Edit tour

Windows Analysis Report
I8R24VDCOi.exe

Overview

General Information

Sample name:	I8R24VDCOi.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	6e3c5f5597966cff1e50c43970281b70b31534e3
Analysis ID:	1541157
MD5:	b5cd3cbe8995dfc01f035b107322db51
SHA1:	6e3c5f5597966cff1e50c43970281b70b31534e3
SHA256:	9c28d8da7a38029e84dda55e3509399ca89655731a6cb275ff59b3fd13fd4649
Infos:

Detection

Score:	6
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Creates a process in suspended mode (likely to inject code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

I8R24VDCOi.exe (PID: 7128 cmdline: "C:\Users\user\Desktop\I8R24VDCOi.exe" MD5: B5CD3CBE8995DFC01F035B107322DB51)

msedgewebview2.exe (PID: 5080 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-GB --mojo-named-platform-channel-pipe=7128.6536.1550348927669786693 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 1364 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffdfb2e8e88,0x7ffdfb2e8e98,0x7ffdfb2e8ea8 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 7188 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:2 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 7264 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2840 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:3 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 7284 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=3308 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:8 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 7304 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5636010885 --mojo-platform-channel-handle=3552 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 7532 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5637143084 --mojo-platform-channel-handle=4000 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 7612 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5639600820 --mojo-platform-channel-handle=4116 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 7676 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5640359025 --mojo-platform-channel-handle=4364 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 7856 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5644726732 --mojo-platform-channel-handle=3900 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 7984 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5646187664 --mojo-platform-channel-handle=3876 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 3312 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5649044302 --mojo-platform-channel-handle=3892 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 7832 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5663800043 --mojo-platform-channel-handle=4900 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 2368 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5208 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:2 MD5: 9909D978B39FB7369F511D8506C17CA0)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.153:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\Default\Network\fa060d0f-39c1-4b0a-b653-5e7aa71261e2.tmp	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\Default\	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\Default\Network\Network Persistent State	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\	Jump to behavior

Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133
Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41

Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.95.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.94.41

Source: msedgewebview2.exe, 00000008.00000003.1738274183.00001AFC008A0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000008.00000002.1776074254.00001AFC008A0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.1745832104.00004B50008A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://microsoftstart.msn.cn/https://rewards.microsoft.com/https://www.microsoftnews.com/https://www.facebook.com/www.staging-bing-int.comaction.getBadgeTextColorhttps://outlook.live.com/https://rewards.bing.com/https://www.microsoftnews.cn/translatorserp.bing.comhttps://translator.bing.com/manifest:action equals www.facebook.com (Facebook)
Source: msedgewebview2.exe, 0000000C.00000002.1849691539.0000503C00874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://microsoftstart.msn.cn/https://rewards.microsoft.com/https://www.microsoftnews.com/https://www.facebook.com/www.staging-bing-int.comaction.getBadgeTextColorhttps://outlook.live.com/https://rewards.bing.com/https://www.microsoftnews.cn/*translatorserp.bing.commanifest:browser_action equals www.facebook.com (Facebook)
Source: msedgewebview2.exe, 0000000B.00000003.1804650926.000023480087C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000B.00000003.1853726164.000023480087C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000B.00000003.1974438974.000023480087C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rewards.microsoft.com/https://www.microsoftnews.com/https://www.facebook.com/www.staging-bing-int.comaction.getBadgeTextColorhttps://outlook.live.com/https://rewards.bing.com/https://www.microsoftnews.cn/translatorserp.bing.comhttps://translator.bing.com/*manifest:action equals www.facebook.com (Facebook)
Source: msedgewebview2.exe, 00000008.00000003.1738274183.00001AFC008A0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000008.00000002.1776074254.00001AFC008A0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.1745832104.00004B50008A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/* equals www.facebook.com (Facebook)
Source: msedgewebview2.exe, 00000008.00000002.1772769738.00001AFC002A8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.1786405657.00004B50002A8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.1846280085.0000503C002A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: lencx.github.io
Source: global traffic	DNS traffic detected: DNS query: chat.openai.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: chatgpt.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:05 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9088Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:05 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9195Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:07 GMTContent-Type: text/html; charset=UTF-8Content-Length: 10478Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:09 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9612Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:12 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9569Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:16 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9249Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:26 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9642Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:27 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9344Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:28 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9612Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:30 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9313Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:32 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9292Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:35 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9591Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:44 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9621Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:46 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9612Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 12:14:48 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9612Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()X-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: I8R24VDCOi.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x4e3a00
Source: I8R24VDCOi.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x4d9a00

