urlscan.io logo urlscan.io
SecurityTrails logo

ired.team Open in urlscan Pro
2606:4700:3030::681f:5ab4  Public Scan

Go To Rescan Add Verdict Report
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Submission: On May 01 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 13 IPs in 3 countries across 11 domains to perform 53 HTTP transactions. The main IP is 2606:4700:3030::681f:5ab4, located in United States and belongs to CLOUDFLARENET, US. The main domain is ired.team.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on September 11th 2019. Valid for: a year.
This is the only time ired.team was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

1    2606:4700:3030::681f:5ab4 (United States)

ASN13335 (CLOUDFLARENET, US)
ired.team
1    2a00:1450:4001:820::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2606:4700::6810:7eaf (United States)

ASN13335 (CLOUDFLARENET, US)
unpkg.com
10    2606:4700:20::681a:6cd (United States)

ASN13335 (CLOUDFLARENET, US)
gstatic.gitbook.com
app.gitbook.com
www.gitbook.com
1    2a04:4e42:200::621 (Ascension Island)

ASN54113 (FASTLY, US)
polyfill.io
22    34.107.207.82 (United States)

ASN15169 (GOOGLE, US)
PTR: 82.207.107.34.bc.googleusercontent.com
gblobscdn.gitbook.com
2    2a00:1450:4001:80b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
lh5.googleusercontent.com
2    2a02:26f0:6c00:19e::353e (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
docs.microsoft.com
1    2a00:1450:4001:81f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2606:4700:e2::ac40:8a14 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.lr-ingest.io
7    2600:1901:0:94b6:: (United States)

ASN15169 (GOOGLE, US)
gitbook-28427.firebaseio.com
s-usc1c-nss-282.firebaseio.com
3    2a00:1450:4001:81b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
Domain Requested by
22 gblobscdn.gitbook.com ired.team
gstatic.gitbook.com
8 gstatic.gitbook.com ired.team
gstatic.gitbook.com
6 s-usc1c-nss-282.firebaseio.com gstatic.gitbook.com
3 www.google-analytics.com gstatic.gitbook.com
2 docs.microsoft.com ired.team
2 lh5.googleusercontent.com ired.team
gstatic.gitbook.com
1 www.gitbook.com gstatic.gitbook.com
1 gitbook-28427.firebaseio.com gstatic.gitbook.com
1 app.gitbook.com gstatic.gitbook.com
1 cdn.lr-ingest.io gstatic.gitbook.com
1 fonts.gstatic.com ired.team
1 polyfill.io ired.team
1 unpkg.com ired.team
1 fonts.googleapis.com ired.team
1 ired.team
53 15
Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2019-09-11 -
2020-09-10		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2020-04-07 -
2020-06-30		 3 months crt.sh
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2020-04-16 -
2021-04-17		 a year crt.sh
gblobscdn.gitbook.com
GTS CA 1D2		 2020-04-22 -
2020-07-21		 3 months crt.sh
*.googleusercontent.com
GTS CA 1O1		 2020-04-07 -
2020-06-30		 3 months crt.sh
docs.microsoft.com
Microsoft IT TLS CA 1		 2019-04-19 -
2021-04-19		 2 years crt.sh
*.gstatic.com
GTS CA 1O1		 2020-04-07 -
2020-06-30		 3 months crt.sh
firebaseio.com
GTS CA 1O1		 2020-02-20 -
2021-02-18		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-04-07 -
2020-06-30		 3 months crt.sh

This page contains 3 frames:

Primary Page: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Frame ID: A7288BF361CE69DA1D82AB687786AC25
Requests: 46 HTTP requests in this frame

Frame: https://gitbook-28427.firebaseio.com/.lp?start=t&ser=86555561&cb=1&v=5
Frame ID: 8158F146589C6697E9CC631628FF3CC9
Requests: 6 HTTP requests in this frame

Frame: https://s-usc1c-nss-282.firebaseio.com/.lp?dframe=t&id=2868774&pw=jyVLHyFQ8w&ns=gitbook-28427
Frame ID: C4114ABF36CAAFEAD5C4D2FEB32A7B93
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<[^>]+data-react/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • script /\/polyfill\.min\.js/i

Page Statistics

53
Requests

98 %
HTTPS

92 %
IPv6

11
Domains

15
Subdomains

13
IPs

3
Countries

4163 kB
Transfer

10351 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

53 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
ired.team/offensive-security/defense-evasion/ 		2 MB
304 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::681f:5ab4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c5aba96614dbffed76d491c394e2afaf35c5ede4f3e63c08d24894f7b4d6332

Request headers

:method
GET
:authority
ired.team
:scheme
https
:path
/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Fri, 01 May 2020 19:13:46 GMT
content-type
text/html; charset=utf-8
set-cookie
__cfduid=d39fd69a711342ff6446c4a92968232351588360426; expires=Sun, 31-May-20 19:13:46 GMT; path=/; domain=.ired.team; HttpOnly; SameSite=Lax
age
75560
last-modified
Thu, 30 Apr 2020 22:14:26 GMT
vary
Accept-Encoding
x-cache
HIT
x-cdn-cache-group
-LFEMnER3fywgFHoroYn
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
58cbd259fbe4d6c5-FRA
content-encoding
br
cf-request-id
027341cc3f0000d6c5523dd200000001
css
fonts.googleapis.com/ 		2 KB
682 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Source+Code+Pro:500
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
dfbf03bd10a5461d085675f9ab7c442b3b4dbe2c5001a661a3925ac9f1378cb6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 01 May 2020 19:13:46 GMT
server
ESF
date
Fri, 01 May 2020 19:13:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 01 May 2020 19:13:46 GMT
emojione-sprite-40.min.css
unpkg.com/emojione-assets@4.0.0/sprites/ 		183 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/emojione-assets@4.0.0/sprites/emojione-sprite-40.min.css
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7eaf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5e939d7d3f9c9bfe632d16484c12354fa89a12738f30f738aa81c984e5b9a92
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 01 May 2020 19:13:46 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
659079
status
200
vary
Accept-Encoding
cf-request-id
027341ccce0000274e012c7200000001
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
server
cloudflare
etag
W/"2dc7c-MlEndlChcp6B66cJCh5yD8CB/Fo"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
access-control-allow-origin
*
x-cloud-trace-context
e9a16aeaeb575aad39009b5bf7f9e8da
cache-control
public, max-age=31536000
cf-ray
58cbd25aefdd274e-FRA
6c3c9dec9383137845be0f0ea2cf1bf4.css
gstatic.gitbook.com/css/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gstatic.gitbook.com/css/6c3c9dec9383137845be0f0ea2cf1bf4.css
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:6cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5ff636c13e4983198fbed7d325d1cbafbe544702de06f5874c46e359ce68b43

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 01 May 2020 19:13:46 GMT
content-encoding
br
cf-cache-status
HIT
age
1544110
cf-polished
origSize=1701
x-guploader-uploadid
AEnB2UrlDK_P-tvLL-hZ_KGdddll9vW79s8Qa_b-ki9YM-sK1t0EWBgQY9--qdFaOWT8Vnfu71c6ElLCX4IAdLRYoC4u5ADuSV8savv_0MOwQLLCCCI-0so
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
text/css
cf-request-id
027341cce20000dff7fb161200000001
last-modified
Sat, 04 Apr 2020 21:36:58 GMT
server
cloudflare
etag
W/"6c3c9dec9383137845be0f0ea2cf1bf4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=hL62rA==, md5=bDyd7JODE3hFvg8Oos8b9A==
x-goog-generation
1583845128372242
access-control-allow-origin
*
expires
Fri, 09 Apr 2021 13:05:02 GMT
cache-control
public, max-age=31536000
x-goog-stored-content-length
1701
cf-ray
58cbd25b0e15dff7-FRA
cf-bgj
minify
polyfill.min.js
polyfill.io/v3/ 		72 B
554 B 		Script
General
Check archive.org
Download Go to
Full URL
https://polyfill.io/v3/polyfill.min.js?flags=gated&features=Intl
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:200::621 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
br
x-content-type-options
nosniff
content-type
text/javascript; charset=utf-8
age
3719882
detected-user-agent
Chrome/74.0.3729
status
200
request_came_from_shield
FRA
server-timing
HIT-CLUSTER, fastly;desc="Edge time";dur=1, HIT-CLUSTER, fastly;desc="Edge time";dur=1
content-length
74
referrer-policy
origin-when-cross-origin
last-modified
Thu, 19 Mar 2020 17:46:14 GMT
date
Fri, 01 May 2020 19:13:46 GMT
vary
User-Agent, Accept-Encoding
access-control-allow-methods
GET,HEAD,OPTIONS
normalized-user-agent
chrome/74.0.0
access-control-allow-origin
*
cache-control
public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges
bytes
timing-allow-origin
*
spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png
gblobscdn.gitbook.com/ 		28 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png?generation=1536436814766237&alt=media
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
aee2771f5f57ecf568ffffd5c0d0fee81b7fb2b5540e10d856f2462abdbd5f92

