTP/1.1
Cache-Control: max-age = 3000
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT
User-Agent: Microsoft-CryptoAPI/10.0
Host: c.pki.goog

Response

HTTP/1.1 304 Not Modified

Date: Tue, 18 Mar 2025 23:18:52 GMT
Expires: Wed, 19 Mar 2025 00:08:52 GMT
Age: 574
Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
Cache-Control: public, max-age=3000
Vary: Accept-Encoding
DNS

msedge.b.tlu.dl.delivery.mp.microsoft.com

Remote address:

8.8.8.8:53

Request

msedge.b.tlu.dl.delivery.mp.microsoft.com

IN A

Response

msedge.b.tlu.dl.delivery.mp.microsoft.com

IN CNAME

star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com

star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com

IN CNAME

cdp-f-tlu-net.trafficmanager.net

cdp-f-tlu-net.trafficmanager.net

IN CNAME

edge.ds-c7114-microsoft.global.dns.qwilted-cds.cqloud.com

edge.ds-c7114-microsoft.global.dns.qwilted-cds.cqloud.com

IN A

91.81.129.180

edge.ds-c7114-microsoft.global.dns.qwilted-cds.cqloud.com

IN A

91.80.49.21

edge.ds-c7114-microsoft.global.dns.qwilted-cds.cqloud.com

IN A

91.80.49.22

edge.ds-c7114-microsoft.global.dns.qwilted-cds.cqloud.com

IN A

91.81.130.133

edge.ds-c7114-microsoft.global.dns.qwilted-cds.cqloud.com

IN A

91.81.130.134
HEAD

http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d

Remote address:

91.81.129.180:80

Request

HEAD /filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.8
Host: msedge.b.tlu.dl.delivery.mp.microsoft.com

Response

HTTP/1.1 200 OK

Date: Tue, 18 Mar 2025 23:28:29 GMT
Content-Type: application/x-chrome-extension
Content-Length: 6252
Connection: keep-alive
Age: 434
Cache-Control: public, max-age=17280000
Etag: "3AWVl34DSMJKHl2C217ukEQM0Mw="
Last-Modified: Mon, 11 Nov 2024 00:17:54 GMT
MS-CorrelationId: 205c2916-df22-4c46-a28e-6c2dc505958d
MS-CV: 7cqM8pKkVUu2bUpF.0
MS-RequestId: 018c4aa9-70c6-4132-bed1-45eaba10281e
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.3
X-Cache: HIT
X-CCC: it
X-CID: 9
X-Powered-By: ASP.NET
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
Ocn-Cache-Status: HIT
Ocn-Requestid: 1000000885bfa5bf-4325215462-1
Ocn-Served-By: QLT
Accept-Ranges: bytes
Server: Qwilt
X-OC-Service-Type: lo
GET

http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d

Remote address:

91.81.129.180:80

Request

GET /filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 11 Nov 2024 00:17:54 GMT
Range: bytes=0-1119
User-Agent: Microsoft BITS/7.8
Host: msedge.b.tlu.dl.delivery.mp.microsoft.com

Response

HTTP/1.1 206 Partial Content

Date: Tue, 18 Mar 2025 23:28:29 GMT
Content-Type: application/x-chrome-extension
Content-Length: 1120
Connection: keep-alive
Age: 434
Cache-Control: public, max-age=17280000
Etag: "3AWVl34DSMJKHl2C217ukEQM0Mw="
Last-Modified: Mon, 11 Nov 2024 00:17:54 GMT
MS-CorrelationId: 205c2916-df22-4c46-a28e-6c2dc505958d
MS-CV: 7cqM8pKkVUu2bUpF.0
MS-RequestId: 018c4aa9-70c6-4132-bed1-45eaba10281e
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.3
X-Cache: HIT
X-CCC: it
X-CID: 9
X-Powered-By: ASP.NET
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
Ocn-Cache-Status: HIT
Ocn-Requestid: 1000000885bfa7b4-4325215462-2
Ocn-Served-By: QLT
Content-Range: bytes 0-1119/6252
Server: Qwilt
X-OC-Service-Type: lo
GET

http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d

Remote address:

91.81.129.180:80

Request

GET /filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 11 Nov 2024 00:17:54 GMT
Range: bytes=1120-1139
User-Agent: Microsoft BITS/7.8
Host: msedge.b.tlu.dl.delivery.mp.microsoft.com

Response

HTTP/1.1 206 Partial Content

Date: Tue, 18 Mar 2025 23:28:35 GMT
Content-Type: application/x-chrome-extension
Content-Length: 20
Connection: keep-alive
Age: 434
Cache-Control: public, max-age=17280000
Etag: "3AWVl34DSMJKHl2C217ukEQM0Mw="
Last-Modified: Mon, 11 Nov 2024 00:17:54 GMT
MS-CorrelationId: 205c2916-df22-4c46-a28e-6c2dc505958d
MS-CV: 7cqM8pKkVUu2bUpF.0
MS-RequestId: 018c4aa9-70c6-4132-bed1-45eaba10281e
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.3
X-Cache: HIT
X-CCC: it
X-CID: 9
X-Powered-By: ASP.NET
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
Ocn-Cache-Status: HIT
Ocn-Requestid: 1000000885bffb63-4325215462-3
Ocn-Served-By: QLT
Content-Range: bytes 1120-1139/6252
Server: Qwilt
X-OC-Service-Type: lo
GET

http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d

Remote address:

91.81.129.180:80

Request

GET /filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 11 Nov 2024 00:17:54 GMT
Range: bytes=1140-1790
User-Agent: Microsoft BITS/7.8
Host: msedge.b.tlu.dl.delivery.mp.microsoft.com

Response

HTTP/1.1 206 Partial Content

Date: Tue, 18 Mar 2025 23:28:40 GMT
Content-Type: application/x-chrome-extension
Content-Length: 651
Connection: keep-alive
Age: 434
Cache-Control: public, max-age=17280000
Etag: "3AWVl34DSMJKHl2C217ukEQM0Mw="
Last-Modified: Mon, 11 Nov 2024 00:17:54 GMT
MS-CorrelationId: 205c2916-df22-4c46-a28e-6c2dc505958d
MS-CV: 7cqM8pKkVUu2bUpF.0
MS-RequestId: 018c4aa9-70c6-4132-bed1-45eaba10281e
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.3
X-Cache: HIT
X-CCC: it
X-CID: 9
X-Powered-By: ASP.NET
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
Ocn-Cache-Status: HIT
Ocn-Requestid: 1000000885c0391f-4325215462-4
Ocn-Served-By: QLT
Content-Range: bytes 1140-1790/6252
Server: Qwilt
X-OC-Service-Type: lo
GET

http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d

Remote address:

91.81.129.180:80

Request

GET /filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 11 Nov 2024 00:17:54 GMT
Range: bytes=1791-5972
User-Agent: Microsoft BITS/7.8
Host: msedge.b.tlu.dl.delivery.mp.microsoft.com

Response

HTTP/1.1 206 Partial Content

Date: Tue, 18 Mar 2025 23:28:44 GMT
Content-Type: application/x-chrome-extension
Content-Length: 4182
Connection: keep-alive
Age: 434
Cache-Control: public, max-age=17280000
Etag: "3AWVl34DSMJKHl2C217ukEQM0Mw="
Last-Modified: Mon, 11 Nov 2024 00:17:54 GMT
MS-CorrelationId: 205c2916-df22-4c46-a28e-6c2dc505958d
MS-CV: 7cqM8pKkVUu2bUpF.0
MS-RequestId: 018c4aa9-70c6-4132-bed1-45eaba10281e
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.3
X-Cache: HIT
X-CCC: it
X-CID: 9
X-Powered-By: ASP.NET
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
Ocn-Cache-Status: HIT
Ocn-Requestid: 1000000885c070b0-4325215462-5
Ocn-Served-By: QLT
Content-Range: bytes 1791-5972/6252
Server: Qwilt
X-OC-Service-Type: lo
GET

http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d

Remote address:

91.81.129.180:80

Request

GET /filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 11 Nov 2024 00:17:54 GMT
Range: bytes=5973-6251
User-Agent: Microsoft BITS/7.8
Host: msedge.b.tlu.dl.delivery.mp.microsoft.com

Response

HTTP/1.1 206 Partial Content

Date: Tue, 18 Mar 2025 23:28:48 GMT
Content-Type: application/x-chrome-extension
Content-Length: 279
Connection: keep-alive
Age: 434
Cache-Control: public, max-age=17280000
Etag: "3AWVl34DSMJKHl2C217ukEQM0Mw="
Last-Modified: Mon, 11 Nov 2024 00:17:54 GMT
MS-CorrelationId: 205c2916-df22-4c46-a28e-6c2dc505958d
MS-CV: 7cqM8pKkVUu2bUpF.0
MS-RequestId: 018c4aa9-70c6-4132-bed1-45eaba10281e
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.3
X-Cache: HIT
X-CCC: it
X-CID: 9
X-Powered-By: ASP.NET
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
Ocn-Cache-Status: HIT
Ocn-Requestid: 1000000885c0ac32-4325215462-6
Ocn-Served-By: QLT
Content-Range: bytes 5973-6251/6252
Server: Qwilt
X-OC-Service-Type: lo
HEAD

http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1742408073&P2=404&P3=2&P4=i2AWjGQbTxub8zMFS4s%2b6VuECdCyGJJiTPiVF2mX1DfSFlYvX7IGzTdytJxx3l9wORxWhO%2fP0oFSAfibaW6lsg%3d%3d

Remote address:

91.81.129.180:80

Request

HEAD /filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1742408073&P2=404&P3=2&P4=i2AWjGQbTxub8zMFS4s%2b6VuECdCyGJJiTPiVF2mX1DfSFlYvX7IGzTdytJxx3l9wORxWhO%2fP0oFSAfibaW6lsg%3d%3d HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.8
Host: msedge.b.tlu.dl.delivery.mp.microsoft.com

Response

HTTP/1.1 200 OK

Date: Tue, 18 Mar 2025 23:29:21 GMT
Content-Type: application/x-chrome-extension
Content-Length: 77845
Connection: keep-alive
Cache-Control: public, max-age=17280000
Last-Modified: Fri, 20 Dec 2024 00:11:28 GMT
ETag: "293R1HX7EQpRuWBV7Z8lmeSFh14="
X-AspNetMvc-Version: 5.3
MS-CorrelationId: d6100d11-2faa-4902-852f-f5a07f715a17
MS-RequestId: 205fbbb1-3692-4e58-965e-42070cc448f6
MS-CV: 5jz2yz4kt2x02t0myythx3.0.1.1.3.1.1.1.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
X-CID: 9
X-CCC: it
Ocn-Cache-Status: HIT
Ocn-Requestid: 1000000885c26f42-4325215462-7
Ocn-Served-By: QLT
Accept-Ranges: bytes
Server: Qwilt
X-OC-Service-Type: lo
GET

http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1742408073&P2=404&P3=2&P4=i2AWjGQbTxub8zMFS4s%2b6VuECdCyGJJiTPiVF2mX1DfSFlYvX7IGzTdytJxx3l9wORxWhO%2fP0oFSAfibaW6lsg%3d%3d

Remote address:

91.81.129.180:80

Request

GET /filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1742408073&P2=404&P3=2&P4=i2AWjGQbTxub8zMFS4s%2b6VuECdCyGJJiTPiVF2mX1DfSFlYvX7IGzTdytJxx3l9wORxWhO%2fP0oFSAfibaW6lsg%3d%3d HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Fri, 20 Dec 2024 00:11:28 GMT
Range: bytes=0-13414
User-Agent: Microsoft BITS/7.8
Host: msedge.b.tlu.dl.delivery.mp.microsoft.com