Source: global traffic	HTTP traffic detected: OPTIONS /report/v4?s=AV6wXoXwDiFa2kAZAebAMJt%2BTSlB3xS0XrY%2FGLd8wAnU7YsZ%2Fo6%2F97SrMSN%2FcKc0D4ciXoI%2BeFr99NoPlXrZcVlvOqSHzvKjKakolcYLTBKlFN4hA5mTeQt08Bj%2BbTU5BQ%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveOrigin: https://chat.openai.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: chatgpt.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: chatgpt.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8d79e2728ba4c86f HTTP/1.1Host: chatgpt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://chatgpt.com/?__cf_chl_rt_tk=OWlVE8SPcNBU.4PYac3.CvmFdPDNrnMWud3IPRv2r_k-1729772045-1.0.1.1-FaJ15L4rrWPMnphtUskDPUMNkVYePEnoZLSvDxWCI3UAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=sdHBg6oF4H6FWxQ60X.5uZVt6GdFGgW512xlAXuvvIk-1729772045-1.0.1.1-UckP2AiJT2n5xudaqhGVxhSavJQwoe38qCHkxcPijBK0X3f2tPoC_bu0LHj8Suz0I5H_pdE4EUnJAsWaGRSrKQ
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8d79e2774d442cde HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://chatgpt.com/?__cf_chl_rt_tk=OMNPTxa5dcbdWDC5zF10_TTA4FAlFeYFzZm.zKDL9MY-1729772045-1.0.1.1-oGUTHZxBlovQ_gIL5xQ1jaizOH9wXBLvxoJ_1YkF2p4Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=oJoiX1NMYw6DM_ZM10iV7_U6hTYQdoaWYs_uOT9BO6Q-1729772045-1.0.1.1-Hi.Ef6VnqbNV0f6LNqlxcUCvkKrrA8_EeBgr1r5yrlAfwT4_lyZXY1IyQeOWdq10DNyC4sCh3837wjg7Vxiz4Q
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=oJoiX1NMYw6DM_ZM10iV7_U6hTYQdoaWYs_uOT9BO6Q-1729772045-1.0.1.1-Hi.Ef6VnqbNV0f6LNqlxcUCvkKrrA8_EeBgr1r5yrlAfwT4_lyZXY1IyQeOWdq10DNyC4sCh3837wjg7Vxiz4Q
Source: global traffic	HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1625211542:1729702664:ZO1Pl1MsCdl5JCd-iTGVq9XUJ0ETrABYlg4qWlIqm4k/8d79e2728ba4c86f/Bf6z6i3aZvmXsh67IRrDkjru2Pn7kPeG3VRRQ9wYEBc-1729772045-1.2.1.1-AI0RlJhjkb4IECuBan0tbsoSM9D5SbozubHBKHccN023GGR2kPZuzNrzloT7IO7O HTTP/1.1Host: chatgpt.comConnection: keep-aliveContent-Length: 4576User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1CF-Challenge: Bf6z6i3aZvmXsh67IRrDkjru2Pn7kPeG3VRRQ9wYEBc-1729772045-1.2.1.1-AI0RlJhjkb4IECuBan0tbsoSM9D5SbozubHBKHccN023GGR2kPZuzNrzloT7IO7OContent-type: application/x-www-form-urlencodedAccept: /Origin: https://chatgpt.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=PYa1QMaEAlNq8AXCZuYgo17lZguigSB142jsoN54yjA-1729772047-1.0.1.1-NXX.Lfh2DS0RB2OrlPcc6VrP3TisYFyDxW9FNDoGM9_HcK7f7_ypBkc5Ujem28EaOoCadx7umKyLOZxcOAxrDg
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=PYa1QMaEAlNq8AXCZuYgo17lZguigSB142jsoN54yjA-1729772047-1.0.1.1-NXX.Lfh2DS0RB2OrlPcc6VrP3TisYFyDxW9FNDoGM9_HcK7f7_ypBkc5Ujem28EaOoCadx7umKyLOZxcOAxrDg
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f2bbd6738e15/api.js?onload=fSZI2&render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveOrigin: https://chatgpt.comUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/t722o/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1625211542:1729702664:ZO1Pl1MsCdl5JCd-iTGVq9XUJ0ETrABYlg4qWlIqm4k/8d79e2774d442cde/ZvH6QH227xOm5Ypb_BANPrzG896Lp.qTZdiJPOQCE7U-1729772045-1.2.1.1-8Lu7RgPxI8Fv.3y7IFtMSEJBYFkeLP29_l0T7jWjXNEKAd9BRbPidx9nG9EW5OjN HTTP/1.1Host: chatgpt.comConnection: keep-aliveContent-Length: 4598sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"Content-type: application/x-www-form-urlencodedsec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""CF-Challenge: ZvH6QH227xOm5Ypb_BANPrzG896Lp.qTZdiJPOQCE7U-1729772045-1.2.1.1-8Lu7RgPxI8Fv.3y7IFtMSEJBYFkeLP29_l0T7jWjXNEKAd9BRbPidx9nG9EW5OjNsec-ch-ua-platform: "Windows"Accept: /Origin: https://chatgpt.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=OQLIkE0UQBS.6z7PZMBm77fwe7cCsT7LkxFFMdDohsc-1729772049-1.0.1.1-wDshRlzskOLKjeCH9yiHP2U0OHy.z1eAe_r213OIjoP0mG39ECCixjcG4Ptq2I.xEWMO.wVaj7yVnc1rKDeubw
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=OQLIkE0UQBS.6z7PZMBm77fwe7cCsT7LkxFFMdDohsc-1729772049-1.0.1.1-wDshRlzskOLKjeCH9yiHP2U0OHy.z1eAe_r213OIjoP0mG39ECCixjcG4Ptq2I.xEWMO.wVaj7yVnc1rKDeubw
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=OQLIkE0UQBS.6z7PZMBm77fwe7cCsT7LkxFFMdDohsc-1729772049-1.0.1.1-wDshRlzskOLKjeCH9yiHP2U0OHy.z1eAe_r213OIjoP0mG39ECCixjcG4Ptq2I.xEWMO.wVaj7yVnc1rKDeubw
Source: global traffic	HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1625211542:1729702664:ZO1Pl1MsCdl5JCd-iTGVq9XUJ0ETrABYlg4qWlIqm4k/8d79e2774d442cde/ZvH6QH227xOm5Ypb_BANPrzG896Lp.qTZdiJPOQCE7U-1729772045-1.2.1.1-8Lu7RgPxI8Fv.3y7IFtMSEJBYFkeLP29_l0T7jWjXNEKAd9BRbPidx9nG9EW5OjN HTTP/1.1Host: chatgpt.comConnection: keep-aliveContent-Length: 5934sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"Content-type: application/x-www-form-urlencodedsec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""CF-Challenge: ZvH6QH227xOm5Ypb_BANPrzG896Lp.qTZdiJPOQCE7U-1729772045-1.2.1.1-8Lu7RgPxI8Fv.3y7IFtMSEJBYFkeLP29_l0T7jWjXNEKAd9BRbPidx9nG9EW5OjNsec-ch-ua-platform: "Windows"Accept: /Origin: https://chatgpt.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=ysrGvPmqhbqYx9hKvni415uvjO__4.xgdhrK.8AeKR0-1729772056-1.0.1.1-8bWYXZaq.ASgU.3ns_xLGRgw.nJpRbCVD3gnD_eHFkoSW2C_5IZScKae9.mTVh1vW8K3WRS2L8wAGhX1Kj.lVA
Source: global traffic	HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1625211542:1729702664:ZO1Pl1MsCdl5JCd-iTGVq9XUJ0ETrABYlg4qWlIqm4k/8d79e2728ba4c86f/Bf6z6i3aZvmXsh67IRrDkjru2Pn7kPeG3VRRQ9wYEBc-1729772045-1.2.1.1-AI0RlJhjkb4IECuBan0tbsoSM9D5SbozubHBKHccN023GGR2kPZuzNrzloT7IO7O HTTP/1.1Host: chatgpt.comConnection: keep-aliveContent-Length: 5583User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1CF-Challenge: Bf6z6i3aZvmXsh67IRrDkjru2Pn7kPeG3VRRQ9wYEBc-1729772045-1.2.1.1-AI0RlJhjkb4IECuBan0tbsoSM9D5SbozubHBKHccN023GGR2kPZuzNrzloT7IO7OContent-type: application/x-www-form-urlencodedAccept: /Origin: https://chatgpt.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=ysrGvPmqhbqYx9hKvni415uvjO__4.xgdhrK.8AeKR0-1729772056-1.0.1.1-8bWYXZaq.ASgU.3ns_xLGRgw.nJpRbCVD3gnD_eHFkoSW2C_5IZScKae9.mTVh1vW8K3WRS2L8wAGhX1Kj.lVA
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: chatgpt.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=h6QED80bYekZchG851gHvOE6zYYRfWLK9yqva63qtPU-1729772062-1.0.1.1-267CL1OpoTxN3FngsAh8qNaK2Q5Cle6PJJtSxSsR3gOIsdQ_pMWs1kaOcVNwe2UFtr8cdpJmpLeMfSaaVMs3tg; cf_chl_rc_m=2
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8d79e2f4cd0c8788 HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://chatgpt.com/?__cf_chl_rt_tk=20txOQoVK95DoG_CQ5q6KcdMzflGfLsefy9rSRUI7iQ-1729772066-1.0.1.1-JFT1zQYUZnxXGuH4WMSvA1_NdrKhV2efJk2vSu0zPD0Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=h6QED80bYekZchG851gHvOE6zYYRfWLK9yqva63qtPU-1729772062-1.0.1.1-267CL1OpoTxN3FngsAh8qNaK2Q5Cle6PJJtSxSsR3gOIsdQ_pMWs1kaOcVNwe2UFtr8cdpJmpLeMfSaaVMs3tg; cf_chl_rc_m=2
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: chatgpt.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=h6QED80bYekZchG851gHvOE6zYYRfWLK9yqva63qtPU-1729772062-1.0.1.1-267CL1OpoTxN3FngsAh8qNaK2Q5Cle6PJJtSxSsR3gOIsdQ_pMWs1kaOcVNwe2UFtr8cdpJmpLeMfSaaVMs3tg; cf_chl_rc_m=2