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 09 Apr 2020 00:49:57 GMT
age
1967029
x-guploader-uploadid
AEnB2Urt8YQ_L9xzkIZOdRNa39WsqXLETdDOw_QhRA6rHe00N8SoQltvi1iYn9OUmOgU0ivalxLQuj96t3fYI7Qhp5Ze1ZwaMqIlMOmuvTRZxV4HMO-o6aw
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
clear
content-length
29066
last-modified
Sat, 08 Sep 2018 20:00:14 GMT
server
UploadServer
etag
"2965c5f978755802debc0291c5574853"
x-goog-hash
crc32c=ALxBKw==, md5=KWXF+Xh1WALevAKRxVdIUw==
x-goog-generation
1536436814766237
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
29066
x-goog-meta-firebasestoragedownloadtokens
1910800b-eed5-42ea-b282-39d0660128fe
accept-ranges
bytes
content-type
image/png
expires
Fri, 09 Apr 2021 00:49:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjArc3FHP4Bp0ltWUOF%2Fimage.png
gblobscdn.gitbook.com/ 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjArc3FHP4Bp0ltWUOF%2Fimage.png?alt=media&token=5ff75d70-bcdb-4451-9082-b07ab0e4b6e2
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1e7af20bf828f0bef62fdc576b55c1ff6e2fce144321286548e6603f5de5b3c2

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98389
x-guploader-uploadid
AAANsUlp8KIHquWL3cqjnc4ac8WIyXwxruPxGKOnIvbFgVPc8BK6oU5YVWj5HsTpLOrDJHq5Efn-AGcnjf-XQS8UIc79WUVZ3g
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
42185
last-modified
Sun, 07 Jul 2019 13:19:57 GMT
server
UploadServer
etag
"ca14c741761d2f3e3cd310eb2589cdeb"
x-goog-hash
crc32c=VButHw==, md5=yhTHQXYdLz480xDrJYnN6w==
x-goog-generation
1562505597293291
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
42185
x-goog-meta-firebasestoragedownloadtokens
5ff75d70-bcdb-4451-9082-b07ab0e4b6e2
accept-ranges
bytes
content-type
image/png
expires
Fri, 30 Apr 2021 15:53:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjBZIlBFPLR4UN-jdL5%2Fimage.png
gblobscdn.gitbook.com/ 		46 KB
46 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjBZIlBFPLR4UN-jdL5%2Fimage.png?alt=media&token=fe38d794-7ef3-429f-946d-097bee5f8565
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
7edc4c63b721a6cf081a6f4b9a676d64abb7953ee6bb770f45d0b6a7ca5f1d79

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 01 May 2020 19:13:46 GMT
x-guploader-uploadid
AAANsUkXdas-Fm1cvSM5Ws7op3t8vudAxXLPzD814C41M0FFk9W2q1TU7Afk4fY66qvVcotbbqIb43IC9IH6d8AAEuk
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
46600
last-modified
Sun, 07 Jul 2019 13:19:57 GMT
server
UploadServer
etag
"fe685c9c5e46f45e0d699f9c1835d3e3"
x-goog-hash
crc32c=PXQLdQ==, md5=/mhcnF5G9F4NaZ+cGDXT4w==
x-goog-generation
1562505597085480
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
46600
x-goog-meta-firebasestoragedownloadtokens
fe38d794-7ef3-429f-946d-097bee5f8565
accept-ranges
bytes
content-type
image/png
expires
Sat, 01 May 2021 19:13:46 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjAypSnABoamJA5qtKP%2Fimage.png
gblobscdn.gitbook.com/ 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjAypSnABoamJA5qtKP%2Fimage.png?alt=media&token=c3e845dc-f3f0-484b-b9cd-173e5b92c970
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
25599a4f79b3b74be393d2a0d55386ed73a28360af4f7b693a75593e8ff36a8b

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98389
x-guploader-uploadid
AAANsUlq7UVXSwu0lNVRkbZX9PftFAc7DK3QFDn76iQk0ikbUfjtqyEzf4U_k7W1CsORE57nvUQc2DwGke884yvZc8_9u4944A
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
27890
last-modified
Sun, 07 Jul 2019 13:19:57 GMT
server
UploadServer
etag
"9f676533c7e81b9c2aa11bc347c2a2e9"
x-goog-hash
crc32c=jIgsaA==, md5=n2dlM8foG5wqoRvDR8Ki6Q==
x-goog-generation
1562505597082428
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
27890
x-goog-meta-firebasestoragedownloadtokens
c3e845dc-f3f0-484b-b9cd-173e5b92c970
accept-ranges
bytes
content-type
image/png
expires
Fri, 30 Apr 2021 15:53:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjBZcR2cOj3bna9xZac%2Fimage.png
gblobscdn.gitbook.com/ 		90 KB
91 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjBZcR2cOj3bna9xZac%2Fimage.png?alt=media&token=59316efd-8f34-4808-b60f-43d2fb36f4b2
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
bd8421a188c6b000167a66d7397edf18c54c7f18c24e0fe078d7c45aeae84ef4

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98389
x-guploader-uploadid
AAANsUm60iCzCiayMQarhNiS2_qNRAdVaGzOuP9z7BLP2k1WmMm54fE94SOBW_aqTsEKAsGzIpWD6h9at6cnKK-iuzDSlJSP7g
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
92397
last-modified
Sun, 07 Jul 2019 13:19:57 GMT
server
UploadServer
etag
"2b0fd2b58694f79194dbad709c1b407b"
x-goog-hash
crc32c=JN5RqQ==, md5=Kw/StYaU95GU261wnBtAew==
x-goog-generation
1562505597695041
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
92397
x-goog-meta-firebasestoragedownloadtokens
59316efd-8f34-4808-b60f-43d2fb36f4b2
accept-ranges
bytes
content-type
image/png
expires
Fri, 30 Apr 2021 15:53:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBbmzimlPcrRQgsuBT%2Fimage.png
gblobscdn.gitbook.com/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBbmzimlPcrRQgsuBT%2Fimage.png?alt=media&token=a250b915-a7e2-4760-8183-d576f1482b3d
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
7f064bc8ed20d75e78805ec7c40459498070952acb3985faca22a35e3c9f78b5

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98389
x-guploader-uploadid
AAANsUmtEfEPoeq6WfO1QVLX3A6u1sVbp9E7G3aooxGayb1UlSvdZj05Dq3gzPjDLXQFTZbSiqzf4CHQfISBSC7_2CvA6zlDNw
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
9204
last-modified
Sun, 07 Jul 2019 13:50:14 GMT
server
UploadServer
etag
"7e21e93c4eb6c35937cae29ac75c189d"
x-goog-hash
crc32c=55IcWA==, md5=fiHpPE62w1k3yuKax1wYnQ==
x-goog-generation
1562507414312028
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
9204
x-goog-meta-firebasestoragedownloadtokens
a250b915-a7e2-4760-8183-d576f1482b3d
accept-ranges
bytes
content-type
image/png
expires
Fri, 30 Apr 2021 15:53:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBbx9pxN_2vbFOEkEZ%2Fimage.png
gblobscdn.gitbook.com/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBbx9pxN_2vbFOEkEZ%2Fimage.png?alt=media&token=95617a95-5298-48cf-a2de-f2dcfe881df5
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
2069c259c3eef690d62c0d9ca55a89498efbaedeb74b65070513ffbf60df6bb6