Response

HTTP/1.1 206 Partial Content

Date: Tue, 18 Mar 2025 23:29:21 GMT
Content-Type: application/x-chrome-extension
Content-Length: 13415
Connection: keep-alive
Cache-Control: public, max-age=17280000
Last-Modified: Fri, 20 Dec 2024 00:11:28 GMT
ETag: "293R1HX7EQpRuWBV7Z8lmeSFh14="
X-AspNetMvc-Version: 5.3
MS-CorrelationId: d6100d11-2faa-4902-852f-f5a07f715a17
MS-RequestId: 205fbbb1-3692-4e58-965e-42070cc448f6
MS-CV: 5jz2yz4kt2x02t0myythx3.0.1.1.3.1.1.1.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
X-CID: 9
X-CCC: it
Ocn-Cache-Status: HIT
Ocn-Requestid: 1000000885c2716a-4325215462-8
Ocn-Served-By: QLT
Content-Range: bytes 0-13414/77845
Server: Qwilt
X-OC-Service-Type: lo
GET

http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1742408073&P2=404&P3=2&P4=i2AWjGQbTxub8zMFS4s%2b6VuECdCyGJJiTPiVF2mX1DfSFlYvX7IGzTdytJxx3l9wORxWhO%2fP0oFSAfibaW6lsg%3d%3d

Remote address:

91.81.129.180:80

Request

GET /filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1742408073&P2=404&P3=2&P4=i2AWjGQbTxub8zMFS4s%2b6VuECdCyGJJiTPiVF2mX1DfSFlYvX7IGzTdytJxx3l9wORxWhO%2fP0oFSAfibaW6lsg%3d%3d HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Fri, 20 Dec 2024 00:11:28 GMT
Range: bytes=13415-35570
User-Agent: Microsoft BITS/7.8
Host: msedge.b.tlu.dl.delivery.mp.microsoft.com

Response

HTTP/1.1 206 Partial Content

Date: Tue, 18 Mar 2025 23:29:22 GMT
Content-Type: application/x-chrome-extension
Content-Length: 22156
Connection: keep-alive
Cache-Control: public, max-age=17280000
Last-Modified: Fri, 20 Dec 2024 00:11:28 GMT
ETag: "293R1HX7EQpRuWBV7Z8lmeSFh14="
X-AspNetMvc-Version: 5.3
MS-CorrelationId: d6100d11-2faa-4902-852f-f5a07f715a17
MS-RequestId: 205fbbb1-3692-4e58-965e-42070cc448f6
MS-CV: 5jz2yz4kt2x02t0myythx3.0.1.1.3.1.1.1.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
X-CID: 9
X-CCC: it
Ocn-Cache-Status: HIT
Ocn-Requestid: 1000000885c280e8-4325215462-9
Ocn-Served-By: QLT
Content-Range: bytes 13415-35570/77845
Server: Qwilt
X-OC-Service-Type: lo
GET

http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1742408073&P2=404&P3=2&P4=i2AWjGQbTxub8zMFS4s%2b6VuECdCyGJJiTPiVF2mX1DfSFlYvX7IGzTdytJxx3l9wORxWhO%2fP0oFSAfibaW6lsg%3d%3d

Remote address:

91.81.129.180:80

Request

GET /filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1742408073&P2=404&P3=2&P4=i2AWjGQbTxub8zMFS4s%2b6VuECdCyGJJiTPiVF2mX1DfSFlYvX7IGzTdytJxx3l9wORxWhO%2fP0oFSAfibaW6lsg%3d%3d HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Fri, 20 Dec 2024 00:11:28 GMT
Range: bytes=35571-77844
User-Agent: Microsoft BITS/7.8
Host: msedge.b.tlu.dl.delivery.mp.microsoft.com

Response

HTTP/1.1 206 Partial Content

Date: Tue, 18 Mar 2025 23:29:23 GMT
Content-Type: application/x-chrome-extension
Content-Length: 42274
Connection: keep-alive
Cache-Control: public, max-age=17280000
Last-Modified: Fri, 20 Dec 2024 00:11:28 GMT
ETag: "293R1HX7EQpRuWBV7Z8lmeSFh14="
X-AspNetMvc-Version: 5.3
MS-CorrelationId: d6100d11-2faa-4902-852f-f5a07f715a17
MS-RequestId: 205fbbb1-3692-4e58-965e-42070cc448f6
MS-CV: 5jz2yz4kt2x02t0myythx3.0.1.1.3.1.1.1.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
X-CID: 9
X-CCC: it
Ocn-Cache-Status: HIT
Ocn-Requestid: 1000000885c28f1d-4325215462-10
Ocn-Served-By: QLT
Content-Range: bytes 35571-77844/77845
Server: Qwilt
X-OC-Service-Type: lo
DNS

jygmsfujfepd.org

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

jygmsfujfepd.org

IN A

Response
DNS

kubntkkwtxxr.co.uk

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

kubntkkwtxxr.co.uk

IN A

Response
DNS

kynsyqdjgbdt.info

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

kynsyqdjgbdt.info

IN A

Response
DNS

luitavswuuli.com

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

luitavswuuli.com

IN A

Response
DNS

lhlvsaxkmnag.net

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

lhlvsaxkmnag.net

IN A

Response
DNS

mdgwtfnxbhiu.biz

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

mdgwtfnxbhiu.biz

IN A

Response
DNS

kkeyrqhnufym.ru

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

kkeyrqhnufym.ru

IN A

Response
DNS

xuymoylpxjpb.org

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

xuymoylpxjpb.org

IN A

Response
DNS

collector.github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

collector.github.com

IN A
DNS

collector.github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

collector.github.com

IN Unknown
DNS

api.github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

api.github.com

IN A
DNS

api.github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

api.github.com

IN Unknown
DNS

mpcqcacuyeel.co.uk

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

mpcqcacuyeel.co.uk

IN A

Response
DNS

collector.github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

collector.github.com

IN A

Response

collector.github.com

IN CNAME

glb-db52c2cf8be544.github.com

glb-db52c2cf8be544.github.com

IN A

140.82.112.22
DNS

collector.github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

collector.github.com

IN Unknown

Response

collector.github.com

IN CNAME

glb-db52c2cf8be544.github.com
DNS

api.github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

api.github.com

IN A

Response

api.github.com

IN A

20.26.156.210
DNS

api.github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

api.github.com

IN Unknown

Response
DNS

github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

github.com

IN A

Response

github.com

IN A

20.26.156.215
DNS

github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

github.com

IN Unknown

Response
GET

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-react-router: json
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
dnt: 1
x-github-target: dotcom
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:28:41 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"a1290295797e948e6d1d8efaee1efcb9"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 2198
x-github-request-id: B34B:A6D85:80B8CC:99096F:67DA01A9
GET

https://github.com/Da2dalus/The-MALWARE-Repo/latest-commit/master/Ransomware/WannaCry.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/latest-commit/master/Ransomware/WannaCry.exe HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
github-verified-fetch: true
content-type: application/json
dnt: 1
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:28:42 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"3b1ec0bc5e0864a5815defaffc90db22"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 181
x-github-request-id: B34B:A6D85:80B954:990A1C:67DA01AA
GET

https://github.com/Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Ransomware/WannaCry.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Ransomware/WannaCry.exe HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
github-verified-fetch: true
content-type: application/json
dnt: 1
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:28:42 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"3ced86846dae3ee107fee9d1856e8b37"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 478
x-github-request-id: B34B:A6D85:80B954:990A1B:67DA01A9
GET

https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
turbo-visit: true
x-react-app-name: react-code-view
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: text/html, application/xhtml+xml, application/json
dnt: 1
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 302

server: GitHub.com
date: Tue, 18 Mar 2025 23:28:45 GMT
content-type: text/html; charset=utf-8
content-length: 0
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
access-control-allow-origin:
location: https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/WannaCry.exe
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
x-github-request-id: B34B:A6D85:80BAE0:990C0B:67DA01AA
GET

https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe HTTP/2.0
host: github.com
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=0, i

Response

HTTP/2.0 302

server: GitHub.com
date: Tue, 18 Mar 2025 23:28:45 GMT
content-type: text/html; charset=utf-8
content-length: 0
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
access-control-allow-origin:
location: https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/WannaCry.exe
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
x-github-request-id: B34B:A6D85:80BB14:990C61:67DA01AD
DNS

aaweyigwciua.info

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

aaweyigwciua.info

IN A

Response
DNS

msjirlkocojp.com

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

msjirlkocojp.com

IN A

Response
DNS

msjirlkocojp.com

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

msjirlkocojp.com

IN A
DNS

adevotoqfsae.net

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

adevotoqfsae.net

IN A

Response
DNS

oxhacufvgnoo.biz

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

oxhacufvgnoo.biz

IN A

Response
DNS

cicnydjxjrfd.ru

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

cicnydjxjrfd.ru

IN A

Response
DNS

cicnydjxjrfd.ru

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

cicnydjxjrfd.ru

IN A
DNS

opmdsfcltroy.org

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

opmdsfcltroy.org

IN A

Response
DNS

opmdsfcltroy.org

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

opmdsfcltroy.org

IN A
DNS

opmdsfcltroy.org

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

opmdsfcltroy.org

IN A
DNS

plhetniswgbf.co.uk

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

plhetniswgbf.co.uk

IN A

Response
DNS

edge.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

edge.microsoft.com

IN A

Response

edge.microsoft.com

IN CNAME

edge-domain.trafficmanager.net

edge-domain.trafficmanager.net

IN CNAME

edge-microsoft-com.dual-a-0036.a-msedge.net

edge-microsoft-com.dual-a-0036.a-msedge.net

IN CNAME

dual-a-0036.a-msedge.net

dual-a-0036.a-msedge.net

IN A

13.107.21.239

dual-a-0036.a-msedge.net

IN A

204.79.197.239
DNS

edge.microsoft.com

msedge.exe

Remote address:

8.8.8.8:53

Request

edge.microsoft.com

IN Unknown

Response

edge.microsoft.com

IN CNAME

edge-domain.trafficmanager.net

edge-domain.trafficmanager.net

IN CNAME

edge-microsoft-com.ax-0002.ax-msedge.net
DNS

qukudowsxqtx.info

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

qukudowsxqtx.info

IN A

Response
DNS

rqfvewdabfge.com

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

rqfvewdabfge.com

IN A

Response
DNS

qxrmsafmbbyc.net

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

qxrmsafmbbyc.net

IN A

Response
DNS

rtmntiltepli.biz

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

rtmntiltepli.biz

IN A

Response
DNS

sdpedjatfaeb.ru

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

sdpedjatfaeb.ru

IN A

Response
DNS

sdpedjatfaeb.ru

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

sdpedjatfaeb.ru

IN A
DNS

tykfergbioqh.org

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

tykfergbioqh.org

IN A

Response
DNS

ypdreignrmby.co.uk

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

ypdreignrmby.co.uk

IN A

Response
DNS

maxfbntsgvvf.info

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

maxfbntsgvvf.info

IN A

Response
DNS

axbuxxtcuost.com

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

axbuxxtcuost.com

IN A

Response
DNS

niviudhhjxna.net

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

niviudhhjxna.net

IN A

Response
DNS

drixtdhpufus.biz

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

drixtdhpufus.biz

IN A

Response
DNS

qcdlqiuujopy.ru

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

qcdlqiuujopy.ru

IN A

Response
DNS

eagbnsuexhmn.org

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

eagbnsuexhmn.org

IN A

Response
DNS

rkbokxijmqht.co.uk

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

rkbokxijmqht.co.uk

IN A

Response
DNS

dulvfwbwqyud.info

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

dulvfwbwqyud.info

IN A

Response
DNS

eqgwgcqkfsdr.com

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

eqgwgcqkfsdr.com

IN A

Response
DNS

edjyymoltbmx.net

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

edjyymoltbmx.net

IN A

Response
DNS

fyeaareyiuum.biz

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

fyeaareyiuum.biz

IN A

Response
DNS

hwqcurcytrow.ru

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

hwqcurcytrow.ru

IN A

Response
DNS

isldvwrmilwl.org

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

isldvwrmilwl.org

IN A

Response
DNS

ifofohpnwtgr.co.uk

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

ifofohpnwtgr.co.uk

IN A

Response
DNS

jbjgpmfblnog.info

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

jbjgpmfblnog.info

IN A

Response
DNS

jbjgpmfblnog.info

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

jbjgpmfblnog.info

IN A

Response
DNS

fohlxriymovj.com

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

fohlxriymovj.com

IN A

Response
DNS

sycyuambpsmx.net

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

sycyuambpsmx.net

IN A

Response
DNS

msedge.b.tlu.dl.delivery.mp.microsoft.com

Remote address:

8.8.8.8:53

Request

msedge.b.tlu.dl.delivery.mp.microsoft.com

IN A

Response

msedge.b.tlu.dl.delivery.mp.microsoft.com

IN CNAME

star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com

star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com

IN CNAME

cdp-f-tlu-net.trafficmanager.net

cdp-f-tlu-net.trafficmanager.net

IN CNAME

fg.microsoft.map.fastly.net

fg.microsoft.map.fastly.net

IN A

199.232.210.172

fg.microsoft.map.fastly.net

IN A

199.232.214.172
DNS

htfdihvanyga.biz

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

htfdihvanyga.biz

IN A

Response
DNS

htfdihvanyga.biz

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

htfdihvanyga.biz

IN A

Response
DNS

ueaqfpacqdwo.ru

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

ueaqfpacqdwo.ru

IN A

Response
DNS

jqmrnmjbphpd.org

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

jqmrnmjbphpd.org

IN A

Response
DNS

wbhfkundslgr.co.uk

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

wbhfkundslgr.co.uk

IN A

Response
DNS

lvkjxcwcqrat.info

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

lvkjxcwcqrat.info

IN A

Response
DNS

lvkjxcwcqrat.info

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

lvkjxcwcqrat.info

IN A

Response
GET

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-react-router: json
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
dnt: 1
x-github-target: dotcom
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:29:28 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"a8b214a8c765699fadfc02e0416ea5d2"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 2290
x-github-request-id: 8000:72BCA:817554:99CD8D:67DA01D7
GET

https://github.com/Da2dalus/The-MALWARE-Repo/latest-commit/master/Trojan/ColorBug.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/latest-commit/master/Trojan/ColorBug.exe HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
github-verified-fetch: true
content-type: application/json
dnt: 1
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:29:28 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"3b1ec0bc5e0864a5815defaffc90db22"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 181
x-github-request-id: 8000:72BCA:817573:99CDC0:67DA01D8
GET

https://github.com/Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Trojan/ColorBug.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Trojan/ColorBug.exe HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: application/json
github-verified-fetch: true
content-type: application/json
dnt: 1
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 200

server: GitHub.com
date: Tue, 18 Mar 2025 23:29:28 GMT
content-type: application/json; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
etag: W/"5185db155c3506b14ff9569056b0e747"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
accept-ranges: bytes
content-length: 448
x-github-request-id: 8000:72BCA:817573:99CDBF:67DA01D7
GET

https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Trojan/ColorBug.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Trojan/ColorBug.exe HTTP/2.0
host: github.com
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
turbo-visit: true
x-react-app-name: react-code-view
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: text/html, application/xhtml+xml, application/json
dnt: 1
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=1, i

Response

HTTP/2.0 302

server: GitHub.com
date: Tue, 18 Mar 2025 23:29:30 GMT
content-type: text/html; charset=utf-8
content-length: 0
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
access-control-allow-origin:
location: https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Trojan/ColorBug.exe
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
x-github-request-id: 8000:72BCA:817661:99CEF6:67DA01D8
GET

https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Trojan/ColorBug.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Trojan/ColorBug.exe HTTP/2.0
host: github.com
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _gh_sess=4U72s3X0mZzzqXDRHCr1YeBxp7SbAgPR1yYJ6PAUClYKv08FFqvpngSguexHNLKJOZKZpC5Z%2F3hym9%2BkYK%2BO1m8bgutJS2QXUoW6QxLzxmoKpmF3%2BYDdgYkgsCYwSq5aNMmSvfqQqy2%2FVss8%2BOVEeUPHeOgxwDH9N0y8ygGT7OfQzgEFi1WSgn%2FhH4n%2BpvOwq%2Bk9gkP%2FeZPnjmoQp%2FzVTmAhRXQzvw91DlHke2%2F9eYzj66lZgmyC%2FyjOrPbDPzCV%2F%2FRt115ZaQanM%2BAAYz8jUw%3D%3D--Ymgx73TLH3vd18aY--LGs0zgH98F%2Fg45%2FpqqQJ7w%3D%3D
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=0, i

Response

HTTP/2.0 302

server: GitHub.com
date: Tue, 18 Mar 2025 23:29:30 GMT
content-type: text/html; charset=utf-8
content-length: 0
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
access-control-allow-origin:
location: https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Trojan/ColorBug.exe
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
x-github-request-id: 8000:72BCA:817689:99CF22:67DA01DA
POST

https://api.github.com/_private/browser/stats

msedge.exe

Remote address:

20.26.156.210:443

Request

POST /_private/browser/stats HTTP/2.0
host: api.github.com
content-length: 608
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0
sec-ch-ua: "Not(A:Brand";v="99", "Microsoft Edge";v="133", "Chromium";v="133"
dnt: 1
content-type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
accept: */*
origin: https://github.com
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: _octo=GH1.1.1565031185.1742340444
cookie: logged_in=no
cookie: cpu_bucket=lg
cookie: preferred_color_mode=light
cookie: tz=UTC
priority: u=4, i

Response

HTTP/2.0 200

date: Tue, 18 Mar 2025 23:29:28 GMT
content-type: text/plain
content-length: 0
cache-control: no-cache
x-ratelimit-limit: 60
x-ratelimit-remaining: 60
x-ratelimit-reset: 1742344168
x-ratelimit-used: 0
x-ratelimit-resource: core
x-github-media-type: github.v3; format=json
x-github-api-version-selected: 2022-11-28
access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'
vary: Accept-Encoding, Accept, X-Requested-With
server: github.com
x-github-request-id: A4B8:F49BB:4C4ECB:5EF1CC:67DA01D8
DNS

ygfwukbetvqi.com

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

ygfwukbetvqi.com

IN A

Response
DNS

raw.githubusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

raw.githubusercontent.com

IN A

Response

raw.githubusercontent.com

IN A

185.199.109.133

raw.githubusercontent.com

IN A

185.199.110.133

raw.githubusercontent.com

IN A

185.199.108.133

raw.githubusercontent.com

IN A

185.199.111.133
DNS

raw.githubusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

raw.githubusercontent.com

IN Unknown

Response
DNS

jtppygdwlblv.net

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

jtppygdwlblv.net

IN A

Response
DNS

kpkqaojeopxc.biz

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

kpkqaojeopxc.biz

IN A

Response
DNS

lynhjvqxmlvm.ru

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

lynhjvqxmlvm.ru

IN A

Response
DNS

muiikewfpais.org

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

muiikewfpais.org

IN A

Response
DNS

nvuvobeyotfp.co.uk

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

nvuvobeyotfp.co.uk

IN A

Response
DNS

pbsnyqrapepg.com

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

pbsnyqrapepg.com

IN A

Response
DNS

qwnoayxhsscm.net

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

qwnoayxhsscm.net

IN A

Response
DNS

icrbykrasduw.biz

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

icrbykrasduw.biz

IN A

Response
DNS

icrbykrasduw.biz

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

icrbykrasduw.biz

IN A

Response
DNS

vosqipftgyqi.ru

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

vosqipftgyqi.ru

IN A

Response
DNS

jgcaftmbeqrj.org

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

jgcaftmbeqrj.org

IN A

Response
DNS

wsdpoyaurmnu.co.uk

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

wsdpoyaurmnu.co.uk

IN A

Response
DNS

kkwkyrhnelpy.info

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

kkwkyrhnelpy.info

IN A

Response
DNS

xwxaiwuhrhlk.com

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

xwxaiwuhrhlk.com

IN A

Response
DNS

lohjfbcopyml.net

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

lohjfbcopyml.net

IN A

Response
DNS

ybiyogpiduiw.biz

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

ybiyogpiduiw.biz

IN A

Response
DNS

ybiyogpiduiw.biz

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

ybiyogpiduiw.biz

IN A

Response
DNS

quarhapmqdvk.ru

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

quarhapmqdvk.ru

IN A

Response
DNS

rsbmiffleewe.org

{34184A33-0407-212E-3320-09040709E2C2}.exe

Remote address:

8.8.8.8:53

Request

rsbmiffleewe.org

IN A

Response

20.26.156.215:443

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk

tls, http2

msedge.exe

4.0kB
55.2kB
33
52

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk

HTTP Response

200
204.79.197.239:80

http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:sn7D6S1VL0h1pakyFSKcj5_cXfhMSlOWNCAqpFiP-R0&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

http

msedge.exe

883 B
1.1kB
5
5

HTTP Request

GET http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:sn7D6S1VL0h1pakyFSKcj5_cXfhMSlOWNCAqpFiP-R0&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Response

200
13.107.21.239:443

https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19041&devicefamily=desktop&installdate=1741877482&clientversion=133.0.3065.69&experimentationmode=2&scpguard=0&scpfull=0&scpver=0

tls, http2

msedge.exe

3.4kB
8.5kB
15
17

HTTP Request

GET https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19041&devicefamily=desktop&installdate=1741877482&clientversion=133.0.3065.69&experimentationmode=2&scpguard=0&scpfull=0&scpver=0

HTTP Response

200
94.245.104.56:443

api.edgeoffer.microsoft.com

tls

msedge.exe

2.2kB
311 B
8
5
95.101.143.218:443

https://copilot.microsoft.com/c/api/user/eligibility

tls, http2

msedge.exe

2.9kB
5.4kB
15
16

HTTP Request

GET https://copilot.microsoft.com/c/api/user/eligibility

HTTP Response

200
94.245.104.56:443

api.edgeoffer.microsoft.com

tls

msedge.exe

2.2kB
311 B
8
5
94.245.104.56:443

https://api.edgeoffer.microsoft.com/edgeoffer/pb/experiments?appId=edge-extensions&country=US

tls, http

msedge.exe

3.6kB
7.5kB
12
12

HTTP Request

GET https://api.edgeoffer.microsoft.com/edgeoffer/pb/experiments?appId=edge-extensions&country=US

HTTP Response

200
185.199.111.154:443

https://github.githubassets.com/assets/chunk-ui_packages_webauthn-get-element_element-entry_ts-c4e5a9b4f95a.js

tls, http2

msedge.exe

35.8kB
1.1MB
538
860

HTTP Request

GET https://github.githubassets.com/assets/light-605318cbe3a1.css

HTTP Request

GET https://github.githubassets.com/assets/primer-aaa714e5674d.css

HTTP Request

GET https://github.githubassets.com/assets/primer-primitives-225433424a87.css

HTTP Request

GET https://github.githubassets.com/assets/dark-bd1cb5575fff.css

HTTP Request

GET https://github.githubassets.com/assets/global-7d4d2344e7ab.css

HTTP Request

GET https://github.githubassets.com/assets/github-43ae85d4871b.css

HTTP Request

GET https://github.githubassets.com/assets/primer-react.8ab4763323c317a58873.module.css

HTTP Request

GET https://github.githubassets.com/assets/code-0210be90f4d3.css

HTTP Request

GET https://github.githubassets.com/assets/repository-4fce88777fa8.css

HTTP Request

GET https://github.githubassets.com/assets/notifications-subscriptions-menu.1bcff9205c241e99cff2.module.css

HTTP Request

GET https://github.githubassets.com/assets/react-code-view.a0633e3d36c876a6eaa1.module.css

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://github.githubassets.com/assets/wp-runtime-ba9cc7e99d50.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover_js-9da652f58479.js

HTTP Response

200

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_arianotify-polyfill_ariaNotify-polyfill_js-node_modules_github_mi-3abb8f-46b9f4874d95.js

HTTP Request

GET https://github.githubassets.com/assets/ui_packages_failbot_failbot_ts-857611aed7fe.js

HTTP Request

GET https://github.githubassets.com/assets/environment-f04cb2a9fc8c.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_index_mjs-0dbb79f97f8f.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_selector-observer_dist_index_esm_js-f690fd9ae3d5.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_relative-time-element_dist_index_js-62d275b7ddd9.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_text-expander-element_dist_index_js-78748950cb0c.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_auto-complete-element_dist_index_js-node_modules_github_catalyst_-8e9f78-a90ac05d2469.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-b5f1d7-a1760ffda83d.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_markdown-toolbar-element_dist_index_js-ceef33f593fa.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_primer_view-co-c44a69-8c52cf4cd0d3.js

