Edit tour

Windows Analysis Report
http://almalinuooslkq.buzz/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9

Overview

General Information

Sample URL:	http://almalinuooslkq.buzz/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9
Analysis ID:	1625459
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

HTML body contains low number of good links

HTML title does not match URL

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 764 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1948,i,484534398703970958,5957363080685509193,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6492 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://almalinuooslkq.buzz/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Suricata Signatures

ETPRO EXPLOIT_KIT FoxTDS Initial Check

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-27T09:46:53.882715+0100	2859622	1	Exploit Kit Activity Detected	93.95.97.136	80	192.168.2.4	49742	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Address: gin_throttle_mw_7200000000_8.46.123.189X-Ratelimit-Limit: 500X-Ratelimit-Remaining: 498X-Ratelimit-Reset: 1740649613Date: Thu, 27 Feb 2025 08:46:53 GMTContent-Length: 0

Source: http://almalinuooslkq.buzz/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9	HTTP Parser: No favicon
Source: http://almalinuooslkq.buzz/t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9	HTTP Parser: No favicon
Source: http://almalinuooslkq.buzz/news?q=CampaignID%20not%20found!%20/t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9	HTTP Parser: No favicon
Source: http://almalinuooslkq.buzz/news?q=CampaignID%20not%20found!%20/t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9	HTTP Parser: No favicon
Source: http://almalinuooslkq.buzz/	HTTP Parser: No favicon
Source: http://almalinuooslkq.buzz/	HTTP Parser: No favicon
Source: http://almalinuooslkq.buzz/	HTTP Parser: No favicon
Source: http://almalinuooslkq.buzz/	HTTP Parser: No favicon
Source: http://almalinuooslkq.buzz/	HTTP Parser: No favicon

Source: http://almalinuooslkq.buzz/	HTTP Parser: No <meta name="author".. found
Source: http://almalinuooslkq.buzz/	HTTP Parser: No <meta name="author".. found
Source: http://almalinuooslkq.buzz/	HTTP Parser: No <meta name="author".. found
Source: http://almalinuooslkq.buzz/	HTTP Parser: No <meta name="author".. found
Source: http://almalinuooslkq.buzz/	HTTP Parser: No <meta name="author".. found

Source: http://almalinuooslkq.buzz/	HTTP Parser: No <meta name="copyright".. found
Source: http://almalinuooslkq.buzz/	HTTP Parser: No <meta name="copyright".. found
Source: http://almalinuooslkq.buzz/	HTTP Parser: No <meta name="copyright".. found
Source: http://almalinuooslkq.buzz/	HTTP Parser: No <meta name="copyright".. found
Source: http://almalinuooslkq.buzz/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.4:49824 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.35
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.35
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.35
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10

Source: global traffic	HTTP traffic detected: GET /foxnews/world HTTP/1.1Host: feeds.foxnews.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: http://almalinuooslkq.buzzSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: http://almalinuooslkq.buzz/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google-publisher/world.xml HTTP/1.1Host: moxie.foxnews.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: http://almalinuooslkq.buzz/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google-publisher/world.xml HTTP/1.1Host: moxie.foxnews.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239406254454_16NVNN3CF3IMQR1OI&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239406254455_1YN7X3I6LOQY14F1E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239363862712_1Y28E27W0AUV6JWOD&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239363862713_1RWXDD5HJIZYGFTRH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418543_1PQIQEA9PYCCTOZ9T&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418544_1U65HGUXV07UFEU5B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9 HTTP/1.1Host: almalinuooslkq.buzzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: almalinuooslkq.buzzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://almalinuooslkq.buzz/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9 HTTP/1.1Host: almalinuooslkq.buzzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://almalinuooslkq.buzz/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /news?q=CampaignID%20not%20found!%20/t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9 HTTP/1.1Host: almalinuooslkq.buzzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://almalinuooslkq.buzz/t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: almalinuooslkq.buzzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://almalinuooslkq.buzz/news?q=CampaignID%20not%20found!%20/t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/styles.css HTTP/1.1Host: almalinuooslkq.buzzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://almalinuooslkq.buzz/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: chromecache_137.2.dr, chromecache_136.2.dr	String found in binary or memory: </p><p>Georgescu said on Facebook that authorities "are looking to invent evidence to justify the theft of the elections and to do anything to block my new candidacy for the presidency." He called on supporters to attend a protest on Saturday in Bucharest.</p><p><a href="https://www.foxnews.com/politics/vance-eviscerates-soviet-style-european-censorship-address-munich-security-conference" target="_blank" rel="noopener"><strong>VANCE EVISCERATES 'SOVIET'-STYLE EUROPEAN CENSORSHIP IN ADDRESS TO MUNICH SECURITY CONFERENCE</strong></a></p><p>Romanian Prime Minister Marcel Ciolacu said on X, "The judiciary is independent &amp; the law must be applied regardless of persons."<br><br>Elon Musk, the tech billionaire involved with the Trump administration's Department of Government Efficiency, weighed in.<br><br>"They just arrested the person who won the most votes in the Romanian presidential election. This is messed up," Musk wrote. equals www.facebook.com (Facebook)
Source: chromecache_137.2.dr, chromecache_136.2.dr	String found in binary or memory: <rss xmlns:media="http://search.yahoo.com/mrss/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"> equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: almalinuooslkq.buzz
Source: global traffic	DNS traffic detected: DNS query: feeds.foxnews.com
Source: global traffic	DNS traffic detected: DNS query: moxie.foxnews.com
Source: global traffic	DNS traffic detected: DNS query: www.foxnews.com

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1948,i,484534398703970958,5957363080685509193,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://almalinuooslkq.buzz/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1948,i,484534398703970958,5957363080685509193,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://almalinuooslkq.buzz/assets/styles.css	0%	Avira URL Cloud	safe
http://almalinuooslkq.buzz/favicon.ico	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
almalinuooslkq.buzz	93.95.97.136	true	true	unknown
j.sni.global.fastly.net	151.101.2.132	true	false	high
www.google.com	142.250.185.100	true	false	high
e197183.dsca.akamaiedge.net	2.19.96.202	true	false	high
moxie.foxnews.com	unknown	unknown	false	high
www.foxnews.com	unknown	unknown	false	high
feeds.foxnews.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
http://almalinuooslkq.buzz/t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9	false		unknown
http://almalinuooslkq.buzz/assets/styles.css	true	Avira URL Cloud: safe	unknown
https://tse1.mm.bing.net/th?id=OADD2.10239406254455_1YN7X3I6LOQY14F1E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false		high
https://tse1.mm.bing.net/th?id=OADD2.10239340418544_1U65HGUXV07UFEU5B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false		high
http://almalinuooslkq.buzz/favicon.ico	true	Avira URL Cloud: safe	unknown
http://almalinuooslkq.buzz/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9	false		unknown
http://almalinuooslkq.buzz/news?q=CampaignID%20not%20found!%20/t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9	false		unknown
https://tse1.mm.bing.net/th?id=OADD2.10239406254454_16NVNN3CF3IMQR1OI&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false		high
https://tse1.mm.bing.net/th?id=OADD2.10239340418543_1PQIQEA9PYCCTOZ9T&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false		high
http://almalinuooslkq.buzz/	false		unknown