Source: global traffic	HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/flow/ov1/292910351:1729702615:K3nzjQK0cRG2v-46QDcmxvg4IT5wiF0B2zJ5KAeT8R8/8d79e2f4cd0c8788/2xkr6zQwIkKrPVFmvDzbUoc4QPjOE0zHNdxAaQIUhI4-1729772066-1.2.1.1-jQNbQPmiZFHVEAQU0G1rz97qSdhiiPh4TRv0aVWRlF0HBddiUrdhcLDyqnBQAJ0q HTTP/1.1Host: chatgpt.comConnection: keep-aliveContent-Length: 4601sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"Content-type: application/x-www-form-urlencodedsec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""CF-Challenge: 2xkr6zQwIkKrPVFmvDzbUoc4QPjOE0zHNdxAaQIUhI4-1729772066-1.2.1.1-jQNbQPmiZFHVEAQU0G1rz97qSdhiiPh4TRv0aVWRlF0HBddiUrdhcLDyqnBQAJ0qsec-ch-ua-platform: "Windows"Accept: /Origin: https://chatgpt.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=h6QED80bYekZchG851gHvOE6zYYRfWLK9yqva63qtPU-1729772062-1.0.1.1-267CL1OpoTxN3FngsAh8qNaK2Q5Cle6PJJtSxSsR3gOIsdQ_pMWs1kaOcVNwe2UFtr8cdpJmpLeMfSaaVMs3tg; cf_chl_rc_m=2
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=h6QED80bYekZchG851gHvOE6zYYRfWLK9yqva63qtPU-1729772062-1.0.1.1-267CL1OpoTxN3FngsAh8qNaK2Q5Cle6PJJtSxSsR3gOIsdQ_pMWs1kaOcVNwe2UFtr8cdpJmpLeMfSaaVMs3tg; cf_chl_rc_m=2
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8d79e300ee17ddae HTTP/1.1Host: chatgpt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://chatgpt.com/?__cf_chl_rt_tk=8w9J9mNtfC6DhGfX8eRBt9XolDvbcfnCdeO8A7tCHUA-1729772067-1.0.1.1-MiHQPsyxieke70xcRzUl5l3hWeQrwMZQRg18duMpcgMAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: cf_chl_rc_m=2; __cf_bm=x_8nAfA8agM_jc9AVuOnIvKN5Qfjpse_HUIsiSmcTjU-1729772067-1.0.1.1-oi9k25cL6mTcxA9p1hxOBX7ownA4ggjyuQ50V34YrBypsa5sdqrkUmPavdlrj0dOcISbQYPxqWW6sist52XFcg
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: cf_chl_rc_m=2; __cf_bm=x_8nAfA8agM_jc9AVuOnIvKN5Qfjpse_HUIsiSmcTjU-1729772067-1.0.1.1-oi9k25cL6mTcxA9p1hxOBX7ownA4ggjyuQ50V34YrBypsa5sdqrkUmPavdlrj0dOcISbQYPxqWW6sist52XFcg
Source: global traffic	HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/flow/ov1/292910351:1729702615:K3nzjQK0cRG2v-46QDcmxvg4IT5wiF0B2zJ5KAeT8R8/8d79e300ee17ddae/aQO6uSl8y3ViDGoOFfVtp9_9o74X77o_dW7pR9QUBig-1729772067-1.2.1.1-rpQKt5NL_ixqyaczBylL4cNNx1TyZkCmaCXTkznmW7NJZpjOPGwN20vTXUQWR7S0 HTTP/1.1Host: chatgpt.comConnection: keep-aliveContent-Length: 4577User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1CF-Challenge: aQO6uSl8y3ViDGoOFfVtp9_9o74X77o_dW7pR9QUBig-1729772067-1.2.1.1-rpQKt5NL_ixqyaczBylL4cNNx1TyZkCmaCXTkznmW7NJZpjOPGwN20vTXUQWR7S0Content-type: application/x-www-form-urlencodedAccept: /Origin: https://chatgpt.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: cf_chl_rc_m=2; __cf_bm=x_8nAfA8agM_jc9AVuOnIvKN5Qfjpse_HUIsiSmcTjU-1729772067-1.0.1.1-oi9k25cL6mTcxA9p1hxOBX7ownA4ggjyuQ50V34YrBypsa5sdqrkUmPavdlrj0dOcISbQYPxqWW6sist52XFcg
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: cf_chl_rc_m=2; __cf_bm=x_8nAfA8agM_jc9AVuOnIvKN5Qfjpse_HUIsiSmcTjU-1729772067-1.0.1.1-oi9k25cL6mTcxA9p1hxOBX7ownA4ggjyuQ50V34YrBypsa5sdqrkUmPavdlrj0dOcISbQYPxqWW6sist52XFcg
Source: global traffic	HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/flow/ov1/292910351:1729702615:K3nzjQK0cRG2v-46QDcmxvg4IT5wiF0B2zJ5KAeT8R8/8d79e2f4cd0c8788/2xkr6zQwIkKrPVFmvDzbUoc4QPjOE0zHNdxAaQIUhI4-1729772066-1.2.1.1-jQNbQPmiZFHVEAQU0G1rz97qSdhiiPh4TRv0aVWRlF0HBddiUrdhcLDyqnBQAJ0q HTTP/1.1Host: chatgpt.comConnection: keep-aliveContent-Length: 5760sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"Content-type: application/x-www-form-urlencodedsec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""CF-Challenge: 2xkr6zQwIkKrPVFmvDzbUoc4QPjOE0zHNdxAaQIUhI4-1729772066-1.2.1.1-jQNbQPmiZFHVEAQU0G1rz97qSdhiiPh4TRv0aVWRlF0HBddiUrdhcLDyqnBQAJ0qsec-ch-ua-platform: "Windows"Accept: /Origin: https://chatgpt.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: cf_chl_rc_m=2; __cf_bm=x_8nAfA8agM_jc9AVuOnIvKN5Qfjpse_HUIsiSmcTjU-1729772067-1.0.1.1-oi9k25cL6mTcxA9p1hxOBX7ownA4ggjyuQ50V34YrBypsa5sdqrkUmPavdlrj0dOcISbQYPxqWW6sist52XFcg
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: cf_chl_rc_m=2; __cf_bm=x_8nAfA8agM_jc9AVuOnIvKN5Qfjpse_HUIsiSmcTjU-1729772067-1.0.1.1-oi9k25cL6mTcxA9p1hxOBX7ownA4ggjyuQ50V34YrBypsa5sdqrkUmPavdlrj0dOcISbQYPxqWW6sist52XFcg
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: chatgpt.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=cI4pbl9fadRAB9hak6.ok0tUSnANbu0oAqisaUDJ8oI-1729772075-1.0.1.1-bFKmL1M2ve3jNiJsDSXJ6BiVUVAwAuEvg9qflnjYWwQ5NCewRO91PRKpv6xvvEi4U22IOKgwEbRjhhnWiafeVA; cf_chl_rc_m=3
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8d79e36a9d700b76 HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://chatgpt.com/?__cf_chl_rt_tk=EKnr2Edcj6ZkF4pygKDOGjVV6HATs.idxv5FCSbsCFo-1729772084-1.0.1.1-EZnBSw_.oM3HtwH5C5xr5cLkdO8sOD.j5sNd_MbjkxMAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=cI4pbl9fadRAB9hak6.ok0tUSnANbu0oAqisaUDJ8oI-1729772075-1.0.1.1-bFKmL1M2ve3jNiJsDSXJ6BiVUVAwAuEvg9qflnjYWwQ5NCewRO91PRKpv6xvvEi4U22IOKgwEbRjhhnWiafeVA; cf_chl_rc_m=3
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=cI4pbl9fadRAB9hak6.ok0tUSnANbu0oAqisaUDJ8oI-1729772075-1.0.1.1-bFKmL1M2ve3jNiJsDSXJ6BiVUVAwAuEvg9qflnjYWwQ5NCewRO91PRKpv6xvvEi4U22IOKgwEbRjhhnWiafeVA; cf_chl_rc_m=3
Source: global traffic	HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1274467767:1729768387:GZ03pNqdcvUyWi3tepVr5CneT2FTszG4NLRECEWjr3U/8d79e36a9d700b76/4rRr1xNn6FwY4ykYht78o1BBXfW68JsrOtAEo9iwHmg-1729772084-1.2.1.1-RT7MAMKq2U2V57BqkjG9u9lVXrrDkaCXEGYzzlcXHfOJFzVwDiiOCHaodXharcBz HTTP/1.1Host: chatgpt.comConnection: keep-aliveContent-Length: 4553sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"Content-type: application/x-www-form-urlencodedsec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""CF-Challenge: 4rRr1xNn6FwY4ykYht78o1BBXfW68JsrOtAEo9iwHmg-1729772084-1.2.1.1-RT7MAMKq2U2V57BqkjG9u9lVXrrDkaCXEGYzzlcXHfOJFzVwDiiOCHaodXharcBzsec-ch-ua-platform: "Windows"Accept: /Origin: https://chatgpt.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=cI4pbl9fadRAB9hak6.ok0tUSnANbu0oAqisaUDJ8oI-1729772075-1.0.1.1-bFKmL1M2ve3jNiJsDSXJ6BiVUVAwAuEvg9qflnjYWwQ5NCewRO91PRKpv6xvvEi4U22IOKgwEbRjhhnWiafeVA; cf_chl_rc_m=3
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=cI4pbl9fadRAB9hak6.ok0tUSnANbu0oAqisaUDJ8oI-1729772075-1.0.1.1-bFKmL1M2ve3jNiJsDSXJ6BiVUVAwAuEvg9qflnjYWwQ5NCewRO91PRKpv6xvvEi4U22IOKgwEbRjhhnWiafeVA; cf_chl_rc_m=3