HTTP Request

GET https://github.githubassets.com/assets/github-elements-394f8eb34f19.js

HTTP Request

GET https://github.githubassets.com/assets/element-registry-469992787dba.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_braintree_browser-detection_dist_browser-detection_js-node_modules_githu-bb80ec-72267f4e3ff9.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_lit-html_lit-html_js-be8cb88f481b.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_morphdom_dist_morphdom-e-7c534c-a4a1922eb55f.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-a03ee12d659a.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-893f9f-6cf3320416b8.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_color-convert_index_js-e3180fe3bcb3.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_quote-selection_dist_index_js-node_modules_github_session-resume_-69cfcc-b9c76c3f220a.js

HTTP Request

GET https://github.githubassets.com/assets/ui_packages_updatable-content_updatable-content_ts-2a55124d5c52.js

HTTP Request

GET https://github.githubassets.com/assets/app_assets_modules_github_behaviors_task-list_ts-app_assets_modules_github_sso_ts-ui_packages-900dde-768abe60b1f8.js

HTTP Request

GET https://github.githubassets.com/assets/app_assets_modules_github_sticky-scroll-into-view_ts-3e000c5d31a9.js

HTTP Request

GET https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-87a4ae-c8be3927cda8.js

HTTP Request

GET https://github.githubassets.com/assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-e429cff6ceb1.js

HTTP Request

GET https://github.githubassets.com/assets/behaviors-b90baffc54d6.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-f6223d90c7ba.js

HTTP Request

GET https://github.githubassets.com/assets/notifications-global-01e85cd1be94.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_github_catalyst_lib_inde-dbbea9-26cce2010167.js

HTTP Request

GET https://github.githubassets.com/assets/code-menu-1c0aedc134b1.js

HTTP Request

GET https://github.githubassets.com/assets/primer-react-c193b47d6fcb.js

HTTP Request

GET https://github.githubassets.com/assets/react-core-8d75451d837a.js

HTTP Request

GET https://github.githubassets.com/assets/react-lib-f1bca44e0926.js

HTTP Request

GET https://github.githubassets.com/assets/octicons-react-611691cca2f6.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_emotion_is-prop-valid_dist_emotion-is-prop-valid_esm_js-node_modules_emo-62da9f-2df2f32ec596.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_stacktrace-parser_dist_s-e7dcdd-9a233856b02c.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover-fn_js-55fea94174bf.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_dompurify_dist_purify_es_mjs-dd1d3ea6a436.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_lodash-es__Stack_js-node_modules_lodash-es__Uint8Array_js-node_modules_l-4faaa6-4a736fde5c2f.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_lodash-es__baseIsEqual_js-8929eb9718d5.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_react-intersection-observer_react-intersection-observer_modern_mjs-node_-b27033-ba82cef135e3.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_hydro-analytics-client_dist_analytics-client_js-node_modules_gith-23d21c-98fe23e2e322.js

HTTP Request

GET https://github.githubassets.com/assets/ui_packages_aria-live_aria-live_ts-ui_packages_promise-with-resolvers-polyfill_promise-with-r-17c672-34345cb18aac.js

HTTP Request

GET https://github.githubassets.com/assets/ui_packages_paths_index_ts-9300589383c3.js

HTTP Request

GET https://github.githubassets.com/assets/ui_packages_ref-selector_RefSelector_tsx-7496afc3784d.js

HTTP Request

GET https://github.githubassets.com/assets/ui_packages_commit-attribution_index_ts-ui_packages_commit-checks-status_index_ts-ui_packages-7094d4-15017f02e61c.js

HTTP Request

GET https://github.githubassets.com/assets/ui_packages_diffs_diff-parts_ts-b05d9274ce63.js

HTTP Request

GET https://github.githubassets.com/assets/ui_packages_code-view-shared_hooks_shortcuts_ts-ui_packages_code-view-shared_utilities_styles-0dc246-f8753c5db08d.js

HTTP Request

GET https://github.githubassets.com/assets/ui_packages_app-uuid_app-uuid_ts-ui_packages_document-metadata_document-metadata_ts-ui_packag-4d8de9-59f6285388bd.js

HTTP Request

GET https://github.githubassets.com/assets/ui_packages_code-view-shared_hooks_use-canonical-object_ts-ui_packages_code-view-shared_hooks-a83ec0-5ee2b562b57f.js

HTTP Request

GET https://github.githubassets.com/assets/app_assets_modules_github_blob-anchor_ts-ui_packages_code-nav_code-nav_ts-ui_packages_filter--8253c1-91468a3354f9.js

HTTP Request

GET https://github.githubassets.com/assets/react-code-view-98cc4e50e73a.js

HTTP Request

GET https://github.githubassets.com/assets/notifications-subscriptions-menu-58a0c58bfee4.js

HTTP Request

GET https://github.githubassets.com/assets/ui_packages_ui-commands_ui-commands_ts-97496b0f52ba.js

HTTP Request

GET https://github.githubassets.com/assets/keyboard-shortcuts-dialog-ac448fe050d6.js

HTTP Request

GET https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd67-56e2d9924e94.js

HTTP Request

GET https://github.githubassets.com/assets/sessions-730dca81d0a2.js

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://github.githubassets.com/assets/chunk-app_components_primer_experimental_select-panel-element_ts-dbc875e76b97.js

HTTP Request

GET https://github.githubassets.com/assets/chunk-app_components_primer_experimental_toggle-switch-element_ts-670c71d392c6.js

HTTP Request

GET https://github.githubassets.com/assets/chunk-app_components_search_custom-scopes-element_ts-abc100eaa2cb.js

HTTP Request

GET https://github.githubassets.com/assets/chunk-vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_github_combobox-nav_dist-b7767a-9ad7d4eda3d9.js

HTTP Request

GET https://github.githubassets.com/assets/ui_packages_query-builder-element_query-builder-element_ts-b492d6900d5e.js

HTTP Request

GET https://github.githubassets.com/assets/chunk-ui_packages_hydro-analytics_hydro-analytics_ts-ui_packages_jump-to-element_model_ts-880f27a93f7b.js

HTTP Request

GET https://github.githubassets.com/assets/chunk-app_components_search_qbsearch-input-element_ts-cf531d29cf91.js

HTTP Request

GET https://github.githubassets.com/assets/chunk-ui_packages_cookie-consent-link-element_element-entry_ts-8ca582ddd98a.js

HTTP Request

GET https://github.githubassets.com/assets/chunk-ui_packages_ghcc-consent-element_element-entry_ts-04338159da93.js

HTTP Request

GET https://github.githubassets.com/assets/chunk-vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_github_combobox-nav_dist-5f477b-eeb221e8a5a3.js

HTTP Request

GET https://github.githubassets.com/assets/chunk-ui_packages_hydro-analytics_hydro-analytics_ts-ui_packages_query-builder-element_element-entry_ts-37a12a0ee62c.js

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://github.githubassets.com/assets/chunk-ui_packages_webauthn-get-element_element-entry_ts-c4e5a9b4f95a.js

HTTP Response

200
185.199.111.154:443

github.githubassets.com

tls

msedge.exe

2.3kB
6.3kB
10
11
185.199.111.154:443

github.githubassets.com

tls

msedge.exe

2.3kB
6.3kB
10
11
185.199.111.154:443

github.githubassets.com

tls

msedge.exe

2.3kB
6.3kB
10
11
185.199.111.154:443

github.githubassets.com

tls

msedge.exe

2.3kB
6.3kB
10
12
185.199.111.154:443

github.githubassets.com

tls

msedge.exe

2.2kB
6.3kB
10
11
185.199.108.133:443

avatars.githubusercontent.com

tls

msedge.exe

2.3kB
6.4kB
10
12
185.199.111.154:443

github.githubassets.com

tls

msedge.exe

2.4kB
769 B
8
7
20.26.156.215:443

https://github.com/Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Trojan/Mobile_Legends_Adventure.apk

tls, http2

msedge.exe

4.3kB
20.9kB
24
26

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/security/overall-count

HTTP Response

200

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/refs?type=branch

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/latest-commit/master/Trojan/Mobile_Legends_Adventure.apk

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Trojan/Mobile_Legends_Adventure.apk

HTTP Response

200

HTTP Response

200

HTTP Response

200
140.82.114.22:443

collector.github.com

msedge.exe

98 B
52 B
2
1
204.79.197.239:443

edge.microsoft.com

msedge.exe

98 B
52 B
2
1
140.82.114.22:443

https://collector.github.com/github/collect

tls, http2

msedge.exe

10.0kB
6.7kB
24
21

HTTP Request

POST https://collector.github.com/github/collect

HTTP Request

POST https://collector.github.com/github/collect

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Response

204

HTTP Response

204
204.79.197.239:443

https://edge.microsoft.com/autofillservice/core/page/-4458411082827526514/6406379592175567390?GroupingThreshold=60&CIdAlgoVersion=2

tls, http2

msedge.exe

3.3kB
8.6kB
16
21

HTTP Request

GET https://edge.microsoft.com/autofillservice/core/page/-4458411082827526514/-3028829078604268615%7C6406379592175567390?GroupingThreshold=60&CIdAlgoVersion=2

HTTP Request

GET https://edge.microsoft.com/autofillservice/core/page/-4458411082827526514/6406379592175567390?GroupingThreshold=60&CIdAlgoVersion=2

HTTP Response

200

HTTP Response

200
185.199.111.154:443

https://github.githubassets.com/assets/chunk-vendors-node_modules_consent-banner_dist_consent-banner_js-362ca569b596.js

tls, http2

msedge.exe

3.5kB
11.4kB
19
21

HTTP Request

GET https://github.githubassets.com/assets/chunk-vendors-node_modules_consent-banner_dist_consent-banner_js-362ca569b596.js

HTTP Response

200
204.79.197.239:443

edge.microsoft.com

msedge.exe

98 B
52 B
2
1
20.26.156.215:443

https://github.com/Da2dalus/The-MALWARE-Repo/refs?type=branch

tls, http2

msedge.exe

4.1kB
16.7kB
23
22

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/refs?type=branch

HTTP Response

304

HTTP Request

GET https://github.com/manifest.json

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/refs?type=branch

HTTP Response

200

HTTP Response

304
185.199.108.133:443

https://avatars.githubusercontent.com/u/63458929?v=4&size=40

tls, http2

msedge.exe

3.3kB
3.2kB
13
14

HTTP Request

GET https://avatars.githubusercontent.com/u/63458929?v=4&size=40

HTTP Response

200
185.199.111.154:443

https://github.githubassets.com/favicons/favicon.png

tls, http2

msedge.exe

3.8kB
24.7kB
25
32

HTTP Request

GET https://github.githubassets.com/favicons/favicon.svg

HTTP Request

GET https://github.githubassets.com/assets/apple-touch-icon-144x144-b882e354c005.png

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://github.githubassets.com/favicons/favicon.png

HTTP Response

200
20.26.156.210:443

https://api.github.com/_private/browser/stats

tls, http2

msedge.exe

8.8kB
5.4kB
20
15

HTTP Request

POST https://api.github.com/_private/browser/stats

HTTP Response

200
150.171.27.10:443

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0d4c7638a2a74bbfa3149156d7bd926c&localId=w:BDEEEA66-9FF9-032D-B4CB-199BE88F3227&deviceId=6896216899373042&anid=

tls, http2

2.0kB
9.3kB
21
18

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0d4c7638a2a74bbfa3149156d7bd926c&localId=w:BDEEEA66-9FF9-032D-B4CB-199BE88F3227&deviceId=6896216899373042&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0d4c7638a2a74bbfa3149156d7bd926c&localId=w:BDEEEA66-9FF9-032D-B4CB-199BE88F3227&deviceId=6896216899373042&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0d4c7638a2a74bbfa3149156d7bd926c&localId=w:BDEEEA66-9FF9-032D-B4CB-199BE88F3227&deviceId=6896216899373042&anid=