Name	Source	Malicious	Reputation
https://www.foxnews.com/world/germanys-new-conservative-leader-looks-achieve-independence-from-us&qu	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/category/world/world-regions/china"	chromecache_136.2.dr	false	high
https://www.foxnews.com/world/pope-francis-critical-stable-condition-has-ct-scan-vatican-says	chromecache_136.2.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/02/931/523/chile2.jpg?ve	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/02/931/523/putin_planes.	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/opinion/you-freed-me-from-hamas-president-trump-please-save-my-brother-too&q	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/funeral-held-shiri-bibas-her-sons-after-remains-handed-over-hamas&quot	chromecache_136.2.dr	false	high
https://www.foxnews.com/world/nato-nation-poland-scrambles-air-defenses-russia-strikes-western-ukrai	chromecache_136.2.dr	false	high
https://www.foxnews.com/politics/trump-calls-ukraines-zelenskyy-dictator-without-elections-rift-wide	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/02/931/523/4cfa9348-hama	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/category/us/crime/police-and-law-enforcement"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/poland-launches-special-commission-probe-russian-belarusian-influence&	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/trump-effect-display-uks-starmer-boosts-defense-spending-eve-us-visit&	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/what-is-chinas-belt-road-initiative"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/dam-collapse-eastern-sudan-kills-least-30-people-heavy-rains-un-agency	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/israel-rescues-4-hostages-kidnapped-hamas-we-overjoyed"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/trapped-gaza-residents-speak-out-egypt-blocks-exit-rejects-trumps-relo	chromecache_136.2.dr	false	high
https://www.foxnews.com/politics/trump-addresses-ukraine-russia-peace-talks-zelenskyy-involved"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/nurse-who-said-she-wouldnt-treat-israelis-charged-making-threats	chromecache_136.2.dr	false	high
https://www.foxnews.com/category/world/world-regions/france"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/austria-deadly-stabbing-suspect-syrian-migrant-who-pledged-allegiance-	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/un-says-widespread-sexual-violence-sudan-deeply-alarming-amid-bloody-c	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://global.fncstatic.com/static/orion/styles/img/fox-news/logos/fox-news-desktop.png	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/funeral-held-shiri-bibas-her-sons-after-remains-handed-over-hamas	chromecache_136.2.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/02/931/523/australian-he	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/politics/bill-exclusive-banning-chinese-citizens-from-buying-u-s-land"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/politics/trump-freezes-aid-south-africa-promotes-resettlement-refugees-facin	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.timesofisrael.com/shiri-ariel-and-kfir-bibas-buried-in-a-single-casket-they-will-remain-	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/politics/trump-dhs-makes-key-move-against-migrants-allowed-via-controversial	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/category/person/benjamin-netanyahu"	chromecache_136.2.dr	false	high
https://www.foxnews.com/world/israels-ambassador-slams-uns-silence-hamas-has-no-resolutions"	chromecache_136.2.dr	false	high
https://www.foxnews.com/world/power-outage-chile-leaves-millions-electricity-officials-scramble-answ	chromecache_136.2.dr	false	high
https://www.foxnews.com/world/putin-says-russia-open-economic-cooperation-us-rare-earth-minerals	chromecache_136.2.dr	false	high
https://www.foxnews.com/politics/us-ukraine-rift-breaks-out-united-nations-third-anniversary-war&quo	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/02/931/523/e97552ab-zele	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/taiwan-dispatches-navy-air-force-after-china-launches-live-fire-drills	chromecache_136.2.dr	false	high
https://www.foxnews.com/world/remains-shiri-bibas-mom-2-killed-allegedly-returned-israel-following-h	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/02/931/523/red-cross-hos	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/category/world/volodymyr-zelenskyy"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/serbian-president-says-he-mistakenly-voted-russia-ukraines-resolution-	chromecache_136.2.dr	false	high
https://www.foxnews.com/world/remains-shiri-bibas-positively-identified-eventually-being-handed-over	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/politics/trump-must-dump-one-china-policy-recognize-free-taiwan-house-republ	chromecache_136.2.dr	false	high
https://www.foxnews.com/world/american-tourist-arrested-paris-allegedly-throwing-newborn-baby-hotel-	chromecache_136.2.dr	false	high
https://www.foxnews.com/category/us/disasters/transportation"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/hamas-release-bodies-4-dead-hostages-netanyahu-says	chromecache_136.2.dr	false	high
https://www.foxnews.com/world/romanian-far-right-presidential-frontrunner-taken-custody-after-jd-van	chromecache_136.2.dr	false	high
https://www.politika.rs/scc/clanak/663420/vucic-srbija-je-u-un-trebalo-da-bude-uzdrzana#google_vigne	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/us-votes-against-condemning-russia-ukraine-war-trump-admin-chases-peac	chromecache_136.2.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/02/931/523/shiri.png?ve=	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://pubsubhubbub.appspot.com/	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/category/world/united-nations"	chromecache_136.2.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/02/931/523/collapsed-hig	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.gloucestershirelive.co.uk/news/cheltenham-news/usaf-b52-bomber-flies-raf-9972108"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/category/us/crime/homicide"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/ukraine-enters-fourth-year-war-russia-closer-beginning-than-end"	chromecache_136.2.dr	false	high
https://www.foxnews.com/politics/iran-terrified-trump-presidency-iranian-currency-falls-all-time-low	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/video/6360097509112"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/law-student-killed-elephant-vacation-thailand-officials"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/politics/vp-jd-vance-speaks-fundamental-goal-trump-administration-cpac-addre	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/pope-francis-resting-day-10-hospital-lung-infection-led-early-stages-k	chromecache_137.2.dr, chromecache_136.2.dr	false	high
http://search.yahoo.com/mrss/	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/category/world/world-regions/israel"	chromecache_136.2.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2023/04/931/523/Ukraine-Zelen	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/media/trump-official-ukraine-mineral-deal-win-win-financial-opportunity-us-t	chromecache_136.2.dr	false	high
https://www.foxnews.com/category/world"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/politics/trump-deal-ukraine-us-access-rare-earth-minerals-pretty-close"	chromecache_136.2.dr	false	high
https://www.foxnews.com/world/hamas-agrees-return-bodies-4-israeli-hostages-exchange-hundreds-palest	chromecache_136.2.dr	false	high
https://www.foxnews.com/world	chromecache_136.2.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/02/931/523/trump-starmer	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/biden-admin-slammed-waiting-declare-genocide-sudan"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/01/931/523/61ae9d70-neta	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/former-hamas-hostage-briefs-un-security-council-pure-hell-captivity-ga	chromecache_136.2.dr	false	high
https://www.foxnews.com/health"	chromecache_136.2.dr	false	high
https://www.foxnews.com/world/analysts-back-trumps-usaid-cuts-africa-say-increased-trade-better-bene	chromecache_136.2.dr	false	high
https://www.foxnews.com/world/iran-tests-trump-regime-general-says-wipe-israel-off-map">Fox	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/pope-francis-had-peaceful-nights-rest-hospital-following-respiratory-c	chromecache_136.2.dr	false	high
https://www.foxnews.com/category/travel/regions/south-america"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/category/world/conflicts"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/politics/trump-envoy-russia-ukraine-calls-zelenskyy-courageous-leader-after-	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/israel-delays-palestinian-prisoner-release-hamas-humiliating-treatment	chromecache_136.2.dr	false	high
https://www.foxnews.com/world/north-korea-vows-block-border-south-korea-build-front-line-defense-str	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/category/world/conflicts/ukraine"	chromecache_136.2.dr	false	high
https://www.foxnews.com/politics/trump-set-meet-world-leaders-dc-busy-week-russia-ukraine-peace-talk	chromecache_136.2.dr	false	high
https://www.foxnews.com/category/energy"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/media/french-president-macron-tells-trump-be-careful-negotiation-process-end	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/world/south-korea-deadly-plane-crash-us-sends-investigators-country-still-re	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/politics/trump-nominates-mike-huckabee-us-ambassador-israel"	chromecache_137.2.dr, chromecache_136.2.dr	false	high
https://www.foxnews.com/category/person/donald-trump"	chromecache_136.2.dr	false	high
https://www.foxnews.com/world/zelenskyy-looking-nato-something-similar-he-prepares-meeting-trump	chromecache_136.2.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/02/931/523/gaza-strip.pn	chromecache_137.2.dr, chromecache_136.2.dr	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
93.95.97.136	almalinuooslkq.buzz	Russian Federation	48347	MTW-ASRU	true
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.2.132	j.sni.global.fastly.net	United States	54113	FASTLYUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1625459
Start date and time:	2025-02-27 09:45:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://almalinuooslkq.buzz/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@16/15@12/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	310
Entropy (8bit):	5.736704988762432
Encrypted:	false
SSDEEP:	6:uIRnXHFmmmJ0SdLlCeW2Cqxg9dzsJKSK/SLlCeW2Cqxg9dz4g/VMCGYoVL:lXHAx6SJweWAg9KjweWAg92w9IL
MD5:	78FE86F4CA549CE78B37C8B92DE66388
SHA1:	6BF0EA3D908178CF143124C798A42D667BEA9AB8
SHA-256:	E0B2943DD8D1346AF07B4A90F98E9D4D3B04AEEAB38A97D3E3594EC85ADA54E2
SHA-512:	9133BEBD8971FCA05AF417DE6A8988B0486F1EFD76A528F1D8001A6A0CAFD7B3577BBCCCCBCE85FC5A9F2ACED8D479D0132838F93AB07532C88442B47D1382EA
Malicious:	false
Reputation:	low
URL:	http://almalinuooslkq.buzz/t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9
Preview:	<script>.setTimeout(function(){. window.location.href = '/news?q=CampaignID not found! /t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9'; . console.log('redirecting to /news?q=CampaignID not found! /t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9');.}, 1000);.</script>.<p></p>.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 27, 2025 09:46:47.469486952 CET	53	63802	1.1.1.1	192.168.2.4
Feb 27, 2025 09:46:47.674242020 CET	53	64680	1.1.1.1	192.168.2.4
Feb 27, 2025 09:46:48.930258036 CET	53	64619	1.1.1.1	192.168.2.4
Feb 27, 2025 09:46:51.895842075 CET	56391	53	192.168.2.4	1.1.1.1
Feb 27, 2025 09:46:51.896008015 CET	53438	53	192.168.2.4	1.1.1.1
Feb 27, 2025 09:46:51.903394938 CET	53	56391	1.1.1.1	192.168.2.4
Feb 27, 2025 09:46:51.903449059 CET	53	53438	1.1.1.1	192.168.2.4
Feb 27, 2025 09:46:53.058522940 CET	50761	53	192.168.2.4	1.1.1.1
Feb 27, 2025 09:46:53.058595896 CET	59268	53	192.168.2.4	1.1.1.1
Feb 27, 2025 09:46:53.066531897 CET	53	50761	1.1.1.1	192.168.2.4
Feb 27, 2025 09:46:53.067970037 CET	53	59268	1.1.1.1	192.168.2.4
Feb 27, 2025 09:46:56.562710047 CET	59975	53	192.168.2.4	1.1.1.1
Feb 27, 2025 09:46:56.562961102 CET	58143	53	192.168.2.4	1.1.1.1
Feb 27, 2025 09:46:56.572079897 CET	53	59975	1.1.1.1	192.168.2.4
Feb 27, 2025 09:46:56.584928036 CET	53	58143	1.1.1.1	192.168.2.4
Feb 27, 2025 09:46:57.195976019 CET	58430	53	192.168.2.4	1.1.1.1
Feb 27, 2025 09:46:57.196113110 CET	53487	53	192.168.2.4	1.1.1.1
Feb 27, 2025 09:46:57.221955061 CET	53	58430	1.1.1.1	192.168.2.4
Feb 27, 2025 09:46:57.223150015 CET	53	53487	1.1.1.1	192.168.2.4
Feb 27, 2025 09:46:58.071943998 CET	62130	53	192.168.2.4	1.1.1.1
Feb 27, 2025 09:46:58.072132111 CET	50993	53	192.168.2.4	1.1.1.1
Feb 27, 2025 09:46:58.094914913 CET	53	50993	1.1.1.1	192.168.2.4
Feb 27, 2025 09:46:58.096225023 CET	53	62130	1.1.1.1	192.168.2.4
Feb 27, 2025 09:47:03.314321041 CET	63179	53	192.168.2.4	1.1.1.1
Feb 27, 2025 09:47:03.314517021 CET	49430	53	192.168.2.4	1.1.1.1
Feb 27, 2025 09:47:03.322253942 CET	53	63179	1.1.1.1	192.168.2.4
Feb 27, 2025 09:47:03.322402954 CET	53	49430	1.1.1.1	192.168.2.4
Feb 27, 2025 09:47:05.808321953 CET	138	138	192.168.2.4	192.168.2.255
Feb 27, 2025 09:47:05.998048067 CET	53	63136	1.1.1.1	192.168.2.4