Source: global traffic	HTTP traffic detected: POST /componentupdater/api/v1/update?cup2key=6:zA-fqe23Zjma7QQvbkpD4CPvwbGWRIk97MMdoDIOR7w&cup2hreq=b625a8f99262a396d9fbb0706e4777b338edb793d786e234d6b4532962ef3d58 HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveContent-Length: 4921X-Microsoft-Update-AppId: oankkpibpaokgecfckkdkgaoafllipag,kpfehajjjbbcifeehjgfgnabifknmdad,ohckeflnhegojcjlcpbfpciadgikcohk,fppmbhmldokgmleojlplaaodlkibgikh,ndikpojcjlepofdkaaldkinkjbeeebkl,fgbafbciocncjfbbonhocjaohoknlaco,ahmaebgpfccdhgidjaidaoojjcijckba,ojblfafjmiikbkepnnolpgbbhejhlcim,alpjnmnfbgfkmmpcfpejmmoebdndedno,jbfaflocpnkhbgcijpkiafdpbjkedane,eeobbhfgfagbclfofmgbdfoicabjdbknX-Microsoft-Update-Interactivity: bgX-Microsoft-Update-Service-Cohort: 3521X-Microsoft-Update-Updater: msedge-117.0.2045.47Content-Type: application/jsonSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 1X-Client-Data: COrjygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: OPTIONS /report/v4?s=3V7tZg8DupBWa%2Ff7S9JM8GFtlRid9dl3Bd35rdFUGaO%2BBiZk%2BKOR78XEahTbWD9%2BIghfA%2F63sNGZv9p%2ByZXnARv2Cm5zxa8K1sT6TPQCdCvn6pPPt%2FSD05VoJUqk HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveOrigin: https://chatgpt.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: global traffic	HTTP traffic detected: GET /ChatGPT/install.json HTTP/1.1accept: application/jsonconnection: closeaccept-encoding: gzip, deflateuser-agent: attohttpc/0.22.0host: lencx.github.io
Source: global traffic	HTTP traffic detected: GET /lencx/ChatGPT/main/scripts/manifest.json HTTP/1.1accept: /host: raw.githubusercontent.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: chatgpt.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: chatgpt.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8d79e2728ba4c86f HTTP/1.1Host: chatgpt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://chatgpt.com/?__cf_chl_rt_tk=OWlVE8SPcNBU.4PYac3.CvmFdPDNrnMWud3IPRv2r_k-1729772045-1.0.1.1-FaJ15L4rrWPMnphtUskDPUMNkVYePEnoZLSvDxWCI3UAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=sdHBg6oF4H6FWxQ60X.5uZVt6GdFGgW512xlAXuvvIk-1729772045-1.0.1.1-UckP2AiJT2n5xudaqhGVxhSavJQwoe38qCHkxcPijBK0X3f2tPoC_bu0LHj8Suz0I5H_pdE4EUnJAsWaGRSrKQ
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8d79e2774d442cde HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://chatgpt.com/?__cf_chl_rt_tk=OMNPTxa5dcbdWDC5zF10_TTA4FAlFeYFzZm.zKDL9MY-1729772045-1.0.1.1-oGUTHZxBlovQ_gIL5xQ1jaizOH9wXBLvxoJ_1YkF2p4Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=oJoiX1NMYw6DM_ZM10iV7_U6hTYQdoaWYs_uOT9BO6Q-1729772045-1.0.1.1-Hi.Ef6VnqbNV0f6LNqlxcUCvkKrrA8_EeBgr1r5yrlAfwT4_lyZXY1IyQeOWdq10DNyC4sCh3837wjg7Vxiz4Q
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=oJoiX1NMYw6DM_ZM10iV7_U6hTYQdoaWYs_uOT9BO6Q-1729772045-1.0.1.1-Hi.Ef6VnqbNV0f6LNqlxcUCvkKrrA8_EeBgr1r5yrlAfwT4_lyZXY1IyQeOWdq10DNyC4sCh3837wjg7Vxiz4Q
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=PYa1QMaEAlNq8AXCZuYgo17lZguigSB142jsoN54yjA-1729772047-1.0.1.1-NXX.Lfh2DS0RB2OrlPcc6VrP3TisYFyDxW9FNDoGM9_HcK7f7_ypBkc5Ujem28EaOoCadx7umKyLOZxcOAxrDg
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f2bbd6738e15/api.js?onload=fSZI2&render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveOrigin: https://chatgpt.comUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/t722o/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=OQLIkE0UQBS.6z7PZMBm77fwe7cCsT7LkxFFMdDohsc-1729772049-1.0.1.1-wDshRlzskOLKjeCH9yiHP2U0OHy.z1eAe_r213OIjoP0mG39ECCixjcG4Ptq2I.xEWMO.wVaj7yVnc1rKDeubw
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=OQLIkE0UQBS.6z7PZMBm77fwe7cCsT7LkxFFMdDohsc-1729772049-1.0.1.1-wDshRlzskOLKjeCH9yiHP2U0OHy.z1eAe_r213OIjoP0mG39ECCixjcG4Ptq2I.xEWMO.wVaj7yVnc1rKDeubw
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: chatgpt.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=h6QED80bYekZchG851gHvOE6zYYRfWLK9yqva63qtPU-1729772062-1.0.1.1-267CL1OpoTxN3FngsAh8qNaK2Q5Cle6PJJtSxSsR3gOIsdQ_pMWs1kaOcVNwe2UFtr8cdpJmpLeMfSaaVMs3tg; cf_chl_rc_m=2
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8d79e2f4cd0c8788 HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://chatgpt.com/?__cf_chl_rt_tk=20txOQoVK95DoG_CQ5q6KcdMzflGfLsefy9rSRUI7iQ-1729772066-1.0.1.1-JFT1zQYUZnxXGuH4WMSvA1_NdrKhV2efJk2vSu0zPD0Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=h6QED80bYekZchG851gHvOE6zYYRfWLK9yqva63qtPU-1729772062-1.0.1.1-267CL1OpoTxN3FngsAh8qNaK2Q5Cle6PJJtSxSsR3gOIsdQ_pMWs1kaOcVNwe2UFtr8cdpJmpLeMfSaaVMs3tg; cf_chl_rc_m=2
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: chatgpt.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=h6QED80bYekZchG851gHvOE6zYYRfWLK9yqva63qtPU-1729772062-1.0.1.1-267CL1OpoTxN3FngsAh8qNaK2Q5Cle6PJJtSxSsR3gOIsdQ_pMWs1kaOcVNwe2UFtr8cdpJmpLeMfSaaVMs3tg; cf_chl_rc_m=2
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=h6QED80bYekZchG851gHvOE6zYYRfWLK9yqva63qtPU-1729772062-1.0.1.1-267CL1OpoTxN3FngsAh8qNaK2Q5Cle6PJJtSxSsR3gOIsdQ_pMWs1kaOcVNwe2UFtr8cdpJmpLeMfSaaVMs3tg; cf_chl_rc_m=2
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8d79e300ee17ddae HTTP/1.1Host: chatgpt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://chatgpt.com/?__cf_chl_rt_tk=8w9J9mNtfC6DhGfX8eRBt9XolDvbcfnCdeO8A7tCHUA-1729772067-1.0.1.1-MiHQPsyxieke70xcRzUl5l3hWeQrwMZQRg18duMpcgMAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: cf_chl_rc_m=2; __cf_bm=x_8nAfA8agM_jc9AVuOnIvKN5Qfjpse_HUIsiSmcTjU-1729772067-1.0.1.1-oi9k25cL6mTcxA9p1hxOBX7ownA4ggjyuQ50V34YrBypsa5sdqrkUmPavdlrj0dOcISbQYPxqWW6sist52XFcg
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: cf_chl_rc_m=2; __cf_bm=x_8nAfA8agM_jc9AVuOnIvKN5Qfjpse_HUIsiSmcTjU-1729772067-1.0.1.1-oi9k25cL6mTcxA9p1hxOBX7ownA4ggjyuQ50V34YrBypsa5sdqrkUmPavdlrj0dOcISbQYPxqWW6sist52XFcg
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: cf_chl_rc_m=2; __cf_bm=x_8nAfA8agM_jc9AVuOnIvKN5Qfjpse_HUIsiSmcTjU-1729772067-1.0.1.1-oi9k25cL6mTcxA9p1hxOBX7ownA4ggjyuQ50V34YrBypsa5sdqrkUmPavdlrj0dOcISbQYPxqWW6sist52XFcg
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: cf_chl_rc_m=2; __cf_bm=x_8nAfA8agM_jc9AVuOnIvKN5Qfjpse_HUIsiSmcTjU-1729772067-1.0.1.1-oi9k25cL6mTcxA9p1hxOBX7ownA4ggjyuQ50V34YrBypsa5sdqrkUmPavdlrj0dOcISbQYPxqWW6sist52XFcg
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: chatgpt.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=cI4pbl9fadRAB9hak6.ok0tUSnANbu0oAqisaUDJ8oI-1729772075-1.0.1.1-bFKmL1M2ve3jNiJsDSXJ6BiVUVAwAuEvg9qflnjYWwQ5NCewRO91PRKpv6xvvEi4U22IOKgwEbRjhhnWiafeVA; cf_chl_rc_m=3
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8d79e36a9d700b76 HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://chatgpt.com/?__cf_chl_rt_tk=EKnr2Edcj6ZkF4pygKDOGjVV6HATs.idxv5FCSbsCFo-1729772084-1.0.1.1-EZnBSw_.oM3HtwH5C5xr5cLkdO8sOD.j5sNd_MbjkxMAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=cI4pbl9fadRAB9hak6.ok0tUSnANbu0oAqisaUDJ8oI-1729772075-1.0.1.1-bFKmL1M2ve3jNiJsDSXJ6BiVUVAwAuEvg9qflnjYWwQ5NCewRO91PRKpv6xvvEi4U22IOKgwEbRjhhnWiafeVA; cf_chl_rc_m=3
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=cI4pbl9fadRAB9hak6.ok0tUSnANbu0oAqisaUDJ8oI-1729772075-1.0.1.1-bFKmL1M2ve3jNiJsDSXJ6BiVUVAwAuEvg9qflnjYWwQ5NCewRO91PRKpv6xvvEi4U22IOKgwEbRjhhnWiafeVA; cf_chl_rc_m=3
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chatgpt.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Microsoft Edge WebView2";v="117.0.2045.47"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chatgpt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=cI4pbl9fadRAB9hak6.ok0tUSnANbu0oAqisaUDJ8oI-1729772075-1.0.1.1-bFKmL1M2ve3jNiJsDSXJ6BiVUVAwAuEvg9qflnjYWwQ5NCewRO91PRKpv6xvvEi4U22IOKgwEbRjhhnWiafeVA; cf_chl_rc_m=3