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 01 May 2020 19:13:46 GMT
x-guploader-uploadid
AAANsUk1-W9Zrxh_TVCk62gq5DVGWuKLMpc3sCSTH1xS0wSvSsMMzSsOLorNmIh7OgOFXFsrmR_eXsy43274_ukmWT0
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
28334
last-modified
Sun, 07 Jul 2019 13:50:14 GMT
server
UploadServer
etag
"96ff9af4be090f6f1b9cd6b152632c9f"
x-goog-hash
crc32c=NlADyQ==, md5=lv+a9L4JD28bnNaxUmMsnw==
x-goog-generation
1562507414384037
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
28334
x-goog-meta-firebasestoragedownloadtokens
95617a95-5298-48cf-a2de-f2dcfe881df5
accept-ranges
bytes
content-type
image/png
expires
Sat, 01 May 2021 19:13:46 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBd_DMd_yudyBgGuWB%2Fimage.png
gblobscdn.gitbook.com/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBd_DMd_yudyBgGuWB%2Fimage.png?alt=media&token=dee1844a-d4b1-4ff9-b234-06b2af94cea2
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
0dce5da46efff3e6f2a0becf8686d2a98b52c575e3d23affab7a091d8b27d1f9

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98389
x-guploader-uploadid
AAANsUlsYTbs_i5eb9cc6JqN4LEs6sbaR-pzmkhJ3IsOjuON4D40go7yGPEIaYXGKXPjFTw13F4vfa8It0afB2qV9-_ai7qeSw
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
25134
last-modified
Sun, 07 Jul 2019 13:50:14 GMT
server
UploadServer
etag
"17b7f296cb9b1b39f97ebc9bd1e5f41e"
x-goog-hash
crc32c=ThmbgQ==, md5=F7fylsubGzn5fryb0eX0Hg==
x-goog-generation
1562507414318112
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
25134
x-goog-meta-firebasestoragedownloadtokens
dee1844a-d4b1-4ff9-b234-06b2af94cea2
accept-ranges
bytes
content-type
image/png
expires
Fri, 30 Apr 2021 15:53:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBeB7V-PtWxmKUSdwo%2Fimage.png
gblobscdn.gitbook.com/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBeB7V-PtWxmKUSdwo%2Fimage.png?alt=media&token=6cae38da-10f6-4375-87dd-fa9553be721b
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
35167ba1fc4cf1fc06cf5c7d659855729ac71fa694a7cb007ac76d2cf5160883

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98389
x-guploader-uploadid
AAANsUl7CJS9EFD2FRC1x6WMhj5ioUR2SFzrzV2cmhL8aEpKkCp5prSPgzkQsBCumsBfIbWRsiwru3-HLNrKAFzr062AMVyy1A
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
19691
last-modified
Sun, 07 Jul 2019 13:50:14 GMT
server
UploadServer
etag
"9202003a2104260df732b0ec0b13b60e"
x-goog-hash
crc32c=RFG7fw==, md5=kgIAOiEEJg33MrDsCxO2Dg==
x-goog-generation
1562507414340087
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
19691
x-goog-meta-firebasestoragedownloadtokens
6cae38da-10f6-4375-87dd-fa9553be721b
accept-ranges
bytes
content-type
image/png
expires
Fri, 30 Apr 2021 15:53:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBgEfj9hapb_G_hQm8%2Fimage.png
gblobscdn.gitbook.com/ 		105 KB
105 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBgEfj9hapb_G_hQm8%2Fimage.png?alt=media&token=ba8aab2e-113c-433f-9490-03d371794790
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
395aee6ff583c57a3b9c68837e58ebd3ab82dc69277f22e8532b61fe97ed298c

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98389
x-guploader-uploadid
AAANsUkM8aQ8HR5nrMHvKqzixizo8CywusCabO9UZtrTPBrowopAGkNFqMz3MrhNnUDjz-clKNkoM9S7VXQQQwG3B1pAviyY_w
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
107667
last-modified
Sun, 07 Jul 2019 13:50:15 GMT
server
UploadServer
etag
"731d9f99b1f900e807fa1627250db841"
x-goog-hash
crc32c=u6c++Q==, md5=cx2fmbH5AOgH+hYnJQ24QQ==
x-goog-generation
1562507415058104
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
107667
x-goog-meta-firebasestoragedownloadtokens
ba8aab2e-113c-433f-9490-03d371794790
accept-ranges
bytes
content-type
image/png
expires
Fri, 30 Apr 2021 15:53:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBgbyzlmx2SIrGuGIk%2Fsyscall-debugging.gif
gblobscdn.gitbook.com/ 		796 KB
797 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBgbyzlmx2SIrGuGIk%2Fsyscall-debugging.gif?alt=media&token=a66279aa-f0d6-426c-bfeb-c95c8896aabb
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
26229819090dce19bc974819478b2daa7be55f4f7803259b68eb9f6af6587dbe

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98389
x-guploader-uploadid
AAANsUnTCrZs-nnGodBbXIeViADe2GO0gfjomT5WFZLWg3JXU7y4EowMcgWKymRsDlwnxqIeQV3SXutNRvHVY6SWn4jgwmHz-g
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''syscall-debugging.gif
alt-svc
clear
content-length
815106
last-modified
Sun, 07 Jul 2019 13:50:15 GMT
server
UploadServer
etag
"3b64be8009f87c22037997bc714e1d19"
x-goog-hash
crc32c=KWhVFw==, md5=O2S+gAn4fCIDeZe8cU4dGQ==
x-goog-generation
1562507415745379
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
815106
x-goog-meta-firebasestoragedownloadtokens
a66279aa-f0d6-426c-bfeb-c95c8896aabb
accept-ranges
bytes
content-type
image/gif
expires
Fri, 30 Apr 2021 15:53:57 GMT
photo.jpg
lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/photo.jpg
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
3e46dc2084ab2945b5af16a2d88abcd6fa7e8aa5ef5a43fc6c83ce561b6c9577
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 01 May 2020 15:36:33 GMT
x-content-type-options
nosniff
age
13033
status
200
content-disposition
inline;filename=""
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6707
x-xss-protection
0
server
fife
etag
"v5e"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sat, 02 May 2020 06:41:13 GMT
logo-ms-social.png
docs.microsoft.com/en-us/media/logos/ 		449 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://docs.microsoft.com/en-us/media/logos/logo-ms-social.png
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:19e::353e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
2d59b358c254d5467046e6f341825949aafecfe46af27b541fae72850c9fc41f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
status
200
content-length
449
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
x-rendering-stack
Static
last-modified
Mon, 16 Dec 2019 19:04:37 GMT
x-datacenter
wus
date
Fri, 01 May 2020 19:13:46 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
content-type
image/png
cache-control
public, max-age=401
etag
"0x8D7825ACB981CED"
akamai-cache-status
Hit from child
request-context
appId=cid-v1:21aee9e4-1cf5-4750-b2bd-78b2747f4211
expires
Fri, 01 May 2020 19:20:27 GMT
f4fa50c4003f87e7dc10459e500933c3.woff
gstatic.gitbook.com/fonts/ 		92 KB
93 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gstatic.gitbook.com/fonts/f4fa50c4003f87e7dc10459e500933c3.woff
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:6cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e692de9565d90dd947a080d4d10cee72a83447ba053e08fdcac457d7197128a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Origin
https://ired.team

Response headers

date
Fri, 01 May 2020 19:13:46 GMT
cf-cache-status
HIT
age
1535182
status
200
x-guploader-uploadid
AEnB2UpI_BqTAZIOqM1zQJlYUz0lXS0y6CCvAisuh6orhBvUiwbkdq2I4d0l9u_a7ojhHngwXtxqFpd0RBCd8usJCH_hf3YGqwqRkumAONewcAEgD110wjc
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
font/woff
content-length
94368
cf-request-id
027341cd390000175225bed200000001
expires
Fri, 09 Apr 2021 13:05:03 GMT
last-modified
Sat, 04 Apr 2020 21:36:58 GMT
server
cloudflare
etag
"f4fa50c4003f87e7dc10459e500933c3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=FUjfEA==, md5=9PpQxAA/h+fcEEWeUAkzww==
x-goog-generation
1583845128534922
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=31536000
x-goog-stored-content-length
94368
accept-ranges
bytes
cf-ray
58cbd25b8ac31752-FRA
cf-bgj
h2pri
72e37e5bf95a8dba938c78b1d7d91253.woff
gstatic.gitbook.com/fonts/ 		92 KB
92 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gstatic.gitbook.com/fonts/72e37e5bf95a8dba938c78b1d7d91253.woff
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:6cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a18af7799b7d241fe5d00645492ccedcad39815e9f4125b7e3e90b18a1b77405