Feb 27, 2025 09:47:20.956763029 CET	53	61125	1.1.1.1	192.168.2.4
Feb 27, 2025 09:47:25.059267044 CET	53	55878	1.1.1.1	192.168.2.4
Feb 27, 2025 09:47:47.375480890 CET	53	54699	1.1.1.1	192.168.2.4
Feb 27, 2025 09:47:47.904527903 CET	53	59650	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 09:46:53.080990076 CET	493	OUT	GET /4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9 HTTP/1.1 Host: almalinuooslkq.buzz Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 27, 2025 09:46:53.775455952 CET	710	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Address: gin_throttle_mw_7200000000_8.46.123.189 X-Ratelimit-Limit: 500 X-Ratelimit-Remaining: 499 X-Ratelimit-Reset: 1740649613 Date: Thu, 27 Feb 2025 08:46:53 GMT Content-Length: 458 Data Raw: 3c 73 63 72 69 70 74 3e 0a 6c 65 74 20 65 3d 6e 65 77 20 55 52 4c 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 3b 65 2e 70 61 74 68 6e 61 6d 65 3d 22 2f 74 22 2b 65 2e 70 61 74 68 6e 61 6d 65 3b 6c 65 74 20 6f 3d 65 2e 74 6f 53 74 72 69 6e 67 28 29 3b 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 26 26 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 6f 3d 5b 22 67 6f 6f 67 6c 65 62 6f 74 22 2c 22 62 69 6e 67 62 6f 74 22 2c 22 79 61 6e 64 65 78 62 6f 74 22 2c 22 64 75 63 6b 64 75 63 6b 62 6f 74 22 2c 22 73 6c 75 72 70 22 2c 22 62 61 69 64 75 73 70 69 64 65 72 22 2c 22 66 61 63 65 62 6f 74 22 2c 22 69 61 5f 61 72 63 68 69 76 65 72 22 5d 2c 74 3d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 6e 3d 30 3b 6e 3c 6f 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 74 2e 69 6e 64 65 78 4f 66 28 6f 5b 6e 5d 29 3e 2d 31 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 3f 73 65 74 54 [TRUNCATED] Data Ascii: <script>let e=new URL(window.location.href);e.pathname="/t"+e.pathname;let o=e.toString();navigator.cookieEnabled&&!function(e){for(var o=["googlebot","bingbot","yandexbot","duckduckbot","slurp","baiduspider","facebot","ia_archiver"],t=e.toLowerCase(),n=0;n<o.length;n++)if(t.indexOf(o[n])>-1)return!0;return!1}(navigator.userAgent)?setTimeout((function(){document.location.href=o}),1e3):console.log("bt");</script><p style="color:gray;">redirect...</p>
Feb 27, 2025 09:46:53.877047062 CET	441	OUT	GET /favicon.ico HTTP/1.1 Host: almalinuooslkq.buzz Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://almalinuooslkq.buzz/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 27, 2025 09:46:54.093888044 CET	258	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Address: gin_throttle_mw_7200000000_8.46.123.189 X-Ratelimit-Limit: 500 X-Ratelimit-Remaining: 498 X-Ratelimit-Reset: 1740649613 Date: Thu, 27 Feb 2025 08:46:53 GMT Content-Length: 0
Feb 27, 2025 09:46:54.852755070 CET	592	OUT	GET /t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9 HTTP/1.1 Host: almalinuooslkq.buzz Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://almalinuooslkq.buzz/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 27, 2025 09:46:55.150322914 CET	562	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Address: gin_throttle_mw_7200000000_8.46.123.189 X-Ratelimit-Limit: 500 X-Ratelimit-Remaining: 497 X-Ratelimit-Reset: 1740649613 Date: Thu, 27 Feb 2025 08:46:55 GMT Content-Length: 310 Data Raw: 3c 73 63 72 69 70 74 3e 0a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 2f 6e 65 77 73 3f 71 3d 43 61 6d 70 61 69 67 6e 49 44 20 6e 6f 74 20 66 6f 75 6e 64 21 20 2f 74 2f 34 51 47 57 54 64 36 39 34 36 59 44 4d 61 31 38 32 79 6b 77 68 6c 76 64 66 66 75 37 36 38 5a 55 51 4e 58 4b 44 4c 42 59 4c 55 44 4c 46 39 34 34 39 48 58 4a 49 31 38 32 33 49 39 27 3b 20 0a 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 72 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 2f 6e 65 77 73 3f 71 3d 43 61 6d 70 61 69 67 6e 49 44 20 6e 6f 74 20 66 6f 75 6e 64 21 20 2f 74 2f 34 51 47 57 54 64 36 39 34 36 59 44 4d 61 31 38 32 79 6b 77 68 6c 76 64 66 66 75 37 36 38 5a 55 51 4e 58 4b 44 4c 42 59 4c 55 44 4c 46 39 34 34 39 48 58 4a 49 31 38 32 33 49 39 27 29 3b 0a 7d 2c 20 31 30 30 30 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 3e 3c 2f 70 3e 0a Data Ascii: <script>setTimeout(function(){ window.location.href = '/news?q=CampaignID not found! /t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9'; console.log('redirecting to /news?q=CampaignID not found! /t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9');}, 1000);</script><p></p>
Feb 27, 2025 09:46:56.252494097 CET	630	OUT	GET /news?q=CampaignID%20not%20found!%20/t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9 HTTP/1.1 Host: almalinuooslkq.buzz Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://almalinuooslkq.buzz/t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 27, 2025 09:46:56.469670057 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Address: gin_throttle_mw_7200000000_8.46.123.189 X-Ratelimit-Limit: 500 X-Ratelimit-Remaining: 496 X-Ratelimit-Reset: 1740649613 Date: Thu, 27 Feb 2025 08:46:56 GMT Transfer-Encoding: chunked Data Raw: 38 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 78 20 4e 65 77 73 20 57 6f 72 6c 64 20 52 53 53 20 46 65 65 64 20 20 2d 20 61 6c 6d 61 6c 69 6e 75 6f 6f 73 6c 6b 71 2e 62 75 7a 7a 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 34 66 36 66 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f [TRUNCATED] Data Ascii: 800<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Fox News World RSS Feed - almalinuooslkq.buzz </title> <style> body { font-family: Arial, sans-serif; background-color: #f4f6f9; color: #333; margin: 0; padding: 0; } .container { width: 80%; margin: 0 auto; } h1 { font-size: 2rem; margin: 2rem 0; } .news-item { background-color: white; padding: 1.5rem; margin-bottom: 1rem; box-shadow: 0 1px 3px rgba(0, 0, 0, 0.12), 0 1px 2px rgba(0, 0, 0, 0.24); } .news-item h2 { font-size: 1.5rem; margin-bottom: 1rem; } .news-item a { color: #1a73e8; text-decoration: none;
Feb 27, 2025 09:46:56.469687939 CET	1236	IN	Data Raw: 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 6e 65 77 73 2d 69 74 65 6d 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 0a 20 20 20 20 20 Data Ascii: } .news-item a:hover { text-decoration: underline; } .news-item p { font-size: 1rem; margin-bottom: 0; } </style></head><body><div class="container"> <h1>Fo
Feb 27, 2025 09:46:56.469700098 CET	448	IN	Data Raw: 69 74 6c 65 64 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 67 75 69 64 20 3d 20 67 75 69 64 45 6c 65 6d 65 6e 74 20 3f 20 67 75 69 64 45 6c 65 6d 65 6e 74 2e 74 65 78 74 43 6f 6e 74 65 6e 74 20 3a 20 22 23 22 3b 0a 20 20 20 20 Data Ascii: itled"; const guid = guidElement ? guidElement.textContent : "#"; const description = descriptionElement ? descriptionElement.textContent : "No description available."; const content = contentElement ? conte
Feb 27, 2025 09:46:56.557943106 CET	556	IN	Data Raw: 20 20 3c 68 32 3e 3c 61 20 68 72 65 66 3d 22 24 7b 67 75 69 64 7d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 24 7b 74 69 74 6c 65 7d 3c 2f 61 3e 3c 2f 68 32 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 24 7b 64 65 73 63 72 69 70 Data Ascii: <h2><a href="${guid}" target="_blank">${title}</a></h2> <p>${description}</p> <div>${content}</div> `; newsItemsContainer.appendChild(newsItem); }); }; (async () => { cons
Feb 27, 2025 09:47:20.216164112 CET	569	OUT	GET / HTTP/1.1 Host: almalinuooslkq.buzz Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://almalinuooslkq.buzz/news?q=CampaignID%20not%20found!%20/t/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 27, 2025 09:47:20.439436913 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Address: gin_throttle_mw_7200000000_8.46.123.189 X-Ratelimit-Limit: 500 X-Ratelimit-Remaining: 495 X-Ratelimit-Reset: 1740649613 Date: Thu, 27 Feb 2025 08:47:20 GMT Transfer-Encoding: chunked Data Raw: 38 30 30 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 6f 6d 69 6e 67 20 53 6f 6f 6e 20 2d 20 61 6c 6d 61 6c 69 6e 75 6f 6f 73 6c 6b 71 2e 62 75 7a 7a 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 2e 63 73 73 22 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 3c [TRUNCATED] Data Ascii: 800<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Coming Soon - almalinuooslkq.buzz</title> <link rel="stylesheet" href="/assets/styles.css"></head><body><div class="container"> <h1>Our Website is Coming Soon!</h1> <p>We are working hard to give you the best experience. Stay tuned!</p> <div class="countdown"> <div class="countdown-item"> <span id="days">00</span> <label>Days</label> </div> <div class="countdown-item"> <span id="hours">00</span> <label>Hours</label> </div> <div class="countdown-item"> <span id="minutes">00</span> <label>Minutes</label> </div> <div class="countdown-item"> <span id="seconds">00</span> <label>Seconds</la
Feb 27, 2025 09:47:20.439483881 CET	1236	IN	Data Raw: 62 65 6c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 0d 0a 20 20 20 20 3c 66 6f 72 6d 20 69 64 3d 22 73 75 62 73 63 72 69 70 74 69 6f 6e 2d 66 6f 72 6d 22 20 6f 6e 73 75 62 6d 69 74 3d 22 73 75 62 Data Ascii: bel> </div> </div> <form id="subscription-form" onsubmit="submitForm(event)"> <input type="email" id="email" placeholder="Enter your email" required> <button type="submit">Subscribe</button> <p i
Feb 27, 2025 09:47:20.439537048 CET	448	IN	Data Raw: 31 30 30 30 20 2a 20 36 30 20 2a 20 36 30 29 29 20 2f 20 28 31 30 30 30 20 2a 20 36 30 29 29 3b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 73 65 63 6f 6e 64 73 20 3d 20 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 74 69 6d 65 52 65 6d 61 69 6e 69 6e Data Ascii: 1000 * 60 * 60)) / (1000 * 60)); const seconds = Math.floor((timeRemaining % (1000 * 60)) / 1000); daysElement.textContent = days.toString().padStart(2, '0'); hoursElement.textContent = hours.toString(
Feb 27, 2025 09:47:20.527700901 CET	338	IN	Data Raw: 76 65 6e 74 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 65 6d 61 69 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e Data Ascii: vent) { event.preventDefault(); const email = document.getElementById('email').value; document.getElementById('subscription-message').textContent = `Thank you for subscribing, ${email}!`; } up
Feb 27, 2025 09:48:05.540991068 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 09:47:20.480073929 CET	342	OUT	GET /assets/styles.css HTTP/1.1 Host: almalinuooslkq.buzz Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://almalinuooslkq.buzz/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 27, 2025 09:47:20.696970940 CET	1236	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 1435 Content-Type: text/css; charset=utf-8 Last-Modified: Mon, 24 Feb 2025 14:30:23 GMT Date: Thu, 27 Feb 2025 08:47:20 GMT Data Raw: 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 30 66 30 66 30 3b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 76 68 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 7d 0a 0a 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 33 30 70 78 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 31 30 70 78 3b 0a 20 20 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 34 70 78 20 36 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 29 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: body { font-family: Arial, sans-serif; background-color: #f0f0f0; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; padding: 0;}.container { background-color: #ffffff; padding: 30px; border-radius: 10px; box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1); text-align: center;}h1 { font-size: 36px; margin-bottom: 20px; color: #333;}p { font-size: 18px; color: #777; margin-bottom: 40px;}.countdown { display: flex; justify-content: center; margin-bottom: 40px;}.countdown-item { display: inline-block; margin: 0 10px;}.countdown-item span { font-size: 24px; color: #444;}.countdown-item label { display: block; font-size: 14px; color: #999;}form { display: flex; justify-content: center; align-items: center; flex-direction: column;}input[type="email"] { font-size: 16px; padding: 10px; border: 1px solid #ccc; [TRUNCATED]
Feb 27, 2025 09:47:20.696993113 CET	384	IN	Data Raw: 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 33 30 30 70 78 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 7d 0a 0a 62 75 74 74 6f 6e 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 20 20 20 Data Ascii: max-width: 300px; margin-bottom: 20px;}button { font-size: 16px; padding: 10px 20px; background-color: #333; color: #fff; border: none; border-radius: 5px; cursor: pointer; transition: background-color
Feb 27, 2025 09:48:05.706710100 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2025-02-27 08:46:57 UTC	564	OUT	GET /foxnews/world HTTP/1.1 Host: feeds.foxnews.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: http://almalinuooslkq.buzz Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://almalinuooslkq.buzz/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-27 08:46:57 UTC	564	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 0 Retry-After: 0 Location: https://moxie.foxnews.com/google-publisher/world.xml Accept-Ranges: bytes Date: Thu, 27 Feb 2025 08:46:57 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740031-EWR X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1740646017.143053,VS0,VE0 access-control-allow-origin: * access-control-allow-methods: GET,HEAD,POST,OPTIONS access-control-allow-headers: * access-control-allow-credentials: false access-control-max-age: 86400 access-Control-expose-headers: etag