Source: unknown	Process created: C:\Users\user\Desktop\I8R24VDCOi.exe "C:\Users\user\Desktop\I8R24VDCOi.exe"
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-GB --mojo-named-platform-channel-pipe=7128.6536.1550348927669786693
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffdfb2e8e88,0x7ffdfb2e8e98,0x7ffdfb2e8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2840 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=3308 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5636010885 --mojo-platform-channel-handle=3552 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5637143084 --mojo-platform-channel-handle=4000 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5639600820 --mojo-platform-channel-handle=4116 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5640359025 --mojo-platform-channel-handle=4364 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5644726732 --mojo-platform-channel-handle=3900 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5646187664 --mojo-platform-channel-handle=3876 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5649044302 --mojo-platform-channel-handle=3892 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5663800043 --mojo-platform-channel-handle=4900 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5208 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffdfb2e8e88,0x7ffdfb2e8e98,0x7ffdfb2e8ea8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2840 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=3308 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5636010885 --mojo-platform-channel-handle=3552 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5637143084 --mojo-platform-channel-handle=4000 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5639600820 --mojo-platform-channel-handle=4116 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5640359025 --mojo-platform-channel-handle=4364 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5644726732 --mojo-platform-channel-handle=3900 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5646187664 --mojo-platform-channel-handle=3876 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5649044302 --mojo-platform-channel-handle=3892 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1729766404493892 --launch-time-ticks=5663800043 --mojo-platform-channel-handle=4900 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView" --webview-exe-name=I8R24VDCOi.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5208 --field-trial-handle=1780,i,11054171514797172,5936391161486530060,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:2	Jump to behavior