HTTP Response

204
13.107.21.239:443

https://edge.microsoft.com/entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362

tls, http2

msedge.exe

4.2kB
3.3kB
18
22

HTTP Request

GET https://edge.microsoft.com/extensionwebstorebase/v1/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=edgecrx&prodchannel=&prodversion=133.0.3065.69&lang=en-US&acceptformat=crx3,puff&x=id%3Djmjflgjpcpepeafmmgdpfkogkghcpiha%26v%3D1.2.1%26installedby%3Dother%26uc%26ping%3Dr%253D5%2526e%253D1

HTTP Request

GET https://edge.microsoft.com/entityextractiontemplates/api/v1/assets/find-assets?name=domains_config_gz&version=3.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://edge.microsoft.com/entityextractiontemplates/api/v1/assets/find-assets?name=arbitration_priority_list&version=24.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362

HTTP Request

GET https://edge.microsoft.com/entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362

HTTP Response

200

HTTP Response

200
88.221.135.26:443

https://www.bing.com/api/shopping/v1/user/shoppingsettings?EnabledServiceFeaturesv2=edgeServerUX.shopping.aablockth,edgeServerUX.shopping.disableCashbackOnCouponCopy,edgeServerUX.shopping.enableColdStartCohort,edgeServerUX.shopping.msEdgeShoppingCashbackDismissTimeout2s,edgeServerUX.shopping.snDataFromOS,edgeServerUX.shopping.useExpSNData

tls, http2

msedge.exe

3.3kB
6.6kB
15
17

HTTP Request

GET https://www.bing.com/api/shopping/v1/user/shoppingsettings?EnabledServiceFeaturesv2=edgeServerUX.shopping.aablockth,edgeServerUX.shopping.disableCashbackOnCouponCopy,edgeServerUX.shopping.enableColdStartCohort,edgeServerUX.shopping.msEdgeShoppingCashbackDismissTimeout2s,edgeServerUX.shopping.snDataFromOS,edgeServerUX.shopping.useExpSNData

HTTP Response

200
204.79.197.239:443

https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist

tls, http2

msedge.exe

3.2kB
7.4kB
14
17

HTTP Request

GET https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist

HTTP Response

304
13.107.246.64:443

https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/24.0.4/asset?assetgroup=ArbitrationService

tls, http2

msedge.exe

4.4kB
30.0kB
33
35

HTTP Request

GET https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/24.0.4/asset?assetgroup=ArbitrationService

HTTP Response

200
20.26.156.210:443

https://api.github.com/_private/browser/stats

tls, http2

msedge.exe

11.6kB
13.0kB
51
48

HTTP Request

POST https://api.github.com/_private/browser/stats

HTTP Response

200

HTTP Request

POST https://api.github.com/_private/browser/stats

HTTP Response

200

HTTP Request

POST https://api.github.com/_private/browser/stats

HTTP Response

200

HTTP Request

POST https://api.github.com/_private/browser/stats

HTTP Response

200

HTTP Request

POST https://api.github.com/_private/browser/stats

HTTP Response

200

HTTP Request

POST https://api.github.com/_private/browser/stats

HTTP Response

200

HTTP Request

POST https://api.github.com/_private/browser/stats

HTTP Response

200
140.82.114.22:443

collector.github.com

tls

msedge.exe

2.4kB
4.7kB
11
10
140.82.114.22:443

https://collector.github.com/github/collect

tls, http2

msedge.exe

86.5kB
25.5kB
147
118

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Request

POST https://collector.github.com/github/collect

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Response

204

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Request

POST https://collector.github.com/github/collect

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Response

204

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Request

POST https://collector.github.com/github/collect

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Response

204

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Request

POST https://collector.github.com/github/collect

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204

HTTP Response

204

HTTP Response

204

HTTP Request

POST https://collector.github.com/github/collect

HTTP Response

204
20.26.156.215:443

https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/CryptoLocker.exe

tls, http2

msedge.exe

6.1kB
46.8kB
43
49

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware

HTTP Response

200

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/latest-commit/master/Ransomware

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/tree-commit-info/master/Ransomware

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Ransomware

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe

HTTP Response

200

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/latest-commit/master/Ransomware/CryptoLocker.exe

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Ransomware/CryptoLocker.exe

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/CryptoLocker.exe

HTTP Response

302

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/CryptoLocker.exe

HTTP Response

302
204.79.197.239:443

https://edge.microsoft.com/autofillservice/core/page/-4458411082827526514/-3028829078604268615?GroupingThreshold=60&CIdAlgoVersion=2

tls, http2

msedge.exe

3.5kB
7.5kB
16
16

HTTP Request

GET https://edge.microsoft.com/autofillservice/core/page/-4458411082827526514/-3028829078604268615?GroupingThreshold=60&CIdAlgoVersion=2

HTTP Response

200
185.199.108.133:443

avatars.githubusercontent.com

tls

msedge.exe

2.5kB
913 B
11
10
185.199.108.133:443

https://avatars.githubusercontent.com/u/123590232?v=4&size=40

tls, http2

msedge.exe

3.1kB
2.7kB
11
12

HTTP Request

GET https://avatars.githubusercontent.com/u/123590232?v=4&size=40

HTTP Response

200
13.107.246.64:443

https://edge-consumer-static.azureedge.net/mouse-gesture/config.json

tls, http2

msedge.exe

3.6kB
9.3kB
18
21

HTTP Request

GET https://edge-consumer-static.azureedge.net/mouse-gesture/config.json

HTTP Response

200
185.199.110.133:443

https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Trojan/ColorBug.exe

tls, http2

msedge.exe

9.3kB
179.7kB
140
150

HTTP Request

OPTIONS https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/CryptoLocker.exe

HTTP Response

403

HTTP Request

OPTIONS https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/WannaCry.exe

HTTP Response

403

HTTP Request

OPTIONS https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Trojan/ColorBug.exe

HTTP Response

403
185.199.109.133:443

https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Trojan/ColorBug.exe

tls, http2

msedge.exe

26.1kB
660.0kB
395
493

HTTP Request

GET https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/CryptoLocker.exe

HTTP Response

200

HTTP Request

GET https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Ransomware/WannaCry.exe

HTTP Response

200

HTTP Request

GET https://raw.githubusercontent.com/Da2dalus/The-MALWARE-Repo/refs/heads/master/Trojan/ColorBug.exe

HTTP Response

200
184.164.136.134:80

{34184A33-0407-212E-3320-09040709E2C2}.exe

260 B
5
13.107.246.64:443

https://static.edge.microsoftapp.net/default/cloud_config_observers.json

tls, http2

msedge.exe

3.7kB
9.7kB
17
18

HTTP Request

HEAD https://static.edge.microsoftapp.net/default/cloud_config_observers.json

HTTP Response

200

HTTP Request

GET https://static.edge.microsoftapp.net/default/cloud_config_observers.json

HTTP Response

200
204.79.197.239:443

https://edge.microsoft.com/componentupdater/api/v1/update

tls, http2

msedge.exe

20.0kB
13.7kB
37
31

HTTP Request

POST https://edge.microsoft.com/componentupdater/api/v1/update?cup2key=7:lES827Iqx3Qf_zLWoGB4vYKmJwU3ff4NYSA41dY72f0&cup2hreq=01b5b9f9528cbd0936eac53ea0c5b3c84011d9b6f5c490f516f0710a036a3385

HTTP Response

200

HTTP Request

POST https://edge.microsoft.com/componentupdater/api/v1/update

HTTP Response

200

HTTP Request

POST https://edge.microsoft.com/componentupdater/api/v1/update

HTTP Response

200
13.107.246.64:443

https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-US&setchannel=stable

tls, http2

msedge.exe

3.7kB
12.8kB
19
21

HTTP Request

GET https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-US&setchannel=stable

HTTP Response

200
142.250.180.3:80

http://c.pki.goog/r/r1.crl

http

384 B
354 B
4
3

HTTP Request

GET http://c.pki.goog/r/r1.crl

HTTP Response

304
91.81.129.180:80

http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1742408073&P2=404&P3=2&P4=i2AWjGQbTxub8zMFS4s%2b6VuECdCyGJJiTPiVF2mX1DfSFlYvX7IGzTdytJxx3l9wORxWhO%2fP0oFSAfibaW6lsg%3d%3d

http

6.4kB
94.7kB
51
77

HTTP Request

HEAD http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d

HTTP Response

200

HTTP Request

GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d

HTTP Response

206

HTTP Request

GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d

HTTP Response

206

HTTP Request

GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d

HTTP Response

206

HTTP Request

GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d

HTTP Response

206

HTTP Request

GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2a0d597c-a09c-4400-be86-87596dd2e696?P1=1742404474&P2=404&P3=2&P4=BTvO2vLzoEq5hY8%2fLW2MMoSS8bs6Nq1aY8voazbpi9pcDzA5Gj%2fgVRfDNmFb%2fDFoapdVYEGFWAQAMhwY9cSjRA%3d%3d

HTTP Response

206

HTTP Request

HEAD http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1742408073&P2=404&P3=2&P4=i2AWjGQbTxub8zMFS4s%2b6VuECdCyGJJiTPiVF2mX1DfSFlYvX7IGzTdytJxx3l9wORxWhO%2fP0oFSAfibaW6lsg%3d%3d

HTTP Response

200

HTTP Request

GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1742408073&P2=404&P3=2&P4=i2AWjGQbTxub8zMFS4s%2b6VuECdCyGJJiTPiVF2mX1DfSFlYvX7IGzTdytJxx3l9wORxWhO%2fP0oFSAfibaW6lsg%3d%3d

HTTP Response

206

HTTP Request

GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1742408073&P2=404&P3=2&P4=i2AWjGQbTxub8zMFS4s%2b6VuECdCyGJJiTPiVF2mX1DfSFlYvX7IGzTdytJxx3l9wORxWhO%2fP0oFSAfibaW6lsg%3d%3d

HTTP Response

206

HTTP Request

GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1742408073&P2=404&P3=2&P4=i2AWjGQbTxub8zMFS4s%2b6VuECdCyGJJiTPiVF2mX1DfSFlYvX7IGzTdytJxx3l9wORxWhO%2fP0oFSAfibaW6lsg%3d%3d

HTTP Response

206
20.26.156.215:443

https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe

tls, http2

msedge.exe

5.4kB
27.5kB
31
35

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe

HTTP Response

200

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/latest-commit/master/Ransomware/WannaCry.exe

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Ransomware/WannaCry.exe

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe

HTTP Response

302

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe

HTTP Response

302
127.0.0.1:9050

!WannaDecryptor!.exe
127.0.0.1:9150

!WannaDecryptor!.exe
127.0.0.1:9050

!WannaDecryptor!.exe
127.0.0.1:9150

!WannaDecryptor!.exe
127.0.0.1:9050

!WannaDecryptor!.exe
127.0.0.1:9150

!WannaDecryptor!.exe
127.0.0.1:9050

!WannaDecryptor!.exe
127.0.0.1:9150

!WannaDecryptor!.exe
127.0.0.1:9050

!WannaDecryptor!.exe
127.0.0.1:9150

!WannaDecryptor!.exe
127.0.0.1:9050

!WannaDecryptor!.exe
127.0.0.1:9150

!WannaDecryptor!.exe
127.0.0.1:9050

!WannaDecryptor!.exe
20.26.156.215:443

https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Trojan/ColorBug.exe

tls, http2

msedge.exe

4.7kB
27.4kB
24
33

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/ColorBug.exe

HTTP Response

200

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/latest-commit/master/Trojan/ColorBug.exe

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/deferred-metadata/master/Trojan/ColorBug.exe

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Trojan/ColorBug.exe

HTTP Response

302

HTTP Request

GET https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Trojan/ColorBug.exe