Timestamp	Bytes transferred	Direction	Data
2025-02-27 08:46:57 UTC	555	OUT	GET /google-publisher/world.xml HTTP/1.1 Host: moxie.foxnews.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://almalinuooslkq.buzz/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-27 08:46:57 UTC	1276	IN	HTTP/1.1 200 OK Connection: close Content-Length: 181071 x-amz-cf-pop: IAD55-P5 cache-control: max-age=300, must-revalidate, stale-while-revalidate=60, stale-if-error=86400 moxie-version: 1.0 x-amz-cf-id: sqhob2obYlKMQvr_GwTiLk9F4HhMOFWRZ37A4_umUxak_fIgoj36XA== x-amzn-requestid: 227aea4a-3607-4774-b19f-e706c735c512 x-amz-apigw-id: GornhFYUoAMEYGA= moxie-uptime: 50.73ms content-type: text/xml;charset=utf-8 via: 1.1 ddf6879aa6c2007b075baebb295e9494.cloudfront.net (CloudFront), 1.1 varnish, 1.1 varnish, 1.1 varnish etag: 64b4d278b1d1f081a88c5e23ad46d7c1 x-robots-tag: noindex, nofollow x-amzn-trace-id: Root=1-67c0262f-5b16a1694a7261343d494875;Parent=27086de2cd897b04;Sampled=0;Lineage=1:c27b69c6:0 x-debug-path: /prod/fn/google-publisher/world.xml x-origin: prod_moxie Accept-Ranges: bytes Age: 82 Date: Thu, 27 Feb 2025 08:46:57 GMT access-control-allow-origin: * access-control-allow-methods: GET,HEAD,POST,OPTIONS access-control-allow-headers: * access-control-allow-credentials: false access-control-max-age: 86400 X-Served-By: cache-iad-kiad7000170-IAD, cache-iad-kiad7000170-IAD, cache-ewr-kewr1740060-EWR X-Cache: Miss from cloudfront, MISS, HIT, MISS X-Cache-Hits: 0, 12, 0 X-Timer: S1740646018.739792,VS0,VE8 Vary: Accept-Encoding
2025-02-27 08:46:57 UTC	1378	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 20 73 74 61 6e 64 61 6c 6f 6e 65 3d 22 79 65 73 22 3f 3e 0a 3c 72 73 73 20 78 6d 6c 6e 73 3a 6d 65 64 69 61 3d 22 68 74 74 70 3a 2f 2f 73 65 61 72 63 68 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 6d 72 73 73 2f 22 20 78 6d 6c 6e 73 3a 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 72 73 73 2f 31 2e 30 2f 6d 6f 64 75 6c 65 73 2f 63 6f 6e 74 65 6e 74 2f 22 20 78 6d 6c 6e 73 3a 64 63 3d 22 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 64 63 2f 65 6c 65 6d 65 6e 74 73 2f 31 2e 31 2f 22 20 78 6d 6c 6e 73 3a 61 74 6f 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 35 2f 41 74 6f 6d 22 20 76 65 72 73 69 6f 6e 3d Data Ascii: <?xml version="1.0" encoding="UTF-8" standalone="yes"?><rss xmlns:media="http://search.yahoo.com/mrss/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom" version=
2025-02-27 08:46:57 UTC	1378	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 75 69 64 20 69 73 50 65 72 6d 61 4c 69 6e 6b 3d 22 74 72 75 65 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 6f 78 6e 65 77 73 2e 63 6f 6d 2f 77 6f 72 6c 64 2f 72 65 64 2d 63 72 6f 73 73 2d 72 65 63 65 69 76 65 73 2d 62 6f 64 69 65 73 2d 34 2d 73 6c 61 69 6e 2d 68 6f 73 74 61 67 65 73 2d 69 73 72 61 65 6c 2d 68 61 6d 61 73 2d 65 78 63 68 61 6e 67 65 3c 2f 67 75 69 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 20 43 72 6f 73 73 20 72 65 63 65 69 76 65 73 20 62 6f 64 69 65 73 20 6f 66 20 34 20 73 6c 61 69 6e 20 68 6f 73 74 61 67 65 73 20 64 75 72 69 6e 67 20 49 73 72 61 65 6c 2d 48 61 6d 61 73 20 65 78 63 68 61 6e 67 65 3c 2f Data Ascii: <guid isPermaLink="true">https://www.foxnews.com/world/red-cross-receives-bodies-4-slain-hostages-israel-hamas-exchange</guid> <title>Red Cross receives bodies of 4 slain hostages during Israel-Hamas exchange</
2025-02-27 08:46:57 UTC	1378	IN	Data Raw: 80 99 73 20 6f 66 66 69 63 65 20 70 72 65 76 69 6f 75 73 6c 79 20 63 6f 6e 66 69 72 6d 65 64 20 74 68 65 20 65 78 63 68 61 6e 67 65 20 6f 6e 20 57 65 64 6e 65 73 64 61 79 2c 20 6e 6f 74 69 6e 67 20 74 68 61 74 20 69 74 20 77 61 73 20 6c 69 6b 65 6c 79 20 74 6f 20 74 61 6b 65 20 70 6c 61 63 65 20 77 69 74 68 6f 75 74 20 74 68 65 20 68 75 6d 69 6c 69 61 74 69 6e 67 20 26 71 75 6f 74 3b 63 65 72 65 6d 6f 6e 69 65 73 26 71 75 6f 74 3b 20 74 68 61 74 20 48 61 6d 61 73 20 68 61 73 20 65 6e 67 61 67 65 64 20 69 6e 20 70 72 69 6f 72 2e 26 6c 74 3b 2f 70 26 67 74 3b 26 6c 74 3b 70 26 67 74 3b 26 6c 74 3b 61 20 68 72 65 66 3d 26 71 75 6f 74 3b 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 6f 78 6e 65 77 73 2e 63 6f 6d 2f 77 6f 72 6c 64 2f 69 73 72 61 65 6c 73 2d 75 6e 2d Data Ascii: s office previously confirmed the exchange on Wednesday, noting that it was likely to take place without the humiliating "ceremonies" that Hamas has engaged in prior.</p><p><a href="https://www.foxnews.com/world/israels-un-
2025-02-27 08:46:57 UTC	1378	IN	Data Raw: 6e 79 61 68 75 26 61 70 6f 73 3b 73 20 73 74 61 74 65 6d 65 6e 74 20 73 61 69 64 2e 26 6c 74 3b 2f 70 26 67 74 3b 26 6c 74 3b 70 26 67 74 3b 48 61 6d 61 73 20 68 61 64 20 63 61 6c 6c 65 64 20 74 68 65 20 64 65 6c 61 79 20 61 20 26 71 75 6f 74 3b 73 65 72 69 6f 75 73 20 76 69 6f 6c 61 74 69 6f 6e 2c 26 71 75 6f 74 3b 20 74 68 6f 75 67 68 20 74 68 65 20 6d 69 6c 69 74 61 6e 74 20 67 72 6f 75 70 26 61 70 6f 73 3b 73 20 74 72 65 61 74 6d 65 6e 74 20 6f 66 20 70 72 69 73 6f 6e 65 72 73 20 77 61 73 20 63 6f 6e 64 65 6d 6e 65 64 20 62 79 20 69 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 67 72 6f 75 70 73 2c 20 69 6e 63 6c 75 64 69 6e 67 20 74 68 65 20 55 6e 69 74 65 64 20 4e 61 74 69 6f 6e 73 2e 26 6c 74 3b 2f 70 26 67 74 3b 26 6c 74 3b 70 26 67 74 3b 26 6c 74 3b 61 Data Ascii: nyahu's statement said.</p><p>Hamas had called the delay a "serious violation," though the militant group's treatment of prisoners was condemned by international groups, including the United Nations.</p><p><a
2025-02-27 08:46:57 UTC	1378	IN	Data Raw: 69 6d 6d 65 64 69 61 74 65 20 72 65 74 75 72 6e 20 6f 66 20 26 6c 74 3b 61 20 68 72 65 66 3d 26 71 75 6f 74 3b 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 6f 78 6e 65 77 73 2e 63 6f 6d 2f 6f 70 69 6e 69 6f 6e 2f 79 6f 75 2d 66 72 65 65 64 2d 6d 65 2d 66 72 6f 6d 2d 68 61 6d 61 73 2d 70 72 65 73 69 64 65 6e 74 2d 74 72 75 6d 70 2d 70 6c 65 61 73 65 2d 73 61 76 65 2d 6d 79 2d 62 72 6f 74 68 65 72 2d 74 6f 6f 26 71 75 6f 74 3b 20 74 61 72 67 65 74 3d 26 71 75 6f 74 3b 5f 62 6c 61 6e 6b 26 71 75 6f 74 3b 20 72 65 6c 3d 26 71 75 6f 74 3b 6e 6f 6f 70 65 6e 65 72 26 71 75 6f 74 3b 26 67 74 3b 26 6c 74 3b 75 26 67 74 3b 6f 75 72 20 68 6f 73 74 61 67 65 73 2c 26 71 75 6f 74 3b 26 6c 74 3b 2f 75 26 67 74 3b 26 6c 74 3b 2f 61 26 67 74 3b 20 44 61 6e 6f 6e 20 73 61 69 64 Data Ascii: immediate return of <a href="https://www.foxnews.com/opinion/you-freed-me-from-hamas-president-trump-please-save-my-brother-too" target="_blank" rel="noopener"><u>our hostages,"</u></a> Danon said
2025-02-27 08:46:57 UTC	1378	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 61 74 65 67 6f 72 79 20 64 6f 6d 61 69 6e 3d 22 66 6f 78 6e 65 77 73 2e 63 6f 6d 2f 74 61 78 6f 6e 6f 6d 79 22 3e 66 6f 78 2d 6e 65 77 73 2f 77 6f 72 6c 64 2f 77 6f 72 6c 64 2d 72 65 67 69 6f 6e 73 2f 6d 69 64 64 6c 65 2d 65 61 73 74 3c 2f 63 61 74 65 67 6f 72 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 61 74 65 67 6f 72 79 20 64 6f 6d 61 69 6e 3d 22 66 6f 78 6e 65 77 73 2e 63 6f 6d 2f 74 61 78 6f 6e 6f 6d 79 22 3e 66 6f 78 2d 6e 65 77 73 2f 70 6f 6c 69 74 69 63 73 2f 66 6f 72 65 Data Ascii: <category domain="foxnews.com/taxonomy">fox-news/world/world-regions/middle-east</category> <category domain="foxnews.com/taxonomy">fox-news/politics/fore
2025-02-27 08:46:57 UTC	1378	IN	Data Raw: 72 74 20 62 79 20 74 68 65 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 41 74 6f 6d 69 63 20 45 6e 65 72 67 79 20 41 67 65 6e 63 79 20 28 49 41 45 41 29 20 63 61 75 74 69 6f 6e 65 64 20 74 68 61 74 20 74 68 65 20 49 73 6c 61 6d 69 63 20 52 65 70 75 62 6c 69 63 20 6f 66 20 49 72 61 6e 20 69 73 20 70 72 6f 64 75 63 69 6e 67 20 61 20 6c 61 72 67 65 20 61 6d 6f 75 6e 74 20 6f 66 20 75 72 61 6e 69 75 6d 20 74 68 61 74 20 63 6f 75 6c 64 20 62 65 20 75 73 65 64 20 69 6e 20 73 69 78 20 61 74 6f 6d 69 63 20 62 6f 6d 62 73 2e 3c 2f 64 65 73 63 72 69 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: rt by the International Atomic Energy Agency (IAEA) cautioned that the Islamic Republic of Iran is producing a large amount of uranium that could be used in six atomic bombs.</description>
2025-02-27 08:46:57 UTC	1378	IN	Data Raw: 6c 69 74 69 63 73 2f 69 72 61 6e 2d 74 65 72 72 69 66 69 65 64 2d 74 72 75 6d 70 2d 70 72 65 73 69 64 65 6e 63 79 2d 69 72 61 6e 69 61 6e 2d 63 75 72 72 65 6e 63 79 2d 66 61 6c 6c 73 2d 61 6c 6c 2d 74 69 6d 65 2d 6c 6f 77 26 71 75 6f 74 3b 20 74 61 72 67 65 74 3d 26 71 75 6f 74 3b 5f 62 6c 61 6e 6b 26 71 75 6f 74 3b 20 72 65 6c 3d 26 71 75 6f 74 3b 6e 6f 6f 70 65 6e 65 72 26 71 75 6f 74 3b 26 67 74 3b 26 6c 74 3b 73 74 72 6f 6e 67 26 67 74 3b 49 52 41 4e 20 e2 80 98 54 45 52 52 49 46 49 45 44 e2 80 99 20 4f 46 20 54 52 55 4d 50 20 50 52 45 53 49 44 45 4e 43 59 20 41 53 20 49 52 41 4e 49 41 4e 20 43 55 52 52 45 4e 43 59 20 46 41 4c 4c 53 20 54 4f 20 41 4e 20 41 4c 4c 2d 54 49 4d 45 20 4c 4f 57 26 6c 74 3b 2f 73 74 72 6f 6e 67 26 67 74 3b 26 6c 74 3b 2f 61 Data Ascii: litics/iran-terrified-trump-presidency-iranian-currency-falls-all-time-low" target="_blank" rel="noopener"><strong>IRAN TERRIFIED OF TRUMP PRESIDENCY AS IRANIAN CURRENCY FALLS TO AN ALL-TIME LOW</strong></a
2025-02-27 08:46:57 UTC	1378	IN	Data Raw: 68 65 20 65 6e 74 72 65 65 2e 20 54 68 65 79 20 64 6f 6e 26 61 70 6f 73 3b 74 20 77 61 6e 74 20 74 6f 20 6a 75 73 74 20 61 6e 6e 69 68 69 6c 61 74 65 20 49 73 72 61 65 6c 2c 20 77 68 69 63 68 20 74 68 65 79 20 64 6f 2e 20 59 65 61 68 2e 20 54 68 65 79 20 77 61 6e 74 20 75 6c 74 69 6d 61 74 65 6c 79 20 74 6f 20 61 6e 6e 69 68 69 6c 61 74 65 20 74 68 65 20 72 65 73 74 20 6f 66 20 75 73 20 61 73 20 77 65 6c 6c 2e 26 71 75 6f 74 3b 26 6c 74 3b 2f 70 26 67 74 3b 26 6c 74 3b 70 26 67 74 3b 26 6c 74 3b 61 20 68 72 65 66 3d 26 71 75 6f 74 3b 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 6f 78 6e 65 77 73 2e 63 6f 6d 2f 70 6f 6c 69 74 69 63 73 2f 6f 76 65 72 2d 31 35 30 2d 6c 61 77 6d 61 6b 65 72 73 2d 6c 65 6e 64 2d 73 75 70 70 6f 72 74 2d 72 65 73 69 73 74 61 6e 63 65 Data Ascii: he entree. They don't want to just annihilate Israel, which they do. Yeah. They want ultimately to annihilate the rest of us as well."</p><p><a href="https://www.foxnews.com/politics/over-150-lawmakers-lend-support-resistance
2025-02-27 08:46:57 UTC	1378	IN	Data Raw: 74 61 6b 65 73 20 74 68 65 20 70 72 65 73 73 75 72 65 20 6f 66 66 2e 20 54 68 65 79 20 67 65 74 20 6d 6f 6e 65 79 20 61 67 61 69 6e 2e 20 54 68 65 79 20 66 75 6e 64 20 74 65 72 72 6f 72 69 73 6d 2e 20 54 68 65 79 20 66 75 6e 64 20 74 68 65 20 62 75 69 6c 64 69 6e 67 20 6f 66 20 74 68 65 69 72 20 62 6f 6d 62 2e 20 41 6e 64 20 6e 6f 77 20 77 65 26 61 70 6f 73 3b 72 65 20 68 61 76 69 6e 67 20 74 6f 20 67 6f 20 62 61 63 6b 2e 20 54 68 61 6e 6b 20 67 6f 6f 64 6e 65 73 73 20 74 68 65 20 70 72 65 73 69 64 65 6e 74 20 68 61 73 20 72 65 65 73 74 61 62 6c 69 73 68 65 64 20 74 68 65 20 70 72 65 73 73 75 72 65 20 6f 6e 20 49 72 61 6e 20 65 63 6f 6e 6f 6d 69 63 61 6c 6c 79 2e 20 54 68 61 74 26 61 70 6f 73 3b 73 20 61 20 70 6c 75 73 2e 26 71 75 6f 74 3b 26 6c 74 3b 2f Data Ascii: takes the pressure off. They get money again. They fund terrorism. They fund the building of their bomb. And now we're having to go back. Thank goodness the president has reestablished the pressure on Iran economically. That's a plus."</