Source: I8R24VDCOi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: I8R24VDCOi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: I8R24VDCOi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: I8R24VDCOi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: I8R24VDCOi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: I8R24VDCOi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: I8R24VDCOi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: I8R24VDCOi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: I8R24VDCOi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: I8R24VDCOi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: I8R24VDCOi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC3190AD9 push edx; ret	14_2_00007FFDC3190C96
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC3190AD9 push edx; ret	14_2_00007FFDC3190E25
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC3190AD9 push edx; ret	14_2_00007FFDC3190F41
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC3190AD9 push edx; ret	14_2_00007FFDC3191081
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC3190AD9 push edx; ret	14_2_00007FFDC31911B1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC3190AD9 push edx; ret	14_2_00007FFDC3191325
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC318DB12 push ecx; ret	14_2_00007FFDC318DB3F
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC318E6AC push ecx; ret	14_2_00007FFDC318E6D9
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E6D63 push edx; retf	14_2_00007FFDC31E6D64
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E3175 push esi; ret	14_2_00007FFDC31E3177
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E1BCB push esi; ret	14_2_00007FFDC31E1BCD
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E49DC push esi; ret	14_2_00007FFDC31E49DE
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E17DB push esi; ret	14_2_00007FFDC31E17DD
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E39AA push esi; ret	14_2_00007FFDC31E39AC
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E37A1 push esi; ret	14_2_00007FFDC31E37A3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E25BC push esi; ret	14_2_00007FFDC31E25BE
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E2006 push esi; ret	14_2_00007FFDC31E2008
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E300D push esi; ret	14_2_00007FFDC31E300F
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E3610 push esi; ret	14_2_00007FFDC31E3612
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E33F4 push esi; ret	14_2_00007FFDC31E33F6
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E2A3E push esi; ret	14_2_00007FFDC31E2A40
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E7054 pushad ; iretd	14_2_00007FFDC31E7055
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E1E3A push esi; ret	14_2_00007FFDC31E1E3C
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E2C89 push esi; ret	14_2_00007FFDC31E2C8B
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E2282 push esi; ret	14_2_00007FFDC31E2284
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E247E push esi; ret	14_2_00007FFDC31E2480
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E1A8D push esi; ret	14_2_00007FFDC31E1A8F
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E567B push F6FFFFFFh; ret	14_2_00007FFDC31E5687
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E2E78 push esi; ret	14_2_00007FFDC31E2E7A
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E28D9 push esi; ret	14_2_00007FFDC31E28DB
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Code function: 14_2_00007FFDC31E3AD3 push esi; ret	14_2_00007FFDC31E3AD5

Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\Default\Code Cache\js FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\Default\Code Cache\wasm FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\Default\blob_storage\4230c95c-a28b-487e-a436-0143a82b46ea FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\Default\Cache\Cache_Data FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user FullSizeInformation

Source: I8R24VDCOi.exe, 00000000.00000003.1706104098.0000024343C8C000.00000004.00000020.00020000.00000000.sdmp, I8R24VDCOi.exe, 00000000.00000003.1747791460.0000024343C90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWlass%SystemRoot%\system32\mswsock.dllmatch(/.*language-(\w+)/)[1];
Source: I8R24VDCOi.exe, 00000000.00000003.1706104098.0000024343C8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh

Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\chat.conf.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\chat.conf.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\chat.conf.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\chat.conf.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\chat.conf.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts\main.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts\core.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts\cmd.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts\chat.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts\popup.core.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts\main.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts\core.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts\popup.core.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts\export.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts\markdown.export.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts\cmd.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts\chat.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\AppData\Local\com.lencx.chatgpt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts\manifest.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I8R24VDCOi.exe	Queries volume information: C:\Users\user\.chatgpt\scripts\manifest.json VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Trust Protection Lists\manifest.json VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\WidevineCdm\manifest.json VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\Default\Code Cache\js\daea56c943a1bb91_0 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\MEIPreload\preloaded_data.pb VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\Default\Code Cache\js\daea56c943a1bb91_0 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\Default\Code Cache\js\daea56c943a1bb91_0 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Local\com.lencx.chatgpt\EBWebView\Default\Network\SCT Auditing Pending Reports VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	11 Input Capture	1 Query Registry	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Name	IP	Active	Malicious	Reputation
chatgpt.com	172.64.155.209	true	false	unknown
chrome.cloudflare-dns.com	162.159.61.3	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
raw.githubusercontent.com	185.199.108.133	true	false	unknown
lencx.github.io	185.199.109.153	true	false	unknown
chat.openai.com	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://chatgpt.com/	false	unknown
https://chatgpt.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8d79e2728ba4c86f	false	unknown
https://chatgpt.com/favicon.ico	false	unknown
https://chatgpt.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8d79e2f4cd0c8788	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
172.64.155.209	chatgpt.com	United States	13335	CLOUDFLARENETUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
185.199.108.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
204.79.197.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
185.199.109.153	lencx.github.io	Netherlands	54113	FASTLYUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report I8R24VDCOi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\.chatgpt\ChatGPT.log

C:\Users\user\.chatgpt\cache_prompts\chatgpt_prompts.json

C:\Users\user\.chatgpt\chat.conf.json

C:\Users\user\.chatgpt\chat.download.json

C:\Users\user\.chatgpt\chat.notes.json

C:\Users\user\.chatgpt\scripts\README.md

C:\Users\user\.chatgpt\scripts\chat.js

C:\Users\user\.chatgpt\scripts\cmd.js

C:\Users\user\.chatgpt\scripts\core.js

C:\Users\user\.chatgpt\scripts\dalle2.js

C:\Users\user\.chatgpt\scripts\export.js

C:\Users\user\.chatgpt\scripts\main.js

C:\Users\user\.chatgpt\scripts\manifest.json

C:\Users\user\.chatgpt\scripts\markdown.export.js

C:\Users\user\.chatgpt\scripts\popup.core.js

C:\Users\user\AppData\Local\D3DSCache\ab326b5a64fa2db7\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

C:\Users\user\AppData\Local\D3DSCache\ab326b5a64fa2db7\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

C:\Users\user\AppData\Local\D3DSCache\ab326b5a64fa2db7\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

C:\Users\user\AppData\Local\Temp\03cae1d6-8b56-47dc-b05a-f73cbbaa7f2d.tmp

C:\Users\user\AppData\Local\Temp\119b4322-f4ec-476b-af2d-3bbc9d71c03c.tmp

C:\Users\user\AppData\Local\Temp\7f1093c5-920d-4d11-95af-5771e495047b.tmp

Windows Analysis Report
I8R24VDCOi.exe

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541157
Start date and time:	2024-10-24 14:13:00 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	I8R24VDCOi.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	6e3c5f5597966cff1e50c43970281b70b31534e3
Detection:	CLEAN
Classification:	clean6.winEXE@28/181@12/9
EGA Information:	Failed
HCA Information:	Failed

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	http://74.248.121.8/d/msdownload/update/software/defu/2024/10/updateplatform.amd64fre_d3f6f8300855e56b8ed00da6dac55a3c4cbf8c20.exe?cacheHostOrigin=au.download.windowsupdate.com	Get hash	malicious	Unknown	Browse
	Demande de proposition du CPE Les Coquins.pdf	Get hash	malicious	Unknown	Browse
	Demande de proposition du CPE Les Coquins.pdf	Get hash	malicious	Unknown	Browse
	roquette October.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://careers.adobe.com/us/en/apply?jobSeqNo=ADOBUSR147673EXTERNALENUS	Get hash	malicious	Unknown	Browse
	Scan copy of document .pdf	Get hash	malicious	Unknown	Browse
	fedcap.67173a0a3d25d0.95038392.pdf	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_1a8e4ebbcc2e3f76efb2a55bb6179417263ebf3d.zip	Get hash	malicious	Unknown	Browse
	[EXTERNAL] Redbrick Communications Request For Proposal .eml	Get hash	malicious	Unknown	Browse
	http://google.com	Get hash	malicious	Unknown	Browse
185.199.108.133	cr_asm.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	gaber.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
104.18.94.41	https://1drv.ms/o/c/3e563d3fb2a98d1c/Emlo5KUbYYNEvKtIF-7SS0EBYSeT3hOOGuv_MbeT-n2y4g?e=HPjqUn	Get hash	malicious	HtmlDropper	Browse
	https://railrent-railrent.powerappsportals.com/	Get hash	malicious	Unknown	Browse
	https://2007.filemail.com/api/file/get?filekey=58mKUrTMdlmzqkRvo0UdVa2TMjJTCQiSNv5rUBtsDQTNU0dM4JzppUJaOrP_mWxCym0k9l5xEDeaXunPsHq6frY8XZH_gnclw86MefA3bpAlGuDkr77-xSqrMOQIlMdW5cRjwoOSCWIlTwpC48cNKMMHhMKp&track=P8fpm4ry&pk_vid=8a8b18f03738ae4f17297703684d559d	Get hash	malicious	HTMLPhisher	Browse
	attachment(1).eml	Get hash	malicious	Unknown	Browse
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse
	https://app.affine.pro/workspace/6f321ca4-f766-41a0-bd18-9a1d8692fccd/OWaJzjD5UQBLWE3oGXvZY	Get hash	malicious	HtmlDropper	Browse
	Douglas County Government.pdf	Get hash	malicious	Unknown	Browse
	Douglas County Government.pdf	Get hash	malicious	HtmlDropper	Browse
	http://tracking.nod.ro/tracking/click?d=v4CWpEHK8Z1tV13Kq0SNnCz3l4pJsmApRreVnXMqsPjuOlW2erarYEe1nKHryrl0g1Aum4XVcWSRzzL9_ygST87VKk2nbDBhx1QybYWkDoE7f-SCn7T5e0BBYpqLQzpruG7FRHbBYNDPftLgaaLpRJA1	Get hash	malicious	Unknown	Browse
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/b%C2%ADr%C2%ADi%C2%ADa%C2%ADn%C2%ADs%C2%ADd%C2%ADr%C2%ADe%C2%ADn%C2%ADn%C2%ADa%C2%ADn%C2%ADm%C2%ADo%C2%AD.%C2%ADc%C2%ADo%C2%ADm%C2%AD.%C2%ADp%C2%ADl/ZsS8z/	Get hash	malicious	HTMLPhisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	kQyd2z80gD.exe	Get hash	malicious	DCRat	Browse	185.199.108.133 185.199.109.153
	PO-Zam#U00f3wienie zakupu-8837837849-pl-.exe	Get hash	malicious	DarkCloud	Browse	185.199.108.133 185.199.109.153
	https://www.yola.com/es/zendesk-sso?return_to=http://york.iwill.app.br/	Get hash	malicious	Unknown	Browse	185.199.108.133 185.199.109.153
	Produccion.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.199.108.133 185.199.109.153
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 185.199.109.153
	226999705-124613-sanlccjavap0004-67.exe	Get hash	malicious	Snake Keylogger	Browse	185.199.108.133 185.199.109.153
	LDlanZur0i.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 185.199.109.153
	Fa1QSXjTZD.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 185.199.109.153
	xxImTScxAq.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 185.199.109.153
	4aOgNkVU5z.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 185.199.109.153