HTTP Response

302
20.26.156.210:443

https://api.github.com/_private/browser/stats

tls, http2

msedge.exe

3.8kB
5.2kB
13
12

HTTP Request

POST https://api.github.com/_private/browser/stats

HTTP Response

200
127.0.0.1:9150

!WannaDecryptor!.exe
127.0.0.1:9050

!WannaDecryptor!.exe
127.0.0.1:9150

!WannaDecryptor!.exe

8.8.8.8:53

github.com

dns

msedge.exe

56 B
72 B
1
1

DNS Request

github.com

DNS Response

20.26.156.215
8.8.8.8:53

github.com

dns

msedge.exe

56 B
121 B
1
1

DNS Request

github.com
8.8.8.8:53

edge.microsoft.com

dns

127 B
350 B
2
2

DNS Request

edge.microsoft.com

DNS Response

204.79.197.239

13.107.21.239

DNS Request

orpwpjkgrirv.info
8.8.8.8:53

edge.microsoft.com

dns

msedge.exe

64 B
209 B
1
1

DNS Request

edge.microsoft.com
8.8.8.8:53

edge.microsoft.com

dns

msedge.exe

64 B
208 B
1
1

DNS Request

edge.microsoft.com

DNS Response

13.107.21.239

204.79.197.239
8.8.8.8:53

edge.microsoft.com

dns

msedge.exe

64 B
206 B
1
1

DNS Request

edge.microsoft.com
8.8.8.8:53

copilot.microsoft.com

dns

msedge.exe

67 B
254 B
1
1

DNS Request

copilot.microsoft.com

DNS Response

95.101.143.218

88.221.135.26

88.221.135.2
8.8.8.8:53

copilot.microsoft.com

dns

msedge.exe

67 B
267 B
1
1

DNS Request

copilot.microsoft.com
8.8.8.8:53

api.edgeoffer.microsoft.com

dns

msedge.exe

73 B
226 B
1
1

DNS Request

api.edgeoffer.microsoft.com

DNS Response

94.245.104.56
8.8.8.8:53

api.edgeoffer.microsoft.com

dns

msedge.exe

73 B
271 B
1
1

DNS Request

api.edgeoffer.microsoft.com
8.8.8.8:53

github.githubassets.com

dns

msedge.exe

69 B
133 B
1
1

DNS Request

github.githubassets.com

DNS Response

185.199.111.154

185.199.109.154

185.199.108.154

185.199.110.154
8.8.8.8:53

github.githubassets.com

dns

msedge.exe

69 B
134 B
1
1

DNS Request

github.githubassets.com
8.8.8.8:53

avatars.githubusercontent.com

dns

msedge.exe

75 B
139 B
1
1

DNS Request

avatars.githubusercontent.com

DNS Response

185.199.108.133

185.199.109.133

185.199.110.133

185.199.111.133
8.8.8.8:53

avatars.githubusercontent.com

dns

msedge.exe

75 B
157 B
1
1

DNS Request

avatars.githubusercontent.com
8.8.8.8:53

user-images.githubusercontent.com

dns

msedge.exe

79 B
143 B
1
1

DNS Request

user-images.githubusercontent.com

DNS Response

185.199.108.133

185.199.110.133

185.199.109.133

185.199.111.133
8.8.8.8:53

user-images.githubusercontent.com

dns

msedge.exe

79 B
161 B
1
1

DNS Request

user-images.githubusercontent.com
8.8.8.8:53

github-cloud.s3.amazonaws.com

dns

msedge.exe

75 B
253 B
1
1

DNS Request

github-cloud.s3.amazonaws.com

DNS Response

52.216.171.163

52.216.152.100

3.5.12.190

3.5.11.194

16.182.38.249

16.15.216.47

3.5.30.23

52.217.202.73
8.8.8.8:53

github-cloud.s3.amazonaws.com

dns

msedge.exe

75 B
203 B
1
1

DNS Request

github-cloud.s3.amazonaws.com
8.8.8.8:53

collector.github.com

dns

msedge.exe

66 B
115 B
1
1

DNS Request

collector.github.com

DNS Response

140.82.114.22
8.8.8.8:53

collector.github.com

dns

msedge.exe

66 B
183 B
1
1

DNS Request

collector.github.com
8.8.8.8:53

edge.microsoft.com

dns

msedge.exe

64 B
208 B
1
1

DNS Request

edge.microsoft.com

DNS Response

204.79.197.239

13.107.21.239
8.8.8.8:53

edge.microsoft.com

dns

msedge.exe

64 B
206 B
1
1

DNS Request

edge.microsoft.com
8.8.8.8:53

api.github.com

dns

msedge.exe

60 B
76 B
1
1

DNS Request

api.github.com

DNS Response

20.26.156.210
8.8.8.8:53

api.github.com

dns

msedge.exe

60 B
125 B
1
1

DNS Request

api.github.com
8.8.8.8:53

g.bing.com

dns

56 B
148 B
1
1

DNS Request

g.bing.com

DNS Response

150.171.27.10

150.171.28.10
8.8.8.8:53

edge.microsoft.com

dns

msedge.exe

64 B
208 B
1
1

DNS Request

edge.microsoft.com

DNS Response

204.79.197.239

13.107.21.239
8.8.8.8:53

edge.microsoft.com

dns

msedge.exe

64 B
209 B
1
1

DNS Request

edge.microsoft.com
88.221.135.26:443

www.bing.com

https

msedge.exe

3.1kB
6.8kB
10
14
8.8.8.8:53

edgeassetservice.azureedge.net

dns

msedge.exe

76 B
243 B
1
1

DNS Request

edgeassetservice.azureedge.net

DNS Response

13.107.246.64
8.8.8.8:53

edgeassetservice.azureedge.net

dns

msedge.exe

76 B
287 B
1
1

DNS Request

edgeassetservice.azureedge.net
224.0.0.251:5353

msedge.exe

204 B
3
8.8.8.8:53

edge-consumer-static.azureedge.net

dns

msedge.exe

80 B
251 B
1
1

DNS Request

edge-consumer-static.azureedge.net

DNS Response

13.107.246.64
8.8.8.8:53

edge-consumer-static.azureedge.net

dns

msedge.exe

80 B
1

DNS Request

edge-consumer-static.azureedge.net
8.8.8.8:53

raw.githubusercontent.com

dns

msedge.exe

71 B
1

DNS Request

raw.githubusercontent.com
8.8.8.8:53

raw.githubusercontent.com

dns

msedge.exe

71 B
1

DNS Request

raw.githubusercontent.com
8.8.8.8:53

raw.githubusercontent.com

dns

msedge.exe

71 B
135 B
1
1

DNS Request

raw.githubusercontent.com

DNS Response

185.199.110.133

185.199.108.133

185.199.109.133

185.199.111.133
8.8.8.8:53

raw.githubusercontent.com

dns

msedge.exe

71 B
153 B
1
1

DNS Request

raw.githubusercontent.com
8.8.8.8:53

raw.githubusercontent.com

dns

msedge.exe

71 B
135 B
1
1

DNS Request

raw.githubusercontent.com

DNS Response

185.199.109.133

185.199.110.133

185.199.108.133

185.199.111.133
8.8.8.8:53

raw.githubusercontent.com

dns

msedge.exe

71 B
136 B
1
1

DNS Request

raw.githubusercontent.com
8.8.8.8:53

static.edge.microsoftapp.net

dns

msedge.exe

74 B
302 B
1
1

DNS Request

static.edge.microsoftapp.net

DNS Response

13.107.246.64
8.8.8.8:53

static.edge.microsoftapp.net

dns

msedge.exe

74 B
346 B
1
1

DNS Request

static.edge.microsoftapp.net
8.8.8.8:53

edge-mobile-static.azureedge.net

dns

msedge.exe

78 B
247 B
1
1

DNS Request

edge-mobile-static.azureedge.net

DNS Response

13.107.246.64
8.8.8.8:53

edge-mobile-static.azureedge.net

dns

msedge.exe

78 B
277 B
1
1

DNS Request

edge-mobile-static.azureedge.net
8.8.8.8:53

c.pki.goog

dns

56 B
107 B
1
1

DNS Request

c.pki.goog

DNS Response

142.250.180.3
8.8.8.8:53

msedge.b.tlu.dl.delivery.mp.microsoft.com

dns

87 B
344 B
1
1

DNS Request

msedge.b.tlu.dl.delivery.mp.microsoft.com

DNS Response

91.81.129.180

91.80.49.21

91.80.49.22

91.81.130.133

91.81.130.134
95.101.143.202:443

www.bing.com

https

msedge.exe

5.7kB
3.5kB
11
12
8.8.8.8:53

jygmsfujfepd.org

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
144 B
1
1

DNS Request

jygmsfujfepd.org
8.8.8.8:53

kubntkkwtxxr.co.uk

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

64 B
132 B
1
1

DNS Request

kubntkkwtxxr.co.uk
8.8.8.8:53

kynsyqdjgbdt.info

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

63 B
142 B
1
1

DNS Request

kynsyqdjgbdt.info
8.8.8.8:53

luitavswuuli.com

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

luitavswuuli.com
8.8.8.8:53

lhlvsaxkmnag.net

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

lhlvsaxkmnag.net
8.8.8.8:53

mdgwtfnxbhiu.biz

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
124 B
1
1

DNS Request

mdgwtfnxbhiu.biz
8.8.8.8:53

kkeyrqhnufym.ru

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

61 B
122 B
1
1

DNS Request

kkeyrqhnufym.ru
8.8.8.8:53

xuymoylpxjpb.org

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
144 B
1
1

DNS Request

xuymoylpxjpb.org
8.8.8.8:53

collector.github.com

dns

msedge.exe

66 B
1

DNS Request

collector.github.com
8.8.8.8:53

collector.github.com

dns

msedge.exe

66 B
1

DNS Request

collector.github.com
8.8.8.8:53

api.github.com

dns

msedge.exe

60 B
1

DNS Request

api.github.com
8.8.8.8:53

api.github.com

dns

msedge.exe

60 B
1

DNS Request

api.github.com
8.8.8.8:53

mpcqcacuyeel.co.uk

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

64 B
132 B
1
1

DNS Request

mpcqcacuyeel.co.uk
8.8.8.8:53

collector.github.com

dns

msedge.exe

66 B
115 B
1
1

DNS Request

collector.github.com

DNS Response

140.82.112.22
8.8.8.8:53

collector.github.com

dns

msedge.exe

66 B
164 B
1
1

DNS Request

collector.github.com
8.8.8.8:53

api.github.com

dns

msedge.exe

60 B
76 B
1
1

DNS Request

api.github.com

DNS Response

20.26.156.210
8.8.8.8:53

api.github.com

dns

msedge.exe

60 B
125 B
1
1

DNS Request

api.github.com
8.8.8.8:53

github.com

dns

msedge.exe

56 B
72 B
1
1

DNS Request

github.com

DNS Response

20.26.156.215
8.8.8.8:53

github.com

dns

msedge.exe

56 B
121 B
1
1

DNS Request

github.com
8.8.8.8:53

aaweyigwciua.info

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

63 B
142 B
1
1

DNS Request

aaweyigwciua.info
8.8.8.8:53

msjirlkocojp.com

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

124 B
135 B
2
1

DNS Request

msjirlkocojp.com

DNS Request

msjirlkocojp.com
8.8.8.8:53

adevotoqfsae.net

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

adevotoqfsae.net
8.8.8.8:53

oxhacufvgnoo.biz

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
124 B
1
1

DNS Request

oxhacufvgnoo.biz
8.8.8.8:53

cicnydjxjrfd.ru

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

122 B
122 B
2
1

DNS Request

cicnydjxjrfd.ru

DNS Request

cicnydjxjrfd.ru
8.8.8.8:53

opmdsfcltroy.org

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

186 B
144 B
3
1

DNS Request

opmdsfcltroy.org

DNS Request

opmdsfcltroy.org

DNS Request

opmdsfcltroy.org
8.8.8.8:53

plhetniswgbf.co.uk

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

64 B
132 B
1
1

DNS Request

plhetniswgbf.co.uk
8.8.8.8:53

edge.microsoft.com

dns

msedge.exe

64 B
208 B
1
1

DNS Request

edge.microsoft.com

DNS Response

13.107.21.239

204.79.197.239
8.8.8.8:53

edge.microsoft.com

dns

msedge.exe

64 B
206 B
1
1

DNS Request

edge.microsoft.com
8.8.8.8:53

qukudowsxqtx.info

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

63 B
142 B
1
1

DNS Request

qukudowsxqtx.info
8.8.8.8:53

rqfvewdabfge.com

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

rqfvewdabfge.com
8.8.8.8:53

qxrmsafmbbyc.net

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

qxrmsafmbbyc.net
8.8.8.8:53

rtmntiltepli.biz

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