Timestamp	Bytes transferred	Direction	Data
2025-02-27 08:46:58 UTC	367	OUT	GET /google-publisher/world.xml HTTP/1.1 Host: moxie.foxnews.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-27 08:46:58 UTC	1275	IN	HTTP/1.1 200 OK Connection: close Content-Length: 181071 x-amz-cf-pop: IAD55-P5 cache-control: max-age=300, must-revalidate, stale-while-revalidate=60, stale-if-error=86400 moxie-version: 1.0 x-amz-cf-id: sqhob2obYlKMQvr_GwTiLk9F4HhMOFWRZ37A4_umUxak_fIgoj36XA== x-amzn-requestid: 227aea4a-3607-4774-b19f-e706c735c512 x-amz-apigw-id: GornhFYUoAMEYGA= moxie-uptime: 50.73ms content-type: text/xml;charset=utf-8 via: 1.1 ddf6879aa6c2007b075baebb295e9494.cloudfront.net (CloudFront), 1.1 varnish, 1.1 varnish, 1.1 varnish etag: 64b4d278b1d1f081a88c5e23ad46d7c1 x-robots-tag: noindex, nofollow x-amzn-trace-id: Root=1-67c0262f-5b16a1694a7261343d494875;Parent=27086de2cd897b04;Sampled=0;Lineage=1:c27b69c6:0 x-debug-path: /prod/fn/google-publisher/world.xml x-origin: prod_moxie Accept-Ranges: bytes Date: Thu, 27 Feb 2025 08:46:58 GMT Age: 83 access-control-allow-origin: * access-control-allow-methods: GET,HEAD,POST,OPTIONS access-control-allow-headers: * access-control-allow-credentials: false access-control-max-age: 86400 X-Served-By: cache-iad-kiad7000170-IAD, cache-iad-kiad7000170-IAD, cache-ewr-kewr1740048-EWR X-Cache: Miss from cloudfront, MISS, HIT, HIT X-Cache-Hits: 0, 12, 1 X-Timer: S1740646019.674371,VS0,VE1 Vary: Accept-Encoding
2025-02-27 08:46:58 UTC	16384	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 20 73 74 61 6e 64 61 6c 6f 6e 65 3d 22 79 65 73 22 3f 3e 0a 3c 72 73 73 20 78 6d 6c 6e 73 3a 6d 65 64 69 61 3d 22 68 74 74 70 3a 2f 2f 73 65 61 72 63 68 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 6d 72 73 73 2f 22 20 78 6d 6c 6e 73 3a 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 72 73 73 2f 31 2e 30 2f 6d 6f 64 75 6c 65 73 2f 63 6f 6e 74 65 6e 74 2f 22 20 78 6d 6c 6e 73 3a 64 63 3d 22 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 64 63 2f 65 6c 65 6d 65 6e 74 73 2f 31 2e 31 2f 22 20 78 6d 6c 6e 73 3a 61 74 6f 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 35 2f 41 74 6f 6d 22 20 76 65 72 73 69 6f 6e 3d Data Ascii: <?xml version="1.0" encoding="UTF-8" standalone="yes"?><rss xmlns:media="http://search.yahoo.com/mrss/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom" version=
2025-02-27 08:46:58 UTC	16384	IN	Data Raw: 3d 26 71 75 6f 74 3b 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 6f 78 6e 65 77 73 2e 63 6f 6d 2f 63 61 74 65 67 6f 72 79 2f 77 6f 72 6c 64 2f 75 6e 69 74 65 64 2d 6e 61 74 69 6f 6e 73 26 71 75 6f 74 3b 20 74 61 72 67 65 74 3d 26 71 75 6f 74 3b 5f 62 6c 61 6e 6b 26 71 75 6f 74 3b 20 72 65 6c 3d 26 71 75 6f 74 3b 6e 6f 6f 70 65 6e 65 72 26 71 75 6f 74 3b 26 67 74 3b 55 6e 69 74 65 64 20 4e 61 74 69 6f 6e 73 26 6c 74 3b 2f 61 26 67 74 3b 20 72 65 73 6f 6c 75 74 69 6f 6e 20 4d 6f 6e 64 61 79 20 61 74 20 74 68 65 20 55 2e 4e 2e 20 47 65 6e 65 72 61 6c 20 41 73 73 65 6d 62 6c 79 20 74 68 61 74 20 62 6c 61 6d 65 73 20 52 75 73 73 69 61 20 66 6f 72 20 74 68 65 20 77 61 72 20 77 69 74 68 20 69 74 73 20 6e 65 69 67 68 62 6f 72 2e c2 a0 26 6c 74 3b 2f 70 26 67 74 3b 26 Data Ascii: ="https://www.foxnews.com/category/world/united-nations" target="_blank" rel="noopener">United Nations</a> resolution Monday at the U.N. General Assembly that blames Russia for the war with its neighbor.</p>&
2025-02-27 08:46:58 UTC	16384	IN	Data Raw: 66 69 67 68 74 20 74 6f 20 67 65 74 20 74 68 65 20 72 65 6d 61 69 6e 69 6e 67 20 68 6f 73 74 61 67 65 73 20 68 6f 6d 65 2e 26 6c 74 3b 2f 70 26 67 74 3b 26 6c 74 3b 70 26 67 74 3b 57 68 69 6c 65 20 53 68 69 72 69 2c 20 41 72 69 65 6c 20 61 6e 64 20 4b 66 69 72 20 42 69 62 61 73 20 77 65 72 65 20 62 75 72 69 65 64 20 6f 6e 20 57 65 64 6e 65 73 64 61 79 20 74 6f 67 65 74 68 65 72 20 69 6e 20 6f 6e 65 20 63 61 73 6b 65 74 2c 20 61 63 63 6f 72 64 69 6e 67 20 74 6f 20 74 68 65 20 26 6c 74 3b 61 20 68 72 65 66 3d 26 71 75 6f 74 3b 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 69 6d 65 73 6f 66 69 73 72 61 65 6c 2e 63 6f 6d 2f 73 68 69 72 69 2d 61 72 69 65 6c 2d 61 6e 64 2d 6b 66 69 72 2d 62 69 62 61 73 2d 62 75 72 69 65 64 2d 69 6e 2d 61 2d 73 69 6e 67 6c 65 2d 63 61 Data Ascii: fight to get the remaining hostages home.</p><p>While Shiri, Ariel and Kfir Bibas were buried on Wednesday together in one casket, according to the <a href="https://www.timesofisrael.com/shiri-ariel-and-kfir-bibas-buried-in-a-single-ca
2025-02-27 08:46:58 UTC	16384	IN	Data Raw: 75 6d 70 2d 61 64 6d 69 6e 69 73 74 72 61 74 69 6f 6e 2d 63 70 61 63 2d 61 64 64 72 65 73 73 26 71 75 6f 74 3b 20 74 61 72 67 65 74 3d 26 71 75 6f 74 3b 5f 62 6c 61 6e 6b 26 71 75 6f 74 3b 20 72 65 6c 3d 26 71 75 6f 74 3b 6e 6f 6f 70 65 6e 65 72 26 71 75 6f 74 3b 26 67 74 3b 43 6f 6e 73 65 72 76 61 74 69 76 65 20 50 6f 6c 69 74 69 63 61 6c 20 41 63 74 69 6f 6e 20 43 6f 6e 66 65 72 65 6e 63 65 26 6c 74 3b 2f 61 26 67 74 3b 20 6f 76 65 72 20 74 68 65 20 77 65 65 6b 65 6e 64 2e c2 a0 26 6c 74 3b 2f 70 26 67 74 3b 26 6c 74 3b 70 26 67 74 3b 26 71 75 6f 74 3b 59 6f 75 20 64 6f 6e 26 61 70 6f 73 3b 74 20 68 61 76 65 20 73 68 61 72 65 64 20 76 61 6c 75 65 73 20 69 66 20 79 6f 75 20 63 61 6e 63 65 6c 20 65 6c 65 63 74 69 6f 6e 73 20 62 65 63 61 75 73 65 20 79 6f Data Ascii: ump-administration-cpac-address" target="_blank" rel="noopener">Conservative Political Action Conference</a> over the weekend.</p><p>"You don't have shared values if you cancel elections because yo
2025-02-27 08:46:58 UTC	16384	IN	Data Raw: 6c 74 3b 2f 70 26 67 74 3b 3c 2f 63 6f 6e 74 65 6e 74 3a 65 6e 63 6f 64 65 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 64 69 61 3a 63 6f 6e 74 65 6e 74 20 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 61 35 37 2e 66 6f 78 6e 65 77 73 2e 63 6f 6d 2f 73 74 61 74 69 63 2e 66 6f 78 6e 65 77 73 2e 63 6f 6d 2f 66 6f 78 6e 65 77 73 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 35 2f 30 32 2f 39 33 31 2f 35 32 33 2f 61 75 73 74 72 61 6c 69 Data Ascii: lt;/p></content:encoded> <media:content url="https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/02/931/523/australi
2025-02-27 08:46:58 UTC	16384	IN	Data Raw: 67 65 72 6f 75 73 2d 64 6f 67 65 73 2d 74 6f 70 2d 35 2d 6d 6f 73 74 2d 73 68 6f 63 6b 69 6e 67 2d 72 65 76 65 6c 61 74 69 6f 6e 73 26 71 75 6f 74 3b 26 67 74 3b 26 6c 74 3b 73 74 72 6f 6e 67 26 67 74 3b 26 6c 74 3b 75 26 67 74 3b 26 61 70 6f 73 3b 57 41 53 54 45 46 55 4c 20 41 4e 44 20 44 41 4e 47 45 52 4f 55 53 26 61 70 6f 73 3b 3a 20 44 4f 47 45 26 61 70 6f 73 3b 53 20 54 4f 50 20 46 49 56 45 20 4d 4f 53 54 20 53 48 4f 43 4b 49 4e 47 20 52 45 56 45 4c 41 54 49 4f 4e 53 26 6c 74 3b 2f 75 26 67 74 3b 26 6c 74 3b 2f 73 74 72 6f 6e 67 26 67 74 3b 26 6c 74 3b 2f 61 26 67 74 3b 26 6c 74 3b 2f 70 26 67 74 3b 26 6c 74 3b 70 26 67 74 3b 43 72 6f 6e 6a 65 20 73 61 69 64 20 26 71 75 6f 74 3b 74 68 65 20 69 64 65 61 20 6f 66 20 68 65 6c 70 69 6e 67 20 70 65 6f 70 Data Ascii: gerous-doges-top-5-most-shocking-revelations"><strong><u>'WASTEFUL AND DANGEROUS': DOGE'S TOP FIVE MOST SHOCKING REVELATIONS</u></strong></a></p><p>Cronje said "the idea of helping peop
2025-02-27 08:46:58 UTC	16384	IN	Data Raw: 65 20 66 69 76 65 20 61 6c 73 6f 20 69 6e 63 6c 75 64 65 64 20 6f 6e 65 20 26 6c 74 3b 61 20 68 72 65 66 3d 26 71 75 6f 74 3b 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 6f 78 6e 65 77 73 2e 63 6f 6d 2f 70 6f 6c 69 74 69 63 73 2f 62 69 6c 6c 2d 65 78 63 6c 75 73 69 76 65 2d 62 61 6e 6e 69 6e 67 2d 63 68 69 6e 65 73 65 2d 63 69 74 69 7a 65 6e 73 2d 66 72 6f 6d 2d 62 75 79 69 6e 67 2d 75 2d 73 2d 6c 61 6e 64 26 71 75 6f 74 3b 20 74 61 72 67 65 74 3d 26 71 75 6f 74 3b 5f 62 6c 61 6e 6b 26 71 75 6f 74 3b 20 72 65 6c 3d 26 71 75 6f 74 3b 6e 6f 6f 70 65 6e 65 72 26 71 75 6f 74 3b 26 67 74 3b 43 68 69 6e 65 73 65 20 63 69 74 69 7a 65 6e 26 6c 74 3b 2f 61 26 67 74 3b 2e 26 6c 74 3b 2f 70 26 67 74 3b 26 6c 74 3b 70 26 67 74 3b 26 71 75 6f 74 3b 54 68 65 79 20 77 65 72 Data Ascii: e five also included one <a href="https://www.foxnews.com/politics/bill-exclusive-banning-chinese-citizens-from-buying-u-s-land" target="_blank" rel="noopener">Chinese citizen</a>.</p><p>"They wer
2025-02-27 08:46:58 UTC	16384	IN	Data Raw: 74 3b 26 6c 74 3b 2f 70 26 67 74 3b 26 6c 74 3b 70 26 67 74 3b 26 71 75 6f 74 3b 57 65 26 61 70 6f 73 3b 76 65 20 70 72 65 74 74 79 20 6d 75 63 68 20 6e 65 67 6f 74 69 61 74 65 64 20 6f 75 72 20 64 65 61 6c 20 6f 6e 20 65 61 72 74 68 20 5b 6d 69 6e 65 72 61 6c 73 5d 20 61 6e 64 20 76 61 72 69 6f 75 73 20 6f 74 68 65 72 20 74 68 69 6e 67 73 2c 26 71 75 6f 74 3b 20 54 72 75 6d 70 20 73 61 69 64 2e 20 26 71 75 6f 74 3b 57 65 26 61 70 6f 73 3b 6c 6c 20 62 65 20 6c 6f 6f 6b 69 6e 67 e2 80 a6 2e 20 67 65 6e 65 72 61 6c 20 73 65 63 75 72 69 74 79 20 66 6f 72 20 55 6b 72 61 69 6e 65 20 6c 61 74 65 72 20 6f 6e 2e 20 49 20 64 6f 6e 26 61 70 6f 73 3b 74 20 74 68 69 6e 6b 20 74 68 61 74 26 61 70 6f 73 3b 73 20 67 6f 69 6e 67 20 74 6f 20 62 65 20 61 20 70 72 6f 62 6c Data Ascii: t;</p><p>"We've pretty much negotiated our deal on earth [minerals] and various other things," Trump said. "We'll be looking. general security for Ukraine later on. I don't think that's going to be a probl
2025-02-27 08:46:59 UTC	16384	IN	Data Raw: e2 80 99 73 20 63 6f 6e 64 69 74 69 6f 6e 20 72 65 6d 61 69 6e 73 20 63 72 69 74 69 63 61 6c 2c 20 62 75 74 20 73 74 61 62 6c 65 2e 20 4e 6f 20 61 63 75 74 65 20 72 65 73 70 69 72 61 74 6f 72 79 20 65 70 69 73 6f 64 65 73 20 68 61 76 65 20 6f 63 63 75 72 72 65 64 20 61 6e 64 20 74 68 65 20 68 65 6d 6f 64 79 6e 61 6d 69 63 20 70 61 72 61 6d 65 74 65 72 73 20 63 6f 6e 74 69 6e 75 65 20 74 6f 20 62 65 20 73 74 61 62 6c 65 2c 26 71 75 6f 74 3b 20 74 68 65 20 56 61 74 69 63 61 6e 20 73 61 69 64 20 69 6e 20 61 20 73 74 61 74 65 6d 65 6e 74 2c 20 74 72 61 6e 73 6c 61 74 65 64 20 66 72 6f 6d 20 49 74 61 6c 69 61 6e 2e 26 6c 74 3b 2f 70 26 67 74 3b 26 6c 74 3b 70 26 67 74 3b 26 71 75 6f 74 3b 49 6e 20 74 68 65 20 65 76 65 6e 69 6e 67 2c 20 68 65 20 75 6e 64 65 72 Data Ascii: s condition remains critical, but stable. No acute respiratory episodes have occurred and the hemodynamic parameters continue to be stable," the Vatican said in a statement, translated from Italian.</p><p>"In the evening, he under
2025-02-27 08:46:59 UTC	16384	IN	Data Raw: 20 65 6c 65 63 74 72 69 63 69 74 79 2c 20 6e 6f 20 69 6e 66 72 61 73 74 72 75 63 74 75 72 65 20 61 74 20 61 6c 6c 2e 26 71 75 6f 74 3b 26 6c 74 3b 2f 70 26 67 74 3b 26 6c 74 3b 70 26 67 74 3b 26 6c 74 3b 61 20 68 72 65 66 3d 26 71 75 6f 74 3b 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 6f 78 6e 65 77 73 2e 63 6f 6d 2f 70 6f 6c 69 74 69 63 73 2f 6c 65 76 65 6c 2d 69 74 2d 74 72 75 6d 70 2d 73 61 79 73 2d 75 73 2d 74 61 6b 65 2d 6f 76 65 72 2d 67 61 7a 61 2d 73 74 72 69 70 2d 72 65 62 75 69 6c 64 26 71 75 6f 74 3b 26 67 74 3b 26 6c 74 3b 73 74 72 6f 6e 67 26 67 74 3b 26 61 70 6f 73 3b 4c 45 56 45 4c 20 49 54 26 61 70 6f 73 3b 3a 20 54 52 55 4d 50 20 53 41 59 53 20 55 53 20 57 49 4c 4c 20 26 61 70 6f 73 3b 54 41 4b 45 20 4f 56 45 52 26 61 70 6f 73 3b 20 47 41 5a Data Ascii: electricity, no infrastructure at all."</p><p><a href="https://www.foxnews.com/politics/level-it-trump-says-us-take-over-gaza-strip-rebuild"><strong>'LEVEL IT': TRUMP SAYS US WILL 'TAKE OVER' GAZ