Process:	C:\Users\user\Desktop\I8R24VDCOi.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2087
Entropy (8bit):	5.142279773153082
Encrypted:	false
SSDEEP:	24:o0/z/ABI4/ABIO/ABIN/ABIp/ABIpWm/ABIJ/ABI2h/ABIy/ABIf95/ABIk/CvDP:oicC5F0mVw+3RvBdkMed3IL33
MD5:	5D262E562F7E50005CBCAC62F305CFC6
SHA1:	ADD1B0CADAB6E110C836B51FBEFE100CF8543451
SHA-256:	6F0B797E3FF9130FD62D97D893561A222094EDB799C4B871B39678B8046A03AF
SHA-512:	FA29DCC9A25D41B711F15388BD7AD25C26CA5FEE7C5A8D6FA6F34DAB4901C8ACCDF35E3529A0E3E7107F1701A0EA860F6E3BF9D7D1D5A029BB79DD33E2D5B774
Malicious:	false
Preview:	[2024-10-24][13:45:01][chatgpt::app::setup][INFO] stepup.[2024-10-24][13:45:01][chatgpt::app::template][INFO] write_script: C:\Users\user\.chatgpt\scripts\main.js.[2024-10-24][13:45:01][chatgpt::app::template][INFO] write_script: C:\Users\user\.chatgpt\scripts\core.js.[2024-10-24][13:45:01][chatgpt::app::template][INFO] write_script: C:\Users\user\.chatgpt\scripts\chat.js.[2024-10-24][13:45:01][chatgpt::app::template][INFO] write_script: C:\Users\user\.chatgpt\scripts\cmd.js.[2024-10-24][13:45:01][chatgpt::app::template][INFO] write_script: C:\Users\user\.chatgpt\scripts\dalle2.js.[2024-10-24][13:45:01][chatgpt::app::template][INFO] write_script: C:\Users\user\.chatgpt\scripts\export.js.[2024-10-24][13:45:01][chatgpt::app::template][INFO] write_script: C:\Users\user\.chatgpt\scripts\markdown.export.js.[2024-10-24][13:45:01][chatgpt::app::template][INFO] write_script: C:\Users\user\.chatgpt\scripts\popup.core.js.[2024-10-24][13:45:01][chatgpt::app::template][INFO] write_script:

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	65552
Entropy (8bit):	0.01267959957008888
Encrypted:	false
SSDEEP:	3:JklGlll/l/lXp9ZjrPBY0Ll4lt/Qf1DP:q0dPBY0y4dz
MD5:	F82406D91DAD32A842033CE56EA73522
SHA1:	4864C2D6780FF0F8211C4A561EE90F76AE2840E0
SHA-256:	CF1AE0AB6FEB70464C9305F3355383B901CCBF0810F335ED5EA2FEB822C46638
SHA-512:	F340D5B65B840BF7C9699AEF837F2107F8204E2ADE706175C415576B049C00FFD97328B59C7F4EC3A51B27724A0C4AB1C0E3075B53A3C78B51B224947B13FEC3
Malicious:	false
Preview:	".7a........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.692069423430372
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	I8R24VDCOi.exe
File size:	10'587'136 bytes
MD5:	b5cd3cbe8995dfc01f035b107322db51
SHA1:	6e3c5f5597966cff1e50c43970281b70b31534e3
SHA256:	9c28d8da7a38029e84dda55e3509399ca89655731a6cb275ff59b3fd13fd4649
SHA512:	1e5879777fc2b9761ed4359400e4e72257a3fbf7df4f76d7e6194d08cc0715fbe7118ba7982341387ea396e432493560eba63d422af9c63710a628af21d0bf0a
SSDEEP:	98304:vnvaQg84Jn0/n2vsUk4Vp3zCMt15mm1BkcDvZ6cDFV/aZNcGTuPSKt4Vpm79:vvirfdGTuqTc5
TLSH:	63B6076D6B851C79E049C8708266CAD30A3234CB0DF5A56F53AE31253E7DBF16EF9209
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Pt.QPt.QPt.QY.]Q^t.Q...P.t.Q...P^t.Q...PYt.QPt.Q8u.Q...POt.QPt.Q[t.QI.1QQt.QI..PQt.QRichPt.Q................PE..d...>..d...

Entrypoint:	0x1404ccfc8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64CBB03E [Thu Aug 3 13:48:46 2023 UTC]
TLS Callbacks:	0x40366e40, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	624308b184b1ceba6797222aacf8b981

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9bc07c	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa08000	0xc560	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x9c1000	0x45438	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa15000	0x9064	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8bd720	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x8bd780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x8bd5e0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4e5000	0xb98	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4e3810	0x4e3a00	943d47e4350f54d4ceaadccf3cb01532	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4e5000	0x4d994c	0x4d9a00	36c1ab810e8245fcb7f0033f1777d8d2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9bf000	0x1410	0x400	a9ef0836ee6726a68263f989192c3b7b	False	0.248046875	data	2.349458944747783	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x9c1000	0x45438	0x45600	0384f66585ff2b31a2c3033dd1a07dde	False	0.4321966497747748	data	6.609168779519522	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0xa07000	0x15c	0x200	adffdcbbae2d7f51cd5463f248f37776	False	0.404296875	data	3.3574443590411454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xa08000	0xc560	0xc600	b8d2c2c2515d7015d158ab858009e29e	False	0.979068023989899	data	7.943596567740648	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa15000	0x9064	0x9200	290766afcbd24cd80f6519715b096457	False	0.2707887414383562	data	5.457398538144074	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xa083c0	0x98e	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.0044971381847916
RT_ICON	0xa08d50	0x3a5	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0117899249732047
RT_ICON	0xa090f8	0x664	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.006723716381418
RT_ICON	0xa09760	0x10a0	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.0025845864661653
RT_ICON	0xa0a800	0x1826	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.001779359430605
RT_ICON	0xa0c028	0x8385	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9968814042591108
RT_GROUP_ICON	0xa143b0	0x5a	data	English	United States	0.7777777777777778
RT_VERSION	0xa08220	0x1a0	data	English	United States	0.49759615384615385
RT_MANIFEST	0xa14410	0x14e	ASCII text, with very long lines (334), with no line terminators	English	United States	0.6586826347305389