124 B
1
1

DNS Request

rtmntiltepli.biz
8.8.8.8:53

sdpedjatfaeb.ru

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

122 B
122 B
2
1

DNS Request

sdpedjatfaeb.ru

DNS Request

sdpedjatfaeb.ru
8.8.8.8:53

tykfergbioqh.org

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
144 B
1
1

DNS Request

tykfergbioqh.org
8.8.8.8:53

ypdreignrmby.co.uk

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

64 B
132 B
1
1

DNS Request

ypdreignrmby.co.uk
8.8.8.8:53

maxfbntsgvvf.info

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

63 B
142 B
1
1

DNS Request

maxfbntsgvvf.info
8.8.8.8:53

axbuxxtcuost.com

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

axbuxxtcuost.com
8.8.8.8:53

niviudhhjxna.net

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

niviudhhjxna.net
8.8.8.8:53

drixtdhpufus.biz

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
124 B
1
1

DNS Request

drixtdhpufus.biz
8.8.8.8:53

qcdlqiuujopy.ru

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

61 B
122 B
1
1

DNS Request

qcdlqiuujopy.ru
8.8.8.8:53

eagbnsuexhmn.org

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
144 B
1
1

DNS Request

eagbnsuexhmn.org
8.8.8.8:53

rkbokxijmqht.co.uk

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

64 B
132 B
1
1

DNS Request

rkbokxijmqht.co.uk
8.8.8.8:53

dulvfwbwqyud.info

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

63 B
142 B
1
1

DNS Request

dulvfwbwqyud.info
8.8.8.8:53

eqgwgcqkfsdr.com

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

eqgwgcqkfsdr.com
8.8.8.8:53

edjyymoltbmx.net

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

edjyymoltbmx.net
8.8.8.8:53

fyeaareyiuum.biz

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
124 B
1
1

DNS Request

fyeaareyiuum.biz
8.8.8.8:53

hwqcurcytrow.ru

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

61 B
122 B
1
1

DNS Request

hwqcurcytrow.ru
8.8.8.8:53

isldvwrmilwl.org

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
144 B
1
1

DNS Request

isldvwrmilwl.org
8.8.8.8:53

ifofohpnwtgr.co.uk

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

64 B
132 B
1
1

DNS Request

ifofohpnwtgr.co.uk
8.8.8.8:53

jbjgpmfblnog.info

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

126 B
284 B
2
2

DNS Request

jbjgpmfblnog.info

DNS Request

jbjgpmfblnog.info
8.8.8.8:53

fohlxriymovj.com

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

fohlxriymovj.com
8.8.8.8:53

sycyuambpsmx.net

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

sycyuambpsmx.net
8.8.8.8:53

msedge.b.tlu.dl.delivery.mp.microsoft.com

dns

87 B
266 B
1
1

DNS Request

msedge.b.tlu.dl.delivery.mp.microsoft.com

DNS Response

199.232.210.172

199.232.214.172
8.8.8.8:53

htfdihvanyga.biz

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

124 B
248 B
2
2

DNS Request

htfdihvanyga.biz

DNS Request

htfdihvanyga.biz
8.8.8.8:53

ueaqfpacqdwo.ru

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

61 B
122 B
1
1

DNS Request

ueaqfpacqdwo.ru
8.8.8.8:53

jqmrnmjbphpd.org

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
144 B
1
1

DNS Request

jqmrnmjbphpd.org
8.8.8.8:53

wbhfkundslgr.co.uk

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

64 B
132 B
1
1

DNS Request

wbhfkundslgr.co.uk
8.8.8.8:53

lvkjxcwcqrat.info

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

126 B
284 B
2
2

DNS Request

lvkjxcwcqrat.info

DNS Request

lvkjxcwcqrat.info
95.101.143.202:443

www.bing.com

https

msedge.exe

3.0kB
3.7kB
7
12
8.8.8.8:53

ygfwukbetvqi.com

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

ygfwukbetvqi.com
8.8.8.8:53

raw.githubusercontent.com

dns

msedge.exe

71 B
135 B
1
1

DNS Request

raw.githubusercontent.com

DNS Response

185.199.109.133

185.199.110.133

185.199.108.133

185.199.111.133
8.8.8.8:53

raw.githubusercontent.com

dns

msedge.exe

71 B
153 B
1
1

DNS Request

raw.githubusercontent.com
8.8.8.8:53

jtppygdwlblv.net

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

jtppygdwlblv.net
8.8.8.8:53

kpkqaojeopxc.biz

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
124 B
1
1

DNS Request

kpkqaojeopxc.biz
8.8.8.8:53

lynhjvqxmlvm.ru

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

61 B
122 B
1
1

DNS Request

lynhjvqxmlvm.ru
8.8.8.8:53

muiikewfpais.org

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
144 B
1
1

DNS Request

muiikewfpais.org
8.8.8.8:53

nvuvobeyotfp.co.uk

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

64 B
132 B
1
1

DNS Request

nvuvobeyotfp.co.uk
8.8.8.8:53

pbsnyqrapepg.com

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

pbsnyqrapepg.com
8.8.8.8:53

qwnoayxhsscm.net

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

qwnoayxhsscm.net
8.8.8.8:53

icrbykrasduw.biz

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

124 B
248 B
2
2

DNS Request

icrbykrasduw.biz

DNS Request

icrbykrasduw.biz
8.8.8.8:53

vosqipftgyqi.ru

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

61 B
122 B
1
1

DNS Request

vosqipftgyqi.ru
8.8.8.8:53

jgcaftmbeqrj.org

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
144 B
1
1

DNS Request

jgcaftmbeqrj.org
8.8.8.8:53

wsdpoyaurmnu.co.uk

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

64 B
132 B
1
1

DNS Request

wsdpoyaurmnu.co.uk
8.8.8.8:53

kkwkyrhnelpy.info

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

63 B
142 B
1
1

DNS Request

kkwkyrhnelpy.info
8.8.8.8:53

xwxaiwuhrhlk.com

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

xwxaiwuhrhlk.com
8.8.8.8:53

lohjfbcopyml.net

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
135 B
1
1

DNS Request

lohjfbcopyml.net
8.8.8.8:53

ybiyogpiduiw.biz

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

124 B
248 B
2
2

DNS Request

ybiyogpiduiw.biz

DNS Request

ybiyogpiduiw.biz
8.8.8.8:53

quarhapmqdvk.ru

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

61 B
122 B
1
1

DNS Request

quarhapmqdvk.ru
8.8.8.8:53

rsbmiffleewe.org

dns

{34184A33-0407-212E-3320-09040709E2C2}.exe

62 B
144 B
1
1

DNS Request

rsbmiffleewe.org
8.8.8.8:53

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5460_144710394\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5460_144710394\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1691947829\manifest.json

Filesize
72B

MD5
a30b19bb414d78fff00fc7855d6ed5fd

SHA1
2a6408f2829e964c578751bf29ec4f702412c11e

SHA256
9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f

SHA512
66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7b0736a36bad51260e5db322736df2e9

SHA1
30af14ed09d3f769230d67f51e0adb955833673e

SHA256
0d2adfd06d505b9020c292d30597083d808bfd90ddc0fe173def5db96832a087

SHA512
caabdc6a8601b93f3c082e6506b3c9efe2242b90e92e86306dc0bd4857d33343ba395325fabb21f5db562d3e3932f52f77de547f379072d0154efd5f1b1cdeb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
35a1590735765f0f96ccd0299a52cb0d

SHA1
79d2a2b74b737cf6b0dc1b63b1ea02c80d91b857

SHA256
8b20c84760ea50256363cecdbda69323f615087d9d262dd10c0293eb5aae0142

SHA512
17eeb854c008f4acdeda6453d31271ac6b410eea13483f0f58073018dba757a0d717744ab46626a7d17071c8296ca5babfa32e63c02b7af6f79235c17c90dd2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57c4b7.TMP

Filesize
3KB

MD5
49c9c12e88cbdf174f2b530e05861ebb

SHA1
94a65ee5d20dcdb0fb76bee5b20aeeaa3e3f01f1

SHA256
67a8dfe020e27879a2f0fb5d3b91503b11a28471b0df1e46be6796abdc6003f9

SHA512
aef4ecc773858db121116f1680787807502b9710507ac01039a839f31fc90cabd01429ab32643f9236b882b59d57f7fd3de0a7bf9575509548fa35016a21daed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
f4d3c6d4c04837d0145499880514828d

SHA1
5ca9fc6e44e1113362fd8c0c92bff60568216aa2

SHA256
27e6b684576cda9d55bd5e9649df01f3868e3b3c30057fe048352b74156b9b45

SHA512
d6a5e90d84d4a399c9eab918702121092e7ea7c9c857995152762d0007eeec912783604419596c4798eb746e617299197871371c371b50d8a5297da0bd465d6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
91472ca1cb29fddec4f95599e07fc9a3

SHA1
a78a1f91f7460463934e2246f5e0431fa9eabcd1

SHA256
24c008aa6b6f9f99e0ca53e7ced3ea8a7764c32bef7dd69a6df0b03b3588c4da

SHA512
dd3639b7b3e660451e0404e02173efd90761acbb3e819a45af15d1d80aedeb677ebf0112dce632bf89bafa63ba5e71e7709204be78a1b6893fb5bb85a8a9a861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
504290aaf15a8a509bc494d9dcdcc2fa

SHA1
de18d6e3eaa2d878cf7427a9d4314392eceb4094

SHA256
961e35928656776964ff67c3ae34352c3183727d5c3fee9737433e5585a0a487

SHA512
4d2e59622dd261ab5e7fa57d76056b8e3cbe73900850041728b3dfc7d051863fbdd50cb6d0b92b2a3766a291b52b350f8e29e9bd3844dcede5deb441acde71e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
e2db6532b2feacab1110270d5b61d2c0

SHA1
e4276faadac6ea1c4bb5f814e8150918b8b6faa4

SHA256
4282f27e151f35fa8650df9b4d19423b595fe6cadc773ccf19f206bdfea7d9f5

SHA512
aec7a40d426fdb362384640c75f0a213d38145bdff8aedd997bd135c0e34d2a96924d2196677403e27f6cbcaa32191e66f360572080302a5996506e15a151332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
63fa3fc80d4ecee163bec727c48128d4

SHA1
6e013b3f16d74c35b6ce5887ab70c757907218c3

SHA256
50f3c61a69c857ba3516fbb7b0c138f5b55c689b6c9c7f3638e2d5813d4849fc

SHA512
aa75f48938566c665a1c89abc17c78b60dfc29ed008bfaa72008a2e6424435b379d8508bce41f09f164aaa899ce9f28f5f8e6055686d0ac1c13f4fe9ff6f9d92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
2348dee033c271b043ecd17a61eabe02

SHA1
b066a8f3509ce486dd350b3e03ad2e2c63bc23b0

SHA256
1095cac8fa3016cefdd7a322da1b1f9fbeba7285158e76a66b749d7ec19dd304

SHA512
a5f5d196d1a6dfd4c8f420b741c7af90a303e1bd135a5c6cd764f86c615d63b2314d957a9746ad3315241593280304985971b320c8cb4023dac2e47c34bf61ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
18KB

MD5
a6cbf22aaeff3fe9f6981d97b5bcedee

SHA1
a4972f1f567bb4cb92858f41d29a3415066e836a

SHA256
3c5529b40adca0e39335a2c951a6d27522e389c1c550f9015506df3f0816c8cb

SHA512
8d14410f2f89fdffc34a427e6e83068dc1b802cb20956d5b06b687c8ff450ea4d4a5ce4bfad6ccc3e1a5b028aceb4e465174e470ea2d3b8f48662e7b67701207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
08289ed817c176cd8097a23b88e02177