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Origin
https://ired.team

Response headers

date
Fri, 01 May 2020 19:13:46 GMT
cf-cache-status
HIT
age
1535182
status
200
x-guploader-uploadid
AEnB2UrrToZ8KtegJ75zLiPdmAHW0fh7OS5nNA7n8RsxUWN1rCy5hDee-93hQaO_02Ofau_9--zYW6AGgX6X9fau5qjYFRSYfg
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
font/woff
content-length
94040
cf-request-id
027341cd390000175225bee200000001
expires
Fri, 09 Apr 2021 13:05:03 GMT
last-modified
Sat, 04 Apr 2020 21:36:58 GMT
server
cloudflare
etag
"72e37e5bf95a8dba938c78b1d7d91253"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=TBIniA==, md5=cuN+W/lajbqTjHix19kSUw==
x-goog-generation
1583845128570709
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=31536000
x-goog-stored-content-length
94040
accept-ranges
bytes
cf-ray
58cbd25b8ac71752-FRA
cf-bgj
h2pri
fc3d4b35e4d07d4e0485cc2db0e57c77.woff
gstatic.gitbook.com/fonts/ 		92 KB
92 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gstatic.gitbook.com/fonts/fc3d4b35e4d07d4e0485cc2db0e57c77.woff
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:6cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b87e90677bdbc3c6bc296a368f57b2d72783c1a7c6e8e9325cd1645c18039cf2

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Origin
https://ired.team

Response headers

date
Fri, 01 May 2020 19:13:46 GMT
cf-cache-status
HIT
age
654505
status
200
x-guploader-uploadid
AEnB2UqsZ3WK_xS0YchRtujyaXSHhWyr8A3u9cWzDfV84KgDBxBluJjubL9gKNbI1STPBxQltx3kLRWA6bEaNRNxSvRzAcBChQ
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
font/woff
content-length
93788
cf-request-id
027341cd390000175225bef200000001
expires
Thu, 15 Apr 2021 16:25:09 GMT
last-modified
Sat, 04 Apr 2020 21:36:58 GMT
server
cloudflare
etag
"fc3d4b35e4d07d4e0485cc2db0e57c77"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=7TN+QQ==, md5=/D1LNeTQfU4EhcwtsOV8dw==
x-goog-generation
1584024803933768
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=31536000
x-goog-stored-content-length
93788
accept-ranges
bytes
cf-ray
58cbd25b8ac81752-FRA
cf-bgj
h2pri
HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDs-cq7Gq0DA.woff2
fonts.gstatic.com/s/sourcecodepro/v11/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/sourcecodepro/v11/HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDs-cq7Gq0DA.woff2
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
59fd4f207936792ab9910baa7df5f1f7bff899e35e0428df34ab9a1319184052
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Source+Code+Pro:500
Origin
https://ired.team

Response headers

date
Fri, 10 Apr 2020 01:05:56 GMT
x-content-type-options
nosniff
last-modified
Thu, 22 Aug 2019 20:45:13 GMT
server
sffe
age
1879670
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11232
x-xss-protection
0
expires
Sat, 10 Apr 2021 01:05:56 GMT
111.56af2e09.js
gstatic.gitbook.com/js/ 		3 MB
871 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gstatic.gitbook.com/js/111.56af2e09.js
Requested by
Host: ired.team
URL: https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:6cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b17f50e223ca3160ec991c1c5c076ab1887c3fdfc6e55eccec9aa055c71df97

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Origin
https://ired.team

Response headers

date
Fri, 01 May 2020 19:13:47 GMT
content-encoding
br
cf-cache-status
HIT
age
89759
status
200
cf-polished
origSize=3387213
x-guploader-uploadid
AAANsUnJPRP6ttuW5Iy1dwwKN8NVyPmEzKjZv9qbUGsGvbuZO1A08nB_oR-BqI2OrVNGj5DaTb9cjPqojccenzYUBheWzg0z8w
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
application/javascript
cf-request-id
027341cdf00000175225bfa200000001
expires
Fri, 30 Apr 2021 17:58:43 GMT
last-modified
Thu, 30 Apr 2020 17:56:30 GMT
server
cloudflare
etag
W/"69cd4711e45d89d06489668f03ac8fe7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=gqVkoA==, md5=ac1HEeRdidBkiWaPA6yP5w==
x-goog-generation
1588269390185624
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=31536000
x-goog-stored-content-length
3387213
cf-ray
58cbd25cbde21752-FRA
cf-bgj
minify
logger.min.js
cdn.lr-ingest.io/ 		576 KB
106 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.lr-ingest.io/logger.min.js
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e2::ac40:8a14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53b8d255226031c6f07a2449be75f6921445015794368338915b0258027eb4ab
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 01 May 2020 19:13:47 GMT
content-encoding
br
vary
x-fh-requested-host, accept-encoding
cf-cache-status
HIT
age
81
x-cache
MISS
status
200
cf-request-id
027341cf890000c303de2ac200000001
x-served-by
cache-fra19129-FRA
last-modified
Thu, 30 Apr 2020 21:14:05 GMT
server
cloudflare
x-timer
S1588281468.039349,VS0,VE542
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31556926
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=14400
cf-ray
58cbd25f4d47c303-FRA
x-cache-hits
0
__session
app.gitbook.com/ 		52 B
702 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://app.gitbook.com/__session?proposed=7bbc8ce6-b0b4-497d-9ae8-4bdb46bc6138R
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:6cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
14c9136afe477a76ba02f06c4ac54f9b113ff9293a13d00c5e23f88731b278d5

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 01 May 2020 19:13:47 GMT
via
no cache
cf-cache-status
DYNAMIC
x-magic-hash
0c71221fe7a9d44f86834ac0afe7508740d8808d5b027623c501298d89c03251
x-powered-by
Express
x-cache
MISS
x-release
gitbook-28427-6.17.1
status
200
content-encoding
br
cf-request-id
027341d1350000dff7fb1cd200000001
server
cloudflare
etag
W/"34-liRn7LWJNnkxN/cgVwBegNDchMo"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://ired.team
x-cloud-trace-context
a360260c66529bafce774bf112cffad0
cache-control
private
access-control-allow-credentials
true
function-execution-id
9h59j7p7aeik
cf-ray
58cbd261e9d8dff7-FRA
expires
Fri, 01 May 2020 19:13:47 GMT
1c4a6b9f-6597-4bf0-b6fa-7728503663d9
https://ired.team/ 		399 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://ired.team/1c4a6b9f-6597-4bf0-b6fa-7728503663d9
Requested by
Host: cdn.lr-ingest.io
URL: https://cdn.lr-ingest.io/logger.min.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
72abbaa875e73f02588ce2b6a15f4df2a7b9f8c508d82b12a0f7623feea0e150

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
408112
.lp
gitbook-28427.firebaseio.com/ Frame 8158 		422 B
664 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gitbook-28427.firebaseio.com/.lp?start=t&ser=86555561&cb=1&v=5
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
305a3fcc13963e6fba6dbba64954ff38ac891602d4f1292e9a95bf170d4ac2a0
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 01 May 2020 19:13:48 GMT
Server
nginx
Connection
keep-alive
Content-Length
422
Strict-Transport-Security
max-age=31556926; includeSubDomains; preload
Content-Type
application/javascript; charset=utf-8
spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png
gblobscdn.gitbook.com/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png?generation=1536436814766237&alt=media
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
aee2771f5f57ecf568ffffd5c0d0fee81b7fb2b5540e10d856f2462abdbd5f92