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://almalinuooslkq.buzz/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Static File Info

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5552, Parent PID: 5076

General

File Activities

File Opened

Windows Analysis Report
http://almalinuooslkq.buzz/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9

Timestamp	Bytes transferred	Direction	Data
2025-02-27 08:47:51 UTC	346	OUT	GET /th?id=OADD2.10239406254454_16NVNN3CF3IMQR1OI&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2025-02-27 08:47:51 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 598112 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: EE5EFDE7C1254725AD0C094881BD3969 Ref B: EWR30EDGE1121 Ref C: 2025-02-27T08:47:53Z Date: Thu, 27 Feb 2025 08:47:53 GMT Connection: close
2025-02-27 08:47:51 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 18 5e 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 ec 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 32 20 28 32 30 32 34 31 31 32 37 2e 6d 2e 32 38 38 35 20 31 37 39 37 34 33 31 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 32 3a 32 37 20 31 34 3a 34 38 3a 33 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 Data Ascii: JFIF``^ExifMM*bj(1:r2i``Adobe Photoshop 26.2 (20241127.m.2885 1797431) (Windows)2024:12:27 14:48:358
2025-02-27 08:47:51 UTC	16384	IN	Data Raw: 50 03 5a 8c 53 b1 46 28 01 39 a2 9d cd 1c d0 03 69 31 4e c5 18 a5 70 13 9a 4c 52 d2 e3 34 c0 6e 31 46 31 4e c5 18 a7 70 1b 8a 31 4b 45 20 13 14 63 d6 9f cd 22 8a 00 4a 4f a5 3f 9a 6d 01 66 26 29 79 a5 c5 2f 34 05 98 de 69 31 4b 45 2b 80 51 4b fc 34 bc d1 70 1b 45 2e 28 c5 17 1d 84 a2 9d cd 14 5c 2c 36 9d cd 27 b8 a3 14 5c 42 f3 47 34 98 a5 a2 e3 48 28 a2 97 14 5c 7c a8 4a 29 dc d1 cd 20 b0 da 31 8a 5c 51 8a 02 c8 4a 77 34 52 62 81 d8 3a 52 f3 47 34 73 40 58 6d 14 ee 68 a0 5c a5 3a 77 34 73 47 bd 68 66 1c d3 69 d4 98 a0 76 12 8a 56 a1 a8 26 c2 52 f3 4b cd 1c d0 16 1b 4e e6 8e 68 a0 61 cd 1c d1 fc 34 50 02 62 92 9d 45 00 36 8a 75 14 00 73 47 34 51 40 09 8a 4a 75 0b 40 59 09 8a 31 4b 45 00 1c d2 62 96 9d cd 17 43 b0 cc 52 f3 4b 8a 5e 68 0b 0d a2 97 14 bc d2 Data Ascii: PZSF(9i1NpLR4n1F1Np1KE c"JO?mf&)y/4i1KE+QK4pE.(\,6'\BG4H(\\|J) 1\QJw4Rb:RG4s@Xmh\:w4sGhfivV&RKNha4PbE6usG4Q@Ju@Y1KEbCRK^h
2025-02-27 08:47:51 UTC	16384	IN	Data Raw: 98 5a e6 cd bc b9 9e 3c 49 ff 00 4d 06 38 fc 45 2a 15 1c 3f 77 f6 5b bf cc 26 af af 52 87 87 ae be d0 b1 3a 37 0d cb 7f b4 2b a1 82 31 2c 0d b9 78 66 f9 7f 0a e3 3c 3b 71 02 4d 2c 76 ff 00 2a da ed 0d fe c9 15 d7 d8 cb 26 dc 9f 94 32 fc ab fd da e8 c6 53 4a 76 31 a3 26 e3 73 cf 3f 6a 2b 18 1b e1 1d f4 b3 ae e1 04 8a fb 7f bd 82 2b ce 6c 2f e2 b0 f0 5c b7 b0 37 94 ab 16 62 fe f7 3d 05 7a f7 c7 cb 03 a9 7c 37 ba 80 af fc 05 ba 37 15 e1 4a 05 e2 d9 e9 81 b7 5a c4 8b 34 8b c7 cc 71 f2 81 ed dc d7 d9 f0 d4 54 b0 0a 1d 14 bf c8 f9 5c f6 4e 38 9b f7 45 6d 07 4f 96 e6 46 d4 6f 5b cc 9a 5e 59 9b e5 db c7 4a ad aa 5a 4f 7b 75 1e 99 07 f7 bf 7e cb fa 0a dd d5 2e cd bc 6b 1d be d5 93 ab 33 7d d8 c7 a9 ac db 0d 5e de cd 98 5b 44 cc 5b 3b a5 65 dc cc 7b 95 1f e3 5f 43 Data Ascii: Z<IM8E?w[&R:7+1,xf<;qM,v&2SJv1&s?j++l/\7b=z\|77JZ4qT\N8EmOFo[^YJZO{u~.k3}^[D[;e{_C
2025-02-27 08:47:51 UTC	16384	IN	Data Raw: 16 17 4b 1f f1 2a e7 6a fa 9a d5 d0 25 78 9a e6 31 ff 00 2c 98 7d ef e2 27 96 c7 d2 b0 ef ee 85 9b 48 63 6f df 48 b9 ff 00 74 54 1a 5e ac 1a dd 40 97 6a f4 f9 be f7 bd 78 99 e6 6a a8 61 a5 18 ef f9 1f 75 c3 5c 37 ed 6a c6 bd 55 ee f4 f3 f3 3a 56 bc 97 ce 90 6e f3 04 92 0d bb bd 31 58 96 77 b1 c5 1c f6 d3 fc de 54 a5 15 7d 8f 20 7e 54 49 aa c6 f2 37 95 f3 34 7f dd aa 09 0c f7 1a d5 e0 89 77 34 ed 19 da bf 75 4e c1 93 9a fc e6 38 7a d8 c9 b7 26 ec 7e a1 ed 69 50 49 68 ac 65 d9 dc 4a 96 31 c4 3f 77 e4 4e c5 76 af cd c1 38 fc 6a cd 8d 8d cd d4 92 3c ed b7 f8 db f8 bc b0 dd bf de 35 a7 74 9a 1e 81 0b 0d 47 50 fb 4d fc 8d 95 82 2c 33 e4 ff 00 b3 57 7c 3d ab 5a 6a 17 1f 67 8a 06 8a 4f 2c ba f9 9f 2f 3f ed 57 d6 60 f2 a8 d3 5e d2 71 3e 47 31 e2 15 14 e9 d1 95 d8 Data Ascii: K*j%x1,}'HcoHtT^@jxjau\7jU:Vn1XwT} ~TI74w4uN8z&~iPIheJ1?wNv8j<5tGPM,3W\|=ZjgO,/?W`^q>G1
2025-02-27 08:47:51 UTC	16384	IN	Data Raw: 00 b4 85 65 f2 b1 e6 af de dc 3b 1a cf 6b 82 66 ca 2a e1 b8 db 5b 56 a1 1e e2 55 2d b6 36 8c ee 56 f4 c5 72 7a 78 9e 28 fc bb 89 d5 a4 8a 53 b9 97 f8 b9 f9 7f 4e 6b 18 24 f5 14 a4 ee 33 52 9c c9 35 b4 6f fb b3 f3 3c 9d 3e 5e 70 38 a2 e6 72 b6 7b 11 b8 6f bb ba a8 47 29 b8 f1 46 a1 71 26 df 2f 6a a4 5b 7f 84 2e 77 7e ad 58 de 26 d4 67 8f 4f 92 4b 76 5f dd 48 63 5f f6 8e 31 fc eb d8 f6 8a 1e ea 5a 9a 50 c1 3a b6 93 7b 97 5a e8 c8 cc 0b 79 71 c6 a0 b7 fb 40 72 48 fc aa 3d 06 dc b6 9b 66 9e 53 2b 4f 1b 5d 4f b9 7e 6c b1 dd cf bf 35 35 d5 81 fe c7 b5 47 5e 5a 41 1f e1 8e 6b 65 93 1b 4c 0b b5 64 c8 5d df 7b 03 02 8a 74 9c 9e a5 cf 11 08 26 a0 ec 4d 1c 28 9a 94 5e 47 cc 56 0c c8 de e4 d5 e9 a3 79 da 3c 7c aa cc 3c cf c3 d2 92 c2 31 1d bb 67 e5 f9 86 ef ef 36 7a Data Ascii: e;kf*[VU-6Vrzx(SNk$3R5o<>^p8r{oG)Fq&/j[.w~X&gOKv_Hc_1ZP:{Zyq@rH=fS+O]O~l55G^ZAkeLd]{t&M(^GVy<\|<1g6z
2025-02-27 08:47:51 UTC	16384	IN	Data Raw: 6c b6 ef e2 f7 35 37 da 54 7e ef 6b 65 be f6 df bb 55 66 63 f2 ef 5f fb e6 a1 69 f6 c8 de 62 ed 55 e3 fd ef 7a f9 ea 98 89 2e a7 b6 a8 26 f6 33 3c 5c 97 96 9e 51 8f 6f d9 ae 65 c4 8d ed d8 7e 27 f4 aa d1 ea 28 23 54 95 bc c0 dc 6e 55 f9 6a 5f 16 4e 35 5d 06 7d 3e da 76 59 19 48 8a 4f ee 91 d0 8f c6 99 e1 fb 07 11 d9 a4 ab b9 b6 fc df de c8 1f e3 5e 77 2b a9 3f 74 f4 63 51 c2 9f ef 3a 16 6c ed 6d ad b7 5c 5b 2b 46 3c b3 ba 35 fe 2f c3 d6 ba 9b 15 7b 58 63 7b 65 5f 33 6f fa cd c7 73 67 b9 fa 76 a8 2c 74 4b 88 a6 fb 49 81 9d 64 8f 67 6e c7 ad 4f 24 84 49 e5 a3 7f 0f cc df c2 a3 da bd 8c 3d 29 d0 d5 e8 d9 f3 18 fc c9 4e 1c b0 77 b9 2c 73 ba c9 b1 f7 2b 2f 1f 7b ee d6 66 ab 21 8e e1 be d0 cc ab d7 76 ef ca ac dc c4 11 a4 93 cf db 14 6b bf cc 92 b9 4f 14 6b 03 Data Ascii: l57T~keUfc_ibUz.&3<\Qoe~'(#TnUj_N5]}>vYHO^w+?tcQ:lm\[+F<5/{Xc{e_3osgv,tKIdgnO$I=)Nw,s+/{f!vkOk
2025-02-27 08:47:51 UTC	16384	IN	Data Raw: 23 a5 88 7c 40 80 ff 00 a1 cb f2 c6 d8 75 6f eb 59 bf da 10 59 dc 34 1e 6a b4 aa bb 1a 3f ef 03 5b 9a ab 46 f1 a9 97 ee 2a fd ea f2 bf 17 5d fd 9f c5 d1 cb f7 4c 8d 85 fe ef 1f 28 fd 29 57 c5 f2 b6 d2 d0 e7 c0 60 bd bb 51 6c 66 b9 33 d9 6a 0c 8c db 61 9e 52 7f d9 5c f3 8f a5 65 df b3 6a 11 ac 69 2a c7 34 4d 95 6f a7 f8 d5 ef 10 2f db ed e4 82 4f 98 ed f9 5b f9 57 2b 67 14 b3 c7 8f bb 34 1f 24 bb 7d 45 7c de 26 ab 95 47 6d 99 f7 d8 0a 2a 34 52 7b 9b 9a 3d f5 c5 a6 a4 c2 e6 26 8e 58 bf bc bf 2b 7f 88 35 a7 a5 a8 8e e1 82 45 fb 96 5f f8 0a 83 d8 fd 29 23 4f b6 b5 9c 8f 16 e6 68 fc bf 9b df 91 f9 56 b5 bd a9 b5 b5 97 0b b8 ac 7f 2a af bf 6a f4 f2 fc 3c ad ab bc 4f 1f 35 c5 d3 8a 76 d2 5d 8c f9 b4 cf b1 cd 21 3f c2 b9 5a a9 7d be 36 68 b7 79 85 59 64 65 f6 0e Data Ascii: #\|@uoYY4j?[F]L()W`Qlf3jaR\eji4Mo/O[W+g4$}E\|&Gm4R{=&X+5E_)#OhVj<O5v]!?Z}6hyYde
2025-02-27 08:47:51 UTC	16067	IN	Data Raw: f7 7e f6 6a ac b7 d1 cd 71 2c 16 fb 71 6c c0 7f b3 9c 7f 41 55 2f a7 2f 22 a7 f0 ab 7c db 6b 68 e0 dd 49 27 25 a1 7c c9 2d 0d 09 2f 86 d6 fd ee e1 23 61 b7 2f 6f 6a 66 a5 70 16 dd 48 89 94 b2 81 1e da a7 a5 c7 23 48 c5 17 cc dd c2 af 1f 31 ab 13 23 8d 41 a0 bb 6d de 54 63 e6 5f 73 ff 00 d6 ae f8 c6 30 5c b1 3a 29 53 4f de 91 6e dd 44 d0 c6 63 6e 79 1b 5b d7 de ab 5c 5c 45 69 aa 5d 23 f5 8a 35 f9 be 80 93 55 f5 ad 50 e9 9a a4 16 76 91 c7 e5 dc f0 cd fc 4b d4 d6 6c 9b e6 9a 52 65 f9 a4 90 ed 6d b5 4e 49 68 b7 3a 15 39 35 77 b1 a5 66 de 67 99 29 6f 9a 46 cf e1 54 ad 6d 0c 31 ae c9 76 85 66 3b 7f bc 49 26 a7 d3 4a 45 6f 18 75 fb cd f2 ed f7 ab 2a 91 a4 7b e0 9d 9b b7 cc bb 99 69 c6 0d 99 54 a8 a9 dc af 63 1c 5f 6a 90 3b 6d 91 98 16 dc be 9d 39 ab 6d 34 16 f2 Data Ascii: ~jq,qlAU//"\|khI'%\|-/#a/ojfpH#H1#AmTc_s0\:)SOnDcny[\\Ei]#5UPvKlRemNIh:95wfg)oFTm1vf;I&JEou*{iTc_j;m9m4
2025-02-27 08:47:51 UTC	16384	IN	Data Raw: a5 72 e3 cd 2b 32 c8 77 32 b2 fd df e1 aa be 22 b1 d4 65 f0 8e a7 6f a2 36 db cf b3 13 6c df 79 77 80 48 e3 bd 6b 58 c4 5e cd 40 5f e1 1f 7a a6 f9 6c ee 3e 76 da ac a7 f4 ac 2a 3b 4d 59 6a 75 af 81 9c 5f c1 0b bb cd 6b c0 b1 ea 37 8c be 64 91 14 91 59 4a b7 98 1f e6 6f 6f 98 1e 2b d0 ac 51 23 93 7f fa b5 65 1b 96 b8 ed 03 58 83 fb 1e 38 ac 3c b4 59 18 c8 cb 1a fc b1 82 e4 f6 ef ff 00 d7 ad 87 9a 5b 95 89 03 6e f3 64 c3 7f b3 de ba 71 15 61 06 fb 9c 51 8c a4 97 63 a0 8e fe ce 08 e4 03 73 37 f0 ed a8 6e 65 32 6d 32 7d e6 ff 00 6b f5 ac 1f b6 db 44 b1 5c 1d db a5 62 90 47 bb fd 67 bd 43 7f 73 3e e8 e3 12 ee 92 e6 4f de 32 ff 00 0a 0e df 4a f2 71 19 87 27 4b fa 1d 34 f0 e6 85 fc d1 4b 1b 20 db 22 af f7 ab 8e f1 86 a0 9a 05 8f f6 83 ba f9 51 b0 0d fd df 98 ed Data Ascii: r+2w2"eo6lywHkX^@_zl>v*;MYju_k7dYJoo+Q#eX8<Y[ndqaQcs7ne2m2}kD\bGgCs>O2Jq'K4K "Q
2025-02-27 08:47:51 UTC	16384	IN	Data Raw: 24 b6 6b 79 77 02 a3 4b cc 51 b3 7c de c4 8c 71 c7 34 eb 0d 96 f6 31 f9 eb c3 2e 5f ea 6a 96 aa f7 1a 96 d4 b4 95 63 2b 26 36 ed ed f5 ad 2a 46 0d b8 6c bb 98 b9 3d fa 9a b2 5e 4b f6 79 2d e0 65 f3 25 e5 9f fa 93 50 3c d1 58 da cb 3d 9c 4d 2c ca b9 66 6f 95 5b e8 4d 56 b1 b0 36 d6 ab 11 f9 9b 77 cc df c6 c7 df e9 4c d6 c9 fb 3b 59 cf 3a ce 59 b3 1c 6a bb 5b d3 19 ef cd 73 d2 8c 3d a2 51 77 5f 98 b9 9d ae 2f 86 ee 64 be be 67 2b b9 b6 ff 00 ac fe 18 c7 a0 15 a9 7c e2 3d e9 f7 42 e0 7f f5 85 53 f0 ad b1 b5 d2 d4 48 be 5b 2e 4c 92 37 dd 63 ed f4 a7 5e 4c f3 5e 29 3b 99 b8 da bb 7e 55 ae ac 45 6a 70 95 e9 ad 11 31 52 b2 b8 98 8e 55 93 cc f9 63 6f ef 7f 9e b5 76 da 50 6d f6 46 bb 63 e0 79 9b 7e f7 d2 ab db db 79 b7 58 75 dc 77 67 cb fe e8 ff 00 6b d2 a6 d5 6e Data Ascii: $kywKQ\|q41._jc+&6*Fl=^Ky-e%P<X=M,fo[MV6wL;Y:Yj[s=Qw_/dg+\|=BSH[.L7c^L^);~UEjp1RUcovPmFcy~yXuwgkn