SHA1
d61bd7c5d23bc7fb8dd1b6138e7daab34551b1bd

SHA256
2a94bf23d90547f6b6ad0ff120734cfc0dac8d3a6af984389354c68b02251cd1

SHA512
c3f837dd7535cbae169188a16ec622d98b1c54106fd82bb96ea0515628be4ae318473c38d1f8a9e762c184694e0c3bcb49022f1f5eb823facbe534157aea9de0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d7674259-0f81-4d9a-9f16-1bd5b044d440.tmp

Filesize
469B

MD5
5bcff5e0167e8bce93196045f881bd85

SHA1
a41da6c29f74882f0aa905fa025ac1c51c15f5bf

SHA256
1998458237dff0b8ac152664d0e6028d11631e7dd9f0bd5cf57ce8b16ea36e31

SHA512
20b2e1ceca09e2eaed24d422f04c46d0186be758014246599d09bd48a359c1f6dd64ef31524028aef6814bc5446c9b164179e772e3d484ee7f5bd159c48eb029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
f69e6346ab50289e5c201fdcf8e7f937

SHA1
d194b325680f17d2d9bf1659eafa904f2f08b566

SHA256
a314ffdf04e64b3c16feeb9a2d3ab278cb89a5c49c160b18e0d86f54aedd4e00

SHA512
0f9d2305285880fee2ea99b5117ab26ef07448530c35798e03efaaf47c9ac765b9ded4ad6ae9c1c82c625ad106e9efcd6075af5a5ada31af2bc97dee5e5f02de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
f0ddf8b220bdbc69f8aacea5ed46e548

SHA1
b2f25ffbde7c32ef0875043e6cd7eb80de7d9005

SHA256
f5b1e1311eb6aed01f040a5a3f7abdb8d7ca6fa021dabb1f9bb2acc2f0be80dd

SHA512
73a295dbd60548281ade2dec341d238b7fcc8c7d74fa1ca150e83d8a88e70afafe3d5f8457ac8e6ff715485f78f409e94a0a36fb9523d8855336f7e06bcc8862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
c7f13e7db8abfcf3f4f55e29d51555cc

SHA1
7743ba9f5dfe66eae17b191341b0ca0f5850e524

SHA256
c25d9c05d275badb25fa2cabf4f79afa1c9924c580b81cc3b71df0a638d35094

SHA512
8f4ff3462058a92cf0487da89e7314f17651e430cb7b36d3d0eff9309b1280da265791bbe666c82877a37d57e2b7887cf8ce626fa2ff3d50270fe8ffa1f6d294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
c019745792c6a9f6c0c58c3d8ba11a7c

SHA1
f5b88bf243e6d8ccfda7e209f4ccb0cf88734a58

SHA256
0df0a140072f1707c7acb12320abfb9805836bb4aadb87bdb7d5b0d8756f4ad7

SHA512
6577b0f65b097a83ddea9eca4eab2d907bd0fc28c60758348269a680e449f65ef3cb0cd4c9a3535b7dfa210ffcdafca3cd81662bb4a0df2569a9a5b813fd0ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
117d6515960f17669f1383603fd0bdfd

SHA1
d30723e8544ed5fffe5fcd557face24d354272c6

SHA256
3afc810303c63f5d479e0e74eb139d62a9b47343b84f57fd091a13723cedc7d8

SHA512
e24e755f2dd583322c7d1574776b0e6930cfb35265f07fb781fc7efce72e4a0a85c15bea74381eb31668826867ba73026bbe5b82c9d94069cc202ed11f92def7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
499f0ac70c04d7a4d7fa6a7c51271978

SHA1
1e1994d3e7f7948a82f3c132a0cb4ca87d1ff610

SHA256
d18d5dea6d525215902411c2d4d759e0ae2fbfec412b6227d452ecdd9dbed508

SHA512
c5105379779d44cbc6e9d041114bb006e00d0729b537a1f7cf555943fd630dd696690c4e0f6b309658b2ffc31fa7b3a9c4668b102e0032a47cbc5cab8b143928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
cfb7117d80b461ecb25dbcd7f0c904d3

SHA1
c2eddb340e4948eb54e211a8108ecfce3fad689d

SHA256
1a848ee7d4b850ed11fed0e01c39b0127fbf803ca65ebe543eb08d42157d6b48

SHA512
249ccebca82e7b03afa462242de0c8f2f6312e27d329656b666646d4dadd38dcdc364d5e34b45e831933c64d370cbd3e9f2720bed7e21fbf76b232b3948e4055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
4c07bdf887752eb3725603bd2da07965

SHA1
048812ffe2fd73a881e5a16d53bc81503af4638c

SHA256
325779fbbae428087a6b7a8141984f9884ad0cd55d3c4dcc4396358f3d5f4ee4

SHA512
76b11df3a4bcb46cd564df5d975f74482e24c701c3b0f25a70ef79696314c3723dbd492e8bdc0dd36032cd9360df8d991c6df2a3c3b7050a2f4c1e2bd9accc07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
272ae6b5a2811db6e00c58ea8f715b26

SHA1
3358ce1f38f0e7edced1bf696dd39139e052419c

SHA256
93d65e81be38f7f12e048d90664cabd00e68548e0774cdfa82b7bb890fc0c7eb

SHA512
b0063822ac1209144a7c56cc35d402c1ae4551add3881c056f0347401c91597b4bd0d73212d723657ded38907406a09b239dfd1f5f4d17acdf762cca958056d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57d6b9.TMP

Filesize
392B

MD5
74edbc7fade4c20f0d04ffa46d3a498e

SHA1
ad3bbeeb132358a9fabd319b877801cc3d318234

SHA256
242647ed6c9ca2c709d6ba2d562f10d3afed07f0d9494974c75486fc45b64e2c

SHA512
5dbe1455b9e72ddf2559d8ac377becbd3b4931fdbb63a1d5a996ea41424a3a5377e0f1c5af0d97ae56bd08ea4b10f6e989fd3526a35d0b3046952eb9d2d429b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb

Filesize
163KB

MD5
bd6846ffa7f4cf897b5323e4a5dcd551

SHA1
a6596cdc8de199492791faa39ce6096cf39295cd

SHA256
854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666

SHA512
aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb

Filesize
3KB

MD5
17c10dbe88d84b9309e6d151923ce116

SHA1
9ad2553c061ddcc07e6f66ce4f9e30290c056bdf

SHA256
3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e

SHA512
ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db

Filesize
68KB

MD5
c485b2f56d3cd9104905a14de0e6f3ed

SHA1
011c8a86414ef18a36d5501534fd2cad5ae63011

SHA256
7f456393457a1aa02eddc37069d74a0a9e19062086a66333763c8127177c5c9c

SHA512
7347e4ccf623cc2f3bc05cfe15906e212bd2a1631dbef1cad20dcd8179b7d0184b1f6332116ee9b42f75ebfcdc36aa2dcfcb210c1a31bbcd5bd50a2c1db55498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
cb7c480b9bafcdd7b92f25c599220fb5

SHA1
3fa094f4287528b09702b9888703866d6629a529

SHA256
05443b9c5631e4aa1e57161ed71676c6dfea1bc6176b588bd54c980d9b8bdd9c

SHA512
9103357290751aeafd73a3ca838a32102bb92d82305bceeb1ce747ca90c359a2e8d548fd5c28dd549f185681bc14d383fddbdad9c4bf9c6415811b60d0626b88

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
2b6916abb8f3c144fbe8709be7a97bcb

SHA1
cb14a327962a99fcdb1398fd8fd22c4d08be68b2

SHA256
bb7db9446b0e49461912d3246cfb1165a4c397f3570c5d9afd92b8e6c926eaea

SHA512
eabd3c7bc31a41f5b342b57e7cc670b236e1e3fa40a44a4cd57dddee3c9adaef4348894a14db6a3f315a996cfcb0d319f937d9fcc15155a252d3aa7099cffef8

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
295886453084097cfc0703171f278e13

SHA1
2ff7d04fe1cc7a631953bc0ae01a17c5b518d446

SHA256
768fee5fd0fb78d5474b9c77b4cda4e43b350f2f5bb3aed9e6750d93b8a7dc51

SHA512
ee612ca3f5b0a3cf1060884b983e66429fbe4de267896ab4a1d900e6c333b5ed2db741de1b7f8b3c99cf099fc2f36726599428d535991c164cb453416c565656

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
e85cd7910df51e04bb8aa8ea0ac0ff45

SHA1
663d0864090c7f3f50b78d79d31361afceb2d54b

SHA256
bcd44a31c74947c58f2b080375da663fd69746c54df4fe534237ec7a570ecf25

SHA512
9ad164fac6d1bdadbfa5c5b057ca35bd8118a4d976d9d7a3755a1d4d59066012c35d32c2e4e1029827164ef15c38f369e9a41bfe4405a47436e41e15505d05e3

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
2738329026662dd08bc4b19d47ecd25d

SHA1
357a4476892e9bbf641b82f84f72747a81c4cf0f

SHA256
72fe62e709b0a55e3f2e39b5bbf41dc608acfebd183afebae4711079ec3cff18

SHA512
e2506cc5c4e295c3931085285678795693ef49246d5167b1e01d368966d5cee1c31b78fa78824632d77bd36527276835929e360491668e574ee5fa2d94908795

Download Submit
C:\Users\Admin\Downloads\214501742340527.bat

Filesize
318B

MD5
a261428b490a45438c0d55781a9c6e75

SHA1
e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e

SHA256
4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44

SHA512
304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40

Download Submit
C:\Users\Admin\Downloads\ColorBug.exe

Filesize
53KB

MD5
6536b10e5a713803d034c607d2de19e3

SHA1
a6000c05f565a36d2250bdab2ce78f505ca624b7

SHA256
775ba68597507cf3c24663f5016d257446abeb66627f20f8f832c0860cad84de

SHA512
61727cf0b150aad6965b4f118f33fd43600fb23dde5f0a3e780cc9998dfcc038b7542bfae9043ce28fb08d613c2a91ff9166f28a2a449d0e3253adc2cb110018

Download Submit
C:\Users\Admin\Downloads\CryptoLocker.exe.crdownload

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit
C:\Users\Admin\Downloads\WannaCry.exe

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\c.vbs

Filesize
201B

MD5
02b937ceef5da308c5689fcdb3fb12e9

SHA1
fa5490ea513c1b0ee01038c18cb641a51f459507

SHA256
5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1

SHA512
843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
c47e21c8982c497eddefc8eeb0e5d8bc

SHA1
95cfa5e06a60208bf21d278dd41b9feb84777d77

SHA256
36cfd6a94b089688635646e7e3d980db51ab707c238d8dfa970ce4c05bb7591e

SHA512
e5c366ada547ab66a38a0a7bd4f726146c7adb2fc1640f2fa415b46ac06e663a399fc211298d7cb3348e1e8cedeedc072eb69e07caa445e0bea83337f813bb2d

Download Submit
C:\Users\Admin\Downloads\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\Downloads\r.wry

Filesize
729B

MD5
880e6a619106b3def7e1255f67cb8099

SHA1
8b3a90b2103a92d9facbfb1f64cb0841d97b4de7

SHA256
c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35

SHA512
c35ca30e0131ae4ee3429610ce4914a36b681d2c406f67816f725aa336969c2996347268cb3d19c22abaa4e2740ae86f4210b872610a38b4fa09ee80fcf36243

Download Submit
C:\Users\Admin\Downloads\t.wry

Filesize
68KB

MD5
5557ee73699322602d9ae8294e64ce10

SHA1
1759643cf8bfd0fb8447fd31c5b616397c27be96

SHA256
a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825

SHA512
77740de21603fe5dbb0d9971e18ec438a9df7aaa5cea6bd6ef5410e0ab38a06ce77fbaeb8fc68e0177323e6f21d0cee9410e21b7e77e8d60cc17f7d93fdb3d5e

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
memory/872-598-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2124-2319-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2476-2321-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2840-2279-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2896-2332-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3384-2315-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4184-2331-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4432-2333-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4472-2317-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4592-2327-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4768-2311-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5380-2313-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5400-2328-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5500-2300-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5784-2323-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6124-2329-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request