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 09 Apr 2020 00:49:57 GMT
age
1967031
x-guploader-uploadid
AEnB2Urt8YQ_L9xzkIZOdRNa39WsqXLETdDOw_QhRA6rHe00N8SoQltvi1iYn9OUmOgU0ivalxLQuj96t3fYI7Qhp5Ze1ZwaMqIlMOmuvTRZxV4HMO-o6aw
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
clear
content-length
29066
last-modified
Sat, 08 Sep 2018 20:00:14 GMT
server
UploadServer
etag
"2965c5f978755802debc0291c5574853"
x-goog-hash
crc32c=ALxBKw==, md5=KWXF+Xh1WALevAKRxVdIUw==
x-goog-generation
1536436814766237
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
29066
x-goog-meta-firebasestoragedownloadtokens
1910800b-eed5-42ea-b282-39d0660128fe
accept-ranges
bytes
content-type
image/png
expires
Fri, 09 Apr 2021 00:49:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjArc3FHP4Bp0ltWUOF%2Fimage.png
gblobscdn.gitbook.com/ 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjArc3FHP4Bp0ltWUOF%2Fimage.png?alt=media&token=5ff75d70-bcdb-4451-9082-b07ab0e4b6e2
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1e7af20bf828f0bef62fdc576b55c1ff6e2fce144321286548e6603f5de5b3c2

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98391
x-guploader-uploadid
AAANsUlp8KIHquWL3cqjnc4ac8WIyXwxruPxGKOnIvbFgVPc8BK6oU5YVWj5HsTpLOrDJHq5Efn-AGcnjf-XQS8UIc79WUVZ3g
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
42185
last-modified
Sun, 07 Jul 2019 13:19:57 GMT
server
UploadServer
etag
"ca14c741761d2f3e3cd310eb2589cdeb"
x-goog-hash
crc32c=VButHw==, md5=yhTHQXYdLz480xDrJYnN6w==
x-goog-generation
1562505597293291
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
42185
x-goog-meta-firebasestoragedownloadtokens
5ff75d70-bcdb-4451-9082-b07ab0e4b6e2
accept-ranges
bytes
content-type
image/png
expires
Fri, 30 Apr 2021 15:53:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjBZIlBFPLR4UN-jdL5%2Fimage.png
gblobscdn.gitbook.com/ 		46 KB
46 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjBZIlBFPLR4UN-jdL5%2Fimage.png?alt=media&token=fe38d794-7ef3-429f-946d-097bee5f8565
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
7edc4c63b721a6cf081a6f4b9a676d64abb7953ee6bb770f45d0b6a7ca5f1d79

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 01 May 2020 19:13:46 GMT
age
2
x-guploader-uploadid
AAANsUkXdas-Fm1cvSM5Ws7op3t8vudAxXLPzD814C41M0FFk9W2q1TU7Afk4fY66qvVcotbbqIb43IC9IH6d8AAEuk
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
46600
last-modified
Sun, 07 Jul 2019 13:19:57 GMT
server
UploadServer
etag
"fe685c9c5e46f45e0d699f9c1835d3e3"
x-goog-hash
crc32c=PXQLdQ==, md5=/mhcnF5G9F4NaZ+cGDXT4w==
x-goog-generation
1562505597085480
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
46600
x-goog-meta-firebasestoragedownloadtokens
fe38d794-7ef3-429f-946d-097bee5f8565
accept-ranges
bytes
content-type
image/png
expires
Sat, 01 May 2021 19:13:46 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjAypSnABoamJA5qtKP%2Fimage.png
gblobscdn.gitbook.com/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjAypSnABoamJA5qtKP%2Fimage.png?alt=media&token=c3e845dc-f3f0-484b-b9cd-173e5b92c970
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
25599a4f79b3b74be393d2a0d55386ed73a28360af4f7b693a75593e8ff36a8b

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98391
x-guploader-uploadid
AAANsUlq7UVXSwu0lNVRkbZX9PftFAc7DK3QFDn76iQk0ikbUfjtqyEzf4U_k7W1CsORE57nvUQc2DwGke884yvZc8_9u4944A
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
27890
last-modified
Sun, 07 Jul 2019 13:19:57 GMT
server
UploadServer
etag
"9f676533c7e81b9c2aa11bc347c2a2e9"
x-goog-hash
crc32c=jIgsaA==, md5=n2dlM8foG5wqoRvDR8Ki6Q==
x-goog-generation
1562505597082428
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
27890
x-goog-meta-firebasestoragedownloadtokens
c3e845dc-f3f0-484b-b9cd-173e5b92c970
accept-ranges
bytes
content-type
image/png
expires
Fri, 30 Apr 2021 15:53:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjBZcR2cOj3bna9xZac%2Fimage.png
gblobscdn.gitbook.com/ 		90 KB
90 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjAqJPrVK--o5vqKZl_%2F-LjBZcR2cOj3bna9xZac%2Fimage.png?alt=media&token=59316efd-8f34-4808-b60f-43d2fb36f4b2
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
bd8421a188c6b000167a66d7397edf18c54c7f18c24e0fe078d7c45aeae84ef4

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98391
x-guploader-uploadid
AAANsUm60iCzCiayMQarhNiS2_qNRAdVaGzOuP9z7BLP2k1WmMm54fE94SOBW_aqTsEKAsGzIpWD6h9at6cnKK-iuzDSlJSP7g
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
92397
last-modified
Sun, 07 Jul 2019 13:19:57 GMT
server
UploadServer
etag
"2b0fd2b58694f79194dbad709c1b407b"
x-goog-hash
crc32c=JN5RqQ==, md5=Kw/StYaU95GU261wnBtAew==
x-goog-generation
1562505597695041
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
92397
x-goog-meta-firebasestoragedownloadtokens
59316efd-8f34-4808-b60f-43d2fb36f4b2
accept-ranges
bytes
content-type
image/png
expires
Fri, 30 Apr 2021 15:53:57 GMT
6c3c9dec9383137845be0f0ea2cf1bf4.css
gstatic.gitbook.com/css/ 		1 KB
690 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gstatic.gitbook.com/css/6c3c9dec9383137845be0f0ea2cf1bf4.css
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:6cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5ff636c13e4983198fbed7d325d1cbafbe544702de06f5874c46e359ce68b43

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 01 May 2020 19:13:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1544112
cf-polished
origSize=1701
x-guploader-uploadid
AEnB2UrlDK_P-tvLL-hZ_KGdddll9vW79s8Qa_b-ki9YM-sK1t0EWBgQY9--qdFaOWT8Vnfu71c6ElLCX4IAdLRYoC4u5ADuSV8savv_0MOwQLLCCCI-0so
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
text/css
cf-request-id
027341d3440000dff7fb209200000001
last-modified
Sat, 04 Apr 2020 21:36:58 GMT
server
cloudflare
etag
W/"6c3c9dec9383137845be0f0ea2cf1bf4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=hL62rA==, md5=bDyd7JODE3hFvg8Oos8b9A==
x-goog-generation
1583845128372242
access-control-allow-origin
*
expires
Fri, 09 Apr 2021 13:05:02 GMT
cache-control
public, max-age=31536000
x-goog-stored-content-length
1701
cf-ray
58cbd2653b6cdff7-FRA
cf-bgj
minify
assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBbmzimlPcrRQgsuBT%2Fimage.png
gblobscdn.gitbook.com/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBbmzimlPcrRQgsuBT%2Fimage.png?alt=media&token=a250b915-a7e2-4760-8183-d576f1482b3d
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
7f064bc8ed20d75e78805ec7c40459498070952acb3985faca22a35e3c9f78b5

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98391
x-guploader-uploadid
AAANsUmtEfEPoeq6WfO1QVLX3A6u1sVbp9E7G3aooxGayb1UlSvdZj05Dq3gzPjDLXQFTZbSiqzf4CHQfISBSC7_2CvA6zlDNw
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
9204
last-modified
Sun, 07 Jul 2019 13:50:14 GMT
server
UploadServer
etag
"7e21e93c4eb6c35937cae29ac75c189d"
x-goog-hash
crc32c=55IcWA==, md5=fiHpPE62w1k3yuKax1wYnQ==
x-goog-generation
1562507414312028
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
9204
x-goog-meta-firebasestoragedownloadtokens
a250b915-a7e2-4760-8183-d576f1482b3d
accept-ranges
bytes
content-type
image/png
expires
Fri, 30 Apr 2021 15:53:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBbx9pxN_2vbFOEkEZ%2Fimage.png
gblobscdn.gitbook.com/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBbx9pxN_2vbFOEkEZ%2Fimage.png?alt=media&token=95617a95-5298-48cf-a2de-f2dcfe881df5
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
2069c259c3eef690d62c0d9ca55a89498efbaedeb74b65070513ffbf60df6bb6