Timestamp	Bytes transferred	Direction	Data
2025-02-27 08:47:51 UTC	375	OUT	GET /th?id=OADD2.10239406254455_1YN7X3I6LOQY14F1E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2025-02-27 08:47:51 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 617070 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: AB7724B1986748D8BDCD247849CEF804 Ref B: EWR30EDGE1119 Ref C: 2025-02-27T08:47:51Z Date: Thu, 27 Feb 2025 08:47:51 GMT Connection: close
2025-02-27 08:47:51 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a 9c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 ec 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 32 20 28 32 30 32 34 31 31 32 37 2e 6d 2e 32 38 38 35 20 31 37 39 37 34 33 31 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 32 3a 32 37 20 31 34 3a 34 38 3a 30 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 Data Ascii: JFIF``ExifMM*bj(1:r2i``Adobe Photoshop 26.2 (20241127.m.2885 1797431) (Windows)2024:12:27 14:48:00
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: ec 2e 68 e6 8e 68 e6 bb 0f 9c 1b 45 2b 52 f3 40 0d a6 d4 9c d3 69 a0 1b 45 3b 9a 4c 53 10 9c d1 cd 2e 29 28 01 31 49 4e a2 80 b0 da 29 71 46 29 dc 2c 25 1c d1 45 20 b0 73 4d 6a 75 1c d3 b8 58 6d 14 ee 69 b4 c9 b0 73 49 8a 5a 28 0b 0d a2 9d cd 1c d0 2d 46 d2 30 a7 f3 4d a0 2c 36 8a 5c 51 8a 77 01 39 a3 9a 5c 52 51 70 1b 45 3a 8e 69 80 de 68 e6 97 14 62 81 0c a2 9c c2 93 14 c6 25 26 29 cc 29 79 a2 e2 19 8a 4a 77 34 50 16 1b 45 2e 29 79 a0 43 31 46 29 68 a6 3b 0d a2 9d 47 34 05 86 d1 cd 3b 9a 39 a0 43 31 49 4e a2 80 b0 d6 a3 9a 5c 51 8a 00 6e 28 c5 3b 14 94 6a 02 62 92 9d 45 17 01 b4 98 a7 62 97 9a 00 63 0a 4a 7e 29 b8 a7 71 58 4a 4c 53 b1 43 0a 2e 16 1b 8a 4a 7e 28 61 45 c2 c3 28 a7 52 62 9d d0 59 0d c5 18 a7 62 92 80 b2 1b 45 3a 8a 05 64 36 8a 73 52 62 80 Data Ascii: .hhE+R@iE;LS.)(1IN)qF),%E sMjuXmisIZ(-F0M,6\Qw9\RQpE:ihb%&))yJw4PE.)yC1F)h;G4;9C1IN\Qn(;jbEbcJ~)qXJLSC.J~(aE(RbYbE:d6sRb
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 34 5c 06 51 4f c6 28 c5 3b 85 86 52 ed a7 62 8c 52 b8 ac 32 93 14 fa 29 85 86 63 14 95 25 14 05 88 e8 a7 ed a3 14 05 88 f1 4b 4f c5 25 01 61 98 a1 85 3e 91 85 3b 80 ca 18 53 a8 c7 cb 45 c4 33 14 bc d2 e2 8c 53 01 b8 a3 14 ec 51 8a 00 4e 69 b4 ea 29 5c 06 d1 4b 8a 5e 69 85 86 d1 4a b4 62 80 b5 c4 e6 8a 29 71 40 09 45 2e 29 79 a5 70 1b 4e e6 9b 4e a6 01 cd 14 51 4a e1 66 14 53 b6 d2 e2 90 ec 27 34 53 a9 71 40 58 65 2a 8c d3 f6 e6 9f 0c 65 9b 01 77 1a 1b 0b 0c 55 a7 2a d7 27 e3 0f 88 fa 06 87 79 25 85 a2 c9 ab 5f 27 fa c8 ed 98 79 70 9f 47 93 91 bb d8 64 fd 2b 8b bc f8 ad e2 c9 5a 53 69 67 a5 da 8f f9 67 1f 90 64 ff 00 c7 98 f2 7f 0a 71 84 e4 cc 2a 62 29 53 76 6f 53 d8 95 29 ca 95 e1 8f f1 6b c7 71 dc 7d 9d db 49 56 55 cb 37 d8 be 6c 7e 75 0b fc 6a f1 df 98 Data Ascii: 4\QO(;RbR2)c%KO%a>;SE3SQNi)\K^iJb)q@E.)ypNNQJfS'4Sq@XeewU'y%_'ypGd+ZSiggdq*b)SvoS)kq}IVU7l~uj
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 7d e5 5f 96 b5 2e 6e 8d ba c6 e9 12 c8 d2 64 7f f5 e9 da 2c f1 47 67 b2 4d bb 95 4e df 98 6d aa 0d a0 ea da ca b1 fb 65 b2 af 99 96 89 64 2b b7 d8 66 bd 9c 1c a1 37 cd 7d 0f 9e c5 c6 ad 1f 72 df 33 0f 5a d6 a4 9a eb e7 66 66 6f e2 6c 7c bf 4e d5 c9 78 93 56 16 76 f2 7c bb 64 6f f5 51 ee f9 be a7 e9 5d 7f 88 3c 33 7b 64 bb 2e 22 55 3c b6 e5 6d cb f4 ae 43 58 d1 b4 98 6e a5 d4 75 9b c6 92 19 e4 c4 70 45 f7 98 f6 19 f4 c5 75 e3 2a 4e 14 9b 8a df af 64 75 70 f6 1f 0f 5f 17 cd 55 5d 47 54 ad 7b b3 82 b6 f1 14 eb 71 10 11 34 ac cc c3 74 9f 5f d6 ba 2f 0e b9 4b 89 0c f0 33 19 17 fd 67 f7 4f a9 aa 7e 21 3a 3d d6 d1 a7 ae 9f a6 88 e4 27 fb ee c7 18 1b 8f a7 b0 a9 3c 3f a0 c9 7b 7c b1 a4 ed 78 cd cb 46 b2 6d 56 c0 fe ee 7a 57 cb d5 8c 5b b4 4f d6 1a a7 52 37 4b 95 Data Ascii: }_.nd,GgMNmed+f7}r3Zffol\|NxVv\|doQ]<3{d."U<mCXnupEu*Ndup_U]GT{q4t_/K3gO~!:='<?{\|xFmVzW[OR7K
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 41 91 55 7e f0 ad 6b d5 d7 dc 7a 1e 85 6c 55 29 4d 38 3f 99 34 3a dd b9 b1 96 29 6c d5 63 8d 71 f3 28 e9 ed 9a e0 7e 29 78 a6 34 d3 5b 4c b3 b5 6b 76 9b 1b 9b 77 cd b4 f4 1f 8d 6a f8 9e 09 23 5f 2c ca db 59 80 8f f8 77 57 23 71 a3 3c 9a 93 5d 4a be 64 9b 0a 47 13 7d ef f7 8e 7b 9a 8a 11 b3 52 66 b4 65 4e 32 e6 b1 91 e1 1b 35 ba d7 6c 6c 1d 95 3c f9 c2 96 f6 27 a5 7b 16 a8 2d f4 c8 d5 a2 b1 8f ce 66 10 c6 cb f3 33 6f 3d 46 38 c7 7f c2 b8 0b 5d 0e dd fe ce c8 f1 c7 2c 53 2b 36 df 9b 8f 4a f5 1b 18 a3 b7 d3 fe df 75 2a f9 71 c5 88 95 9b ee a7 72 6b 4c 4c b9 e4 9a d8 e5 cc f1 70 94 a1 cb b2 d2 c7 3f a8 3d b7 87 b4 76 36 d6 ca c3 aa aa fc aa d2 75 c9 fa 9a c1 6b 87 95 7c fb 8d de 6c 91 ab ee 65 f9 79 1f e7 f0 ae d6 f2 3d 2f 52 db bd 76 c4 ac 0c 6b b7 bf a9 1d Data Ascii: AU~kzlU)M8?4:)lcq(~)x4[Lkvwj#_,YwW#q<]JdG}{RfeN25ll<'{-f3o=F8],S+6Ju*qrkLLp?=v6uk\|ley=/Rvk
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: d7 40 ee 16 d5 42 6d 8f e6 fe ef 7e d5 71 8b 95 ae 75 d6 ad 1a 7e ea dc d0 b8 84 79 71 c9 f8 6d fc 7a d6 27 89 b5 09 20 d0 6f 2e 13 fd 65 b4 12 3a ff 00 77 80 7f ad 74 76 b1 49 3e 9e b2 ee e2 45 35 c7 78 e2 da 7b 3d 2e fa 38 ff 00 78 7c b2 7f d9 64 23 9a d6 8d e4 ec fb 9e 75 46 b7 13 c2 37 f1 1d 06 ce 2f f5 4d 1c 00 32 b6 3d 3a fe 35 7a e2 fa 2f b3 e7 cd e5 bf bb 5e 7d e0 b1 2d fc 90 7c d2 79 51 c7 fb cf ee b3 e3 06 ba 59 a2 46 bc 59 e5 75 58 a2 e7 cb 5f d0 57 a3 2a 29 4a c7 9c ea be 56 cd bb 69 62 2b e6 9f 98 b2 9d b5 8b ad df 4a 90 f9 91 37 ee f9 1f 2f cb c9 e9 8a 73 de 49 73 71 e5 08 b6 c5 b7 ef 2b 7c df fd 6a cf 4b 33 7f 36 22 dd 24 ab 21 f9 99 be 48 c0 e3 e5 15 bf 2c 22 ee 73 f3 49 96 74 15 fb 44 98 92 56 60 b8 32 6d f7 e8 bf 5a e9 13 4d 1b be d1 7b Data Ascii: @Bm~qu~yqmz' o.e:wtvI>E5x{=.8x\|d#uF7/M2=:5z/^}-\|yQYFYuX_W*)JVib+J7/sIsq+\|jK36"$!H,"sItDV`2mZM{
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 7c 0c bf 75 5f b8 fc 45 61 4d 75 2b 5c 5b 79 7f 75 a5 21 99 7d 19 73 cf e2 b4 cf ed 18 e7 85 ad 0e e6 58 ff 00 d5 b0 ea a6 b3 2d d6 7b 2b 19 a4 3b b7 45 72 66 6f f6 93 3d bf e0 35 e5 d5 7e d2 4d fe 1e a7 a1 42 9a 84 7d e5 f3 3a 95 2e f0 c5 bd 96 4d df 26 e6 fb cb dc 54 1a a8 58 a3 8a 70 bb 55 9c 46 db bf 87 8f f1 a8 a3 96 4f b3 a9 0b bb 77 ce b5 66 39 bc ed f6 52 f4 65 3b 5b fb d8 e4 35 70 46 95 4e 65 a1 ab a9 18 3b 5c 59 0e fb 59 23 8f ef 6d 3b 5b df 1c 57 13 e2 c6 8a e6 3b 6b 0e d7 1f be 92 36 6d ad f2 9d a8 87 3d 33 8e 7e 86 ba 3d 3f 50 49 6e ae 86 ef dd c5 26 c5 6f e1 63 81 91 f8 1e 2b 91 b7 8e e2 e3 c5 1a ad c4 ab e6 43 15 d9 86 0f e2 66 27 f7 8d c7 b1 6c 57 b7 93 61 dc 2a 4a 53 5b 24 ce 4c 65 67 28 2e 5e a5 fd 2f 4d 17 37 4b fe 8d e5 34 b8 1b bf 81 Data Ascii: \|u_EaMu+\[yu!}sX-{+;Erfo=5~MB}:.M&TXpUFOwf9Re;[5pFNe;\YY#m;[W;k6m=3~=?PIn&oc+Cf'lWa*JS[$Leg(.^/M7K4
2025-02-27 08:47:52 UTC	16067	IN	Data Raw: 6b 89 69 5e 3b 75 b7 81 55 63 eb f2 fb d6 f7 c3 13 2c 1a d4 97 a3 76 62 8c 85 db ea 78 c5 71 e6 54 fd a6 1a 77 d1 1c 4a 8c e9 56 4e 3b bd 11 f4 9d 9d 92 49 a4 aa c5 b7 12 21 ff 00 3f 9d 70 3f 13 35 0b 0b 1d 3e ce da ee 2f dc e9 ac 64 91 55 be f3 9c ed 15 d4 68 fa 8c b6 da 7a 9b 95 f2 e4 58 fe 55 dd b9 97 da bc 7b e3 ad d5 c4 ba f5 b1 f9 be cf 3c 6d 24 8b fc 3b c1 eb 5f 13 96 e5 ca 58 a4 9b dc 72 c6 d4 e5 e5 82 bb ec 76 1f 0a 35 ab cd 56 39 75 0b dd ca 3c dc 45 1a e1 42 8f 6a e9 bc 41 6e 75 29 a3 93 fd 64 4c c4 49 b7 f8 72 36 8e 3e 8c d5 e5 7e 0b d5 ee 21 85 b4 fb 7f 95 a3 8d 4f de f5 ae f6 c6 f6 4b 38 64 94 ff 00 0a 83 bb 76 df c6 b3 c7 50 72 c5 4b 95 7b a8 f5 63 86 9e 16 82 9c dd a7 24 9a fb 88 7e 2a 78 92 2b 06 d2 7c 2d 66 bb 8c b2 45 25 cb 7d ef 93 3f Data Ascii: ki^;uUc,vbxqTwJVN;I!?p?5>/dUhzXU{<m$;_Xrv5V9u<EBjAnu)dLIr6>~!OK8dvPrK{c$~*x+\|-fE%}?
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 95 f5 38 58 2a 34 d5 45 d4 ca 96 19 e2 f1 1e ca da 47 7f eb cc d1 d2 6d c9 91 63 53 b4 46 b8 2d fd da ec 74 9b 58 a3 da 6d a2 f9 b6 e3 73 7f cb 43 fd 31 d6 a8 43 2d b4 ba 6c 16 d6 d6 6a b1 c5 82 de 5a fe f2 47 ee cc 7b e2 b4 95 89 85 7c bf 97 72 90 aa ad b5 98 63 fa d7 3d 49 b7 64 7d 6c ed 08 c6 31 d1 fa 9a b6 71 5b c7 0b 79 72 ac ec b9 dd b7 f8 9c f5 ae 9f c0 36 4e 23 cc ac cd 2c bc c9 22 ff 00 0f b0 ae 03 41 96 63 ad 49 13 db 79 71 f9 04 34 8b f3 6d ff 00 f5 d7 aa 78 2d 3c b8 57 0d cc 9c af cd f7 78 af 37 19 2e 58 fa 9c b6 71 95 99 b3 72 f1 5a 2c 61 22 65 8d be eb 2f ae 2a bd 85 ec 93 ea 0d 6d 24 0a d0 c4 bf 34 8d fc 24 f6 fa d4 3e 30 b5 b8 37 16 b2 24 ad f6 78 e4 cb 79 5f 36 ee dd 3d aa db 2c 76 d6 b1 49 1d 9e d8 e5 94 27 96 df 7b e6 ee 6b c5 71 4d dc Data Ascii: 8X4EGmcSF-tXmsC1C-ljZG{\|rc=Id}l1q[yr6N#,"AcIyq4mx-<Wx7.XqrZ,a"e/m$4$>07$xy_6=,vI'{kqM
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 3e c2 ab e9 b3 c8 d1 ef 8d 76 ab 72 df e7 bd 67 4d 75 1c b2 7c 8d b8 55 fb 37 48 63 58 d1 59 bf d9 af 8c c4 4e 75 6b 39 4b 73 db 8f 2c 12 8c 76 3d 3b c2 ed a2 dc 68 ed fd a1 78 b1 dc 71 b7 73 7d d0 3a 56 66 a9 6b 6f 72 b2 01 3c 0a bc 85 fd e7 cc c3 e8 05 72 8d aa 25 b5 ae f9 7e 6d bf 75 57 ef 7d 2b 9a fe db bf 9b 54 69 f7 49 18 fb 91 b6 ed bf 90 fe b5 d7 80 c3 a9 39 54 9e 89 75 32 a9 5a 7f 0a d4 dd f1 36 92 e6 48 ef 1e 06 92 4b 69 e3 2c ca bf 33 00 70 df 89 53 5b fa 7e 80 21 d2 fe d7 a8 6a b6 36 b6 cd fe ae 3d db e6 61 fe e0 ae 2d af dd 61 c9 66 65 66 fb cc d5 63 4b 4b bb e9 37 c7 ba 30 cd f3 57 a5 5b 30 94 22 94 5e c4 72 f5 7b 9b 37 33 d9 3c d1 c5 02 c9 f2 c9 95 91 ba fe 95 5b c4 5a cc 56 56 ed 04 6b 04 93 7f b4 a1 b6 8f 5e 73 59 9a de aa 34 e8 64 b7 b4 Data Ascii: >vrgMu\|U7HcXYNuk9Ks,v=;hxqs}:Vfkor<r%~muW}+TiI9Tu2Z6HKi,3pS[~!j6=a-afefcKK70W[0"^r{73<[ZVVk^sY4d

Timestamp	Bytes transferred	Direction	Data
2025-02-27 08:47:51 UTC	346	OUT	GET /th?id=OADD2.10239363862712_1Y28E27W0AUV6JWOD&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2025-02-27 08:47:51 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 416666 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 26CCDDA2E7CB49E2A9AFEEAA5EBD579A Ref B: EWR30EDGE0814 Ref C: 2025-02-27T08:47:51Z Date: Thu, 27 Feb 2025 08:47:51 GMT Connection: close
2025-02-27 08:47:51 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 30 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 30 3a 31 38 20 30 38 3a 30 37 3a 35 39 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.0 (Windows)2023:10:18 08:07:598C
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 00 a5 db 9e 69 73 0f 94 8b 07 af 7a 31 52 ec cf 7a 36 61 b1 4f 9d 07 29 18 18 a3 9a 93 69 a3 6d 4f 30 58 8d ba d1 ef 52 63 3d a9 a5 69 dd 0e c2 03 da 97 3f 9d 1b 69 08 f4 a4 21 41 c5 3b f9 53 69 32 57 a5 1c b7 0b 92 8c 50 c0 0a 8b 75 2e 4f 04 d4 b8 b2 b9 95 87 e0 71 8a 31 f2 d3 33 9e 4d 39 4d 16 b0 5d 30 c1 a5 da 7d 29 54 fc d8 cd 3b 23 b5 21 e8 47 b3 da 9a 52 a7 c1 a5 03 d7 bd 2e 66 87 ca 8a fe 5e 78 c7 5a 8c c2 bd c7 7a ba 10 1e ab 48 51 4f 5a 15 46 83 d9 a2 8f 90 87 b7 e9 4d 36 d1 9e dc d5 f3 18 3d 38 a6 79 5e 86 b4 55 9f 73 3f 65 e4 51 fb 28 0b c6 ee 69 0d ab 0e 41 cd 5f f2 98 35 01 0e ec 9a d3 db cb b9 3e c6 3d 8a 0b 04 83 a5 3d 52 4e e2 ae 32 62 80 a7 d2 8f 6c de e2 f6 29 6c 55 56 65 ea 0d 3b 27 d6 ad 71 e9 4e da a7 a8 ac dd 55 d8 d1 53 f3 2b 07 1d Data Ascii: isz1Rz6aO)imO0XRc=i?i!A;Si2WPu.Oq13M9M]0})T;#!GR.f^xZzHQOZFM6=8y^Us?eQ(iA_5>==RN2bl)lUVe;'qNUS+
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: a7 6d a6 62 98 85 dd 40 e2 9b b4 fa d0 32 28 b0 0f 52 0f 22 94 1c 54 63 d2 9c 0e 29 01 25 1d 69 b4 ec e2 80 0f a5 18 14 e1 cd 28 14 ae 91 5c a4 44 51 b4 d4 db 7d a9 76 52 f6 91 5d 47 ca df 42 ab 2d 35 96 ae f9 60 d3 4c 4b d2 a7 db 45 0f d9 49 94 8a fc bc