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 01 May 2020 19:13:46 GMT
age
2
x-guploader-uploadid
AAANsUk1-W9Zrxh_TVCk62gq5DVGWuKLMpc3sCSTH1xS0wSvSsMMzSsOLorNmIh7OgOFXFsrmR_eXsy43274_ukmWT0
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
28334
last-modified
Sun, 07 Jul 2019 13:50:14 GMT
server
UploadServer
etag
"96ff9af4be090f6f1b9cd6b152632c9f"
x-goog-hash
crc32c=NlADyQ==, md5=lv+a9L4JD28bnNaxUmMsnw==
x-goog-generation
1562507414384037
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
28334
x-goog-meta-firebasestoragedownloadtokens
95617a95-5298-48cf-a2de-f2dcfe881df5
accept-ranges
bytes
content-type
image/png
expires
Sat, 01 May 2021 19:13:46 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBd_DMd_yudyBgGuWB%2Fimage.png
gblobscdn.gitbook.com/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBd_DMd_yudyBgGuWB%2Fimage.png?alt=media&token=dee1844a-d4b1-4ff9-b234-06b2af94cea2
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
0dce5da46efff3e6f2a0becf8686d2a98b52c575e3d23affab7a091d8b27d1f9

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98391
x-guploader-uploadid
AAANsUlsYTbs_i5eb9cc6JqN4LEs6sbaR-pzmkhJ3IsOjuON4D40go7yGPEIaYXGKXPjFTw13F4vfa8It0afB2qV9-_ai7qeSw
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
25134
last-modified
Sun, 07 Jul 2019 13:50:14 GMT
server
UploadServer
etag
"17b7f296cb9b1b39f97ebc9bd1e5f41e"
x-goog-hash
crc32c=ThmbgQ==, md5=F7fylsubGzn5fryb0eX0Hg==
x-goog-generation
1562507414318112
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
25134
x-goog-meta-firebasestoragedownloadtokens
dee1844a-d4b1-4ff9-b234-06b2af94cea2
accept-ranges
bytes
content-type
image/png
expires
Fri, 30 Apr 2021 15:53:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBeB7V-PtWxmKUSdwo%2Fimage.png
gblobscdn.gitbook.com/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBeB7V-PtWxmKUSdwo%2Fimage.png?alt=media&token=6cae38da-10f6-4375-87dd-fa9553be721b
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
35167ba1fc4cf1fc06cf5c7d659855729ac71fa694a7cb007ac76d2cf5160883

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98391
x-guploader-uploadid
AAANsUl7CJS9EFD2FRC1x6WMhj5ioUR2SFzrzV2cmhL8aEpKkCp5prSPgzkQsBCumsBfIbWRsiwru3-HLNrKAFzr062AMVyy1A
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
19691
last-modified
Sun, 07 Jul 2019 13:50:14 GMT
server
UploadServer
etag
"9202003a2104260df732b0ec0b13b60e"
x-goog-hash
crc32c=RFG7fw==, md5=kgIAOiEEJg33MrDsCxO2Dg==
x-goog-generation
1562507414340087
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
19691
x-goog-meta-firebasestoragedownloadtokens
6cae38da-10f6-4375-87dd-fa9553be721b
accept-ranges
bytes
content-type
image/png
expires
Fri, 30 Apr 2021 15:53:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBgEfj9hapb_G_hQm8%2Fimage.png
gblobscdn.gitbook.com/ 		105 KB
105 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBgEfj9hapb_G_hQm8%2Fimage.png?alt=media&token=ba8aab2e-113c-433f-9490-03d371794790
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
395aee6ff583c57a3b9c68837e58ebd3ab82dc69277f22e8532b61fe97ed298c

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98391
x-guploader-uploadid
AAANsUkM8aQ8HR5nrMHvKqzixizo8CywusCabO9UZtrTPBrowopAGkNFqMz3MrhNnUDjz-clKNkoM9S7VXQQQwG3B1pAviyY_w
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''image.png
alt-svc
clear
content-length
107667
last-modified
Sun, 07 Jul 2019 13:50:15 GMT
server
UploadServer
etag
"731d9f99b1f900e807fa1627250db841"
x-goog-hash
crc32c=u6c++Q==, md5=cx2fmbH5AOgH+hYnJQ24QQ==
x-goog-generation
1562507415058104
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
107667
x-goog-meta-firebasestoragedownloadtokens
ba8aab2e-113c-433f-9490-03d371794790
accept-ranges
bytes
content-type
image/png
expires
Fri, 30 Apr 2021 15:53:57 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBgbyzlmx2SIrGuGIk%2Fsyscall-debugging.gif
gblobscdn.gitbook.com/ 		796 KB
797 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LjB_qkyhCQvQXmTWkaq%2F-LjBgbyzlmx2SIrGuGIk%2Fsyscall-debugging.gif?alt=media&token=a66279aa-f0d6-426c-bfeb-c95c8896aabb
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.207.107.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
26229819090dce19bc974819478b2daa7be55f4f7803259b68eb9f6af6587dbe

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 15:53:57 GMT
age
98391
x-guploader-uploadid
AAANsUnTCrZs-nnGodBbXIeViADe2GO0gfjomT5WFZLWg3JXU7y4EowMcgWKymRsDlwnxqIeQV3SXutNRvHVY6SWn4jgwmHz-g
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''syscall-debugging.gif
alt-svc
clear
content-length
815106
last-modified
Sun, 07 Jul 2019 13:50:15 GMT
server
UploadServer
etag
"3b64be8009f87c22037997bc714e1d19"
x-goog-hash
crc32c=KWhVFw==, md5=O2S+gAn4fCIDeZe8cU4dGQ==
x-goog-generation
1562507415745379
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
815106
x-goog-meta-firebasestoragedownloadtokens
a66279aa-f0d6-426c-bfeb-c95c8896aabb
accept-ranges
bytes
content-type
image/gif
expires
Fri, 30 Apr 2021 15:53:57 GMT
photo.jpg
lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/photo.jpg
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
3e46dc2084ab2945b5af16a2d88abcd6fa7e8aa5ef5a43fc6c83ce561b6c9577
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 01 May 2020 15:36:33 GMT
x-content-type-options
nosniff
age
13035
status
200
content-disposition
inline;filename=""
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6707
x-xss-protection
0
server
fife
etag
"v5e"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sat, 02 May 2020 06:41:13 GMT
.lp
s-usc1c-nss-282.firebaseio.com/ Frame C411 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://s-usc1c-nss-282.firebaseio.com/.lp?dframe=t&id=2868774&pw=jyVLHyFQ8w&ns=gitbook-28427
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Host
s-usc1c-nss-282.firebaseio.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs

Response headers

Server
nginx
Date
Fri, 01 May 2020 19:13:48 GMT
Content-Type
text/html; charset=utf-8
Content-Length
420
Connection
keep-alive
Strict-Transport-Security
max-age=31556926; includeSubDomains; preload
logo-ms-social.png
docs.microsoft.com/en-us/media/logos/ 		449 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://docs.microsoft.com/en-us/media/logos/logo-ms-social.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:19e::353e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
2d59b358c254d5467046e6f341825949aafecfe46af27b541fae72850c9fc41f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
status
200
content-length
449
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
x-rendering-stack
Static
last-modified
Mon, 16 Dec 2019 19:04:37 GMT
x-datacenter
wus
date
Fri, 01 May 2020 19:13:48 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
content-type
image/png
cache-control
public, max-age=399
etag
"0x8D7825ACB981CED"
akamai-cache-status
Hit from child
request-context
appId=cid-v1:21aee9e4-1cf5-4750-b2bd-78b2747f4211
expires
Fri, 01 May 2020 19:20:27 GMT
.lp
s-usc1c-nss-282.firebaseio.com/ Frame 8158 		15 B
256 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s-usc1c-nss-282.firebaseio.com/.lp?id=2868774&pw=jyVLHyFQ8w&ser=25802723&ns=gitbook-28427
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
3d14e96bd08692f39b357173c908dcb0b21ee11d0bdb29b963ce7fcc836eb4fd
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 01 May 2020 19:13:48 GMT
Server
nginx
Connection
keep-alive
Content-Length
15
Strict-Transport-Security
max-age=31556926; includeSubDomains; preload
Content-Type
application/javascript; charset=utf-8
.lp
s-usc1c-nss-282.firebaseio.com/ Frame 8158 		58 B
299 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s-usc1c-nss-282.firebaseio.com/.lp?id=2868774&pw=jyVLHyFQ8w&ser=25802724&ns=gitbook-28427&seg0=0&ts0=1&d0=eyJ0IjoiZCIsImQiOnsiciI6MSwiYSI6InMiLCJiIjp7ImMiOnsic2RrLmpzLjctMTQtMSI6MX19fX0.
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
ef824052cc54e24358011a6d1f363813e99264883d6a019f5c98f75e43f78dc9
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 01 May 2020 19:13:48 GMT
Server
nginx
Connection
keep-alive
Content-Length
58
Strict-Transport-Security
max-age=31556926; includeSubDomains; preload
Content-Type
application/javascript; charset=utf-8
/
www.gitbook.com/__amp/ 		7 B
291 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.gitbook.com/__amp/
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:6cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Fri, 01 May 2020 19:13:49 GMT
cf-cache-status
DYNAMIC
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, POST
content-type
text/html;charset=utf-8
access-control-allow-origin
*
strict-transport-security
max-age=15768000
cf-ray
58cbd266c86c1752-FRA
content-length
7
cf-request-id
027341d4390000175225873200000001
analytics.js
www.google-analytics.com/ 		44 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Feb 2020 00:21:02 GMT
server
Golfe2
age
1048
date
Fri, 01 May 2020 18:56:20 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18174
expires
Fri, 01 May 2020 20:56:20 GMT
7f9239ce726764aa22093884902e018d.svg
gstatic.gitbook.com/images/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gstatic.gitbook.com/images/7f9239ce726764aa22093884902e018d.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:6cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
863db76a201dedb75ccb6392a1664138cfb5c60d71e2073056db22ca39a56fec

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 01 May 2020 19:13:48 GMT
content-encoding
br
cf-cache-status
HIT
age
1544827
x-guploader-uploadid
AEnB2Up4_u4zsu-VzeTELd0oacAlZEN_VuSfwJg4nLtQ2217uVqL3_snTm0ea4BPUQnb0dkmty19gyuS1IAzP119HZVqUcn_Sw
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
image/svg+xml
cf-request-id
027341d44e0000dff7fb222200000001
last-modified
Sat, 04 Apr 2020 21:36:58 GMT
server
cloudflare
etag
W/"7f9239ce726764aa22093884902e018d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=VnuT0A==, md5=f5I5znJnZKoiCTiEkC4BjQ==
x-goog-generation
1583845128485401
access-control-allow-origin
*
expires
Fri, 09 Apr 2021 13:06:16 GMT
cache-control
public, max-age=31536000
x-goog-stored-content-length
2137
cf-ray
58cbd266efcadff7-FRA
cf-bgj
h2pri
collect
www.google-analytics.com/r/ 		35 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1145905347&t=pageview&_s=1&dl=https%3A%2F%2Fired.team%2Foffensive-security%2Fdefense-evasion%2Fusing-syscalls-directly-from-visual-studio-to-bypass-avs-edrs&dp=%2Foffensive-security%2Fdefense-evasion%2Fusing-syscalls-directly-from-visual-studio-to-bypass-avs-edrs&ul=en-us&de=UTF-8&dt=Calling%20Syscalls%20Directly%20from%20Visual%20Studio%20to%20Bypass%20AVs%2FEDRs%20-%20Red%20Teaming%20Experiments&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEDAAEAB~&jid=411188483&gjid=350244496&cid=1985102880.1588360429&tid=UA-57505611-10&_gid=1403921237.1588360429&_r=1&cd1=-LFEMnER3fywgFHoroYn&cd2=-LFEMnEQwqZOY6DtfrzY&cd3=-M25tV5MUcph3bcnY5jh&cd4=master&cd5=-LjAqSVI10yo-MJuXTts&z=1072511696
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 May 2020 19:13:48 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/r/ 		35 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1145905347&t=pageview&_s=1&dl=https%3A%2F%2Fired.team%2Foffensive-security%2Fdefense-evasion%2Fusing-syscalls-directly-from-visual-studio-to-bypass-avs-edrs&dp=%2Foffensive-security%2Fdefense-evasion%2Fusing-syscalls-directly-from-visual-studio-to-bypass-avs-edrs&ul=en-us&de=UTF-8&dt=Calling%20Syscalls%20Directly%20from%20Visual%20Studio%20to%20Bypass%20AVs%2FEDRs%20-%20Red%20Teaming%20Experiments&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEDAAEAB~&jid=433213227&gjid=978165871&cid=1985102880.1588360429&tid=UA-128974775-1&_gid=1403921237.1588360429&_r=1&z=913495714
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 May 2020 19:13:48 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
.lp
s-usc1c-nss-282.firebaseio.com/ Frame 8158 		58 B
299 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s-usc1c-nss-282.firebaseio.com/.lp?id=2868774&pw=jyVLHyFQ8w&ser=25802725&ns=gitbook-28427&seg0=1&ts0=1&d0=eyJ0IjoiZCIsImQiOnsiciI6MiwiYSI6Im0iLCJiIjp7InAiOiIvZW1iZWRzL2h0dHBzOiUyRiUyRm91dGZsYW5rJTJFbmwlMkZibG9nJTJGMjAxOSUyRjA2JTJGMTklMkZyZWQtdGVhbS10YWN0aWNzLWNvbWJpbmluZy1kaXJlY3Qtc3lzdGVtLWNhbGxzLWFuZC1zcmRpLXRvLWJ5cGFzcy1hdi1lZHIlMkYiLCJkIjp7Im91dGRhdGVkIjp0cnVlfX19fQ..&seg1=2&ts1=1&d1=eyJ0IjoiZCIsImQiOnsiciI6MywiYSI6Im0iLCJiIjp7InAiOiIvZW1iZWRzL2h0dHBzOiUyRiUyRmRvY3MlMkVtaWNyb3NvZnQlMkVjb20lMkZlbi11cyUyRndpbmRvd3MlMkZ3aW4zMiUyRmFwaSUyRndpbnRlcm5sJTJGbmYtd2ludGVybmwtbnRjcmVhdGVmaWxlIiwiZCI6eyJvdXRkYXRlZCI6dHJ1ZX19fX0.&seg2=3&ts2=1&d2=eyJ0IjoiZCIsImQiOnsiciI6NCwiYSI6Im0iLCJiIjp7InAiOiIvZW1iZWRzL2h0dHBzOiUyRiUyRmowMHJ1JTJFdmV4aWxsaXVtJTJFb3JnJTJGc3lzY2FsbHMlMkZudCUyRjY0JTJGIiwiZCI6eyJvdXRkYXRlZCI6dHJ1ZX19fX0.&seg3=4&ts3=1&d3=eyJ0IjoiZCIsImQiOnsiciI6NSwiYSI6InEiLCJiIjp7InAiOiIvc3BhY2VzLy1MRkVNbkVSM2Z5d2dGSG9yb1luL3VzZXJQYWdlUmF0aW5ncy8tTGpBcVNWSTEweW8tTUp1WFR0cy8tTTZDOHZxUUR5X2VYMHdCMUlQaiIsImgiOiIifX19
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
712d6d4de72cccd1e89edb05c59b37a548fc8b5f5744c09e8b413506ca87cdcb
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 01 May 2020 19:13:48 GMT
Server
nginx
Connection
keep-alive
Content-Length
58
Strict-Transport-Security
max-age=31556926; includeSubDomains; preload
Content-Type
application/javascript; charset=utf-8
.lp
s-usc1c-nss-282.firebaseio.com/ Frame 8158 		146 B
388 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s-usc1c-nss-282.firebaseio.com/.lp?id=2868774&pw=jyVLHyFQ8w&ser=25802726&ns=gitbook-28427
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
37907036cff2c4497b27e3db33a185ba1db7e58ebf6226ee5e8b4d2fccaa8de5
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 01 May 2020 19:13:49 GMT
Server
nginx
Connection
keep-alive
Content-Length
146
Strict-Transport-Security
max-age=31556926; includeSubDomains; preload
Content-Type
application/javascript; charset=utf-8
.lp
s-usc1c-nss-282.firebaseio.com/ Frame 8158 		70 B
311 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s-usc1c-nss-282.firebaseio.com/.lp?id=2868774&pw=jyVLHyFQ8w&ser=25802727&ns=gitbook-28427&seg0=5&ts0=1&d0=eyJ0IjoiYyIsImQiOnsidCI6Im4iLCJkIjp7fX19
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
efb03fd285c04565fb592bea3f05d43eb45da9f03af6f94e01d3c10ba14f288e
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 01 May 2020 19:13:49 GMT
Server
nginx
Connection
keep-alive
Content-Length
70
Strict-Transport-Security
max-age=31556926; includeSubDomains; preload
Content-Type
application/javascript; charset=utf-8
chunk.966.9bcdd26c.js
gstatic.gitbook.com/js/ 		1 MB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gstatic.gitbook.com/js/chunk.966.9bcdd26c.js
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.56af2e09.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:6cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b08085db82bdd556abf8dfe2c049e433274cd77fe15cadaa1437af9b5e928eb

Request headers

Referer
https://ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 01 May 2020 19:13:53 GMT
content-encoding
br
cf-cache-status
HIT
age
1544827
cf-polished
origSize=1540766
x-guploader-uploadid
AEnB2UrE6u3DxUCkjkLF72H3TwQDMxmSuFonSV8WXpfUii-tAP17xchRAht7QXmMtWLKXDJ5RGZ5cKtFW53BWBKzZN8KrPYqYPyTcEJ7ud4fuOE2Nl48Ago
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
application/javascript
cf-request-id
027341e5a50000dff7fb004200000001
last-modified
Fri, 27 Mar 2020 15:33:33 GMT
server
cloudflare
etag
W/"1ee0a04f04f79506addc6f9cc9ade2c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=6ui4QQ==, md5=HuCgTwT3lQat3G+cya3iwA==
x-goog-generation
1585323213534405
access-control-allow-origin
*
expires
Tue, 30 Mar 2021 08:54:44 GMT
cache-control
public, max-age=31536000
x-goog-stored-content-length
1540766
cf-ray
58cbd282ada4dff7-FRA
cf-bgj
minify

Verdicts & Comments Add Verdict or Comment

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| GITBOOK_STATE object| __LOADABLE_LOADED_CHUNKS__ object| GitBook object| __SENTRY__ function| _lrMutationObserver object| __SDKCONFIG__ number| 2f1acc6c3a606b082e5eef5e54414ffb function| Intercom function| Mousetrap function| setImmediate function| clearImmediate object| Prism object| __algolia function| _LRLogger boolean| _lr_loaded function| pLPCommand1 function| pRTLPCB1 boolean| __isReactDndBackendSetUp string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData

2 Cookies

Domain/Path Name / Value
.ired.team/ Name: amplitude_id_fef1e872c952688acd962d30aa545b9eired.team
Value: eyJkZXZpY2VJZCI6IjdiYmM4Y2U2LWIwYjQtNDk3ZC05YWU4LTRiZGI0NmJjNjEzOFIiLCJ1c2VySWQiOm51bGwsIm9wdE91dCI6ZmFsc2UsInNlc3Npb25JZCI6MTU4ODM2MDQyODA2NSwibGFzdEV2ZW50VGltZSI6MTU4ODM2MDQyODA2NSwiZXZlbnRJZCI6MCwiaWRlbnRpZnlJZCI6MCwic2VxdWVuY2VOdW1iZXIiOjB9
.ired.team/ Name: __cfduid
Value: d39fd69a711342ff6446c4a92968232351588360426

1 Console Messages

Source Level URL
Text
console-api log URL: https://gstatic.gitbook.com/js/111.56af2e09.js(Line 1)
Message:
Application ready

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.gitbook.com
cdn.lr-ingest.io
docs.microsoft.com
fonts.googleapis.com
fonts.gstatic.com
gblobscdn.gitbook.com
gitbook-28427.firebaseio.com
gstatic.gitbook.com
ired.team
lh5.googleusercontent.com
polyfill.io
s-usc1c-nss-282.firebaseio.com
unpkg.com
www.gitbook.com
www.google-analytics.com
2600:1901:0:94b6::
2606:4700:20::681a:6cd
2606:4700:3030::681f:5ab4
2606:4700::6810:7eaf
2606:4700:e2::ac40:8a14
2a00:1450:4001:80b::2001
2a00:1450:4001:81b::200e
2a00:1450:4001:81f::2003
2a00:1450:4001:820::200a
2a02:26f0:6c00:19e::353e
2a04:4e42:200::621
34.107.207.82
0b17f50e223ca3160ec991c1c5c076ab1887c3fdfc6e55eccec9aa055c71df97
0dce5da46efff3e6f2a0becf8686d2a98b52c575e3d23affab7a091d8b27d1f9
14c9136afe477a76ba02f06c4ac54f9b113ff9293a13d00c5e23f88731b278d5
1e7af20bf828f0bef62fdc576b55c1ff6e2fce144321286548e6603f5de5b3c2
2069c259c3eef690d62c0d9ca55a89498efbaedeb74b65070513ffbf60df6bb6
25599a4f79b3b74be393d2a0d55386ed73a28360af4f7b693a75593e8ff36a8b
26229819090dce19bc974819478b2daa7be55f4f7803259b68eb9f6af6587dbe
2d59b358c254d5467046e6f341825949aafecfe46af27b541fae72850c9fc41f
305a3fcc13963e6fba6dbba64954ff38ac891602d4f1292e9a95bf170d4ac2a0
35167ba1fc4cf1fc06cf5c7d659855729ac71fa694a7cb007ac76d2cf5160883
37907036cff2c4497b27e3db33a185ba1db7e58ebf6226ee5e8b4d2fccaa8de5
395aee6ff583c57a3b9c68837e58ebd3ab82dc69277f22e8532b61fe97ed298c
3d14e96bd08692f39b357173c908dcb0b21ee11d0bdb29b963ce7fcc836eb4fd
3e46dc2084ab2945b5af16a2d88abcd6fa7e8aa5ef5a43fc6c83ce561b6c9577
3e692de9565d90dd947a080d4d10cee72a83447ba053e08fdcac457d7197128a
53b8d255226031c6f07a2449be75f6921445015794368338915b0258027eb4ab
59fd4f207936792ab9910baa7df5f1f7bff899e35e0428df34ab9a1319184052
5b08085db82bdd556abf8dfe2c049e433274cd77fe15cadaa1437af9b5e928eb
712d6d4de72cccd1e89edb05c59b37a548fc8b5f5744c09e8b413506ca87cdcb
72abbaa875e73f02588ce2b6a15f4df2a7b9f8c508d82b12a0f7623feea0e150
7edc4c63b721a6cf081a6f4b9a676d64abb7953ee6bb770f45d0b6a7ca5f1d79
7f064bc8ed20d75e78805ec7c40459498070952acb3985faca22a35e3c9f78b5
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
863db76a201dedb75ccb6392a1664138cfb5c60d71e2073056db22ca39a56fec
8c5aba96614dbffed76d491c394e2afaf35c5ede4f3e63c08d24894f7b4d6332
a18af7799b7d241fe5d00645492ccedcad39815e9f4125b7e3e90b18a1b77405
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
aee2771f5f57ecf568ffffd5c0d0fee81b7fb2b5540e10d856f2462abdbd5f92
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
b87e90677bdbc3c6bc296a368f57b2d72783c1a7c6e8e9325cd1645c18039cf2
bd8421a188c6b000167a66d7397edf18c54c7f18c24e0fe078d7c45aeae84ef4
c5e939d7d3f9c9bfe632d16484c12354fa89a12738f30f738aa81c984e5b9a92
c5ff636c13e4983198fbed7d325d1cbafbe544702de06f5874c46e359ce68b43
dfbf03bd10a5461d085675f9ab7c442b3b4dbe2c5001a661a3925ac9f1378cb6
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ef824052cc54e24358011a6d1f363813e99264883d6a019f5c98f75e43f78dc9
efb03fd285c04565fb592bea3f05d43eb45da9f03af6f94e01d3c10ba14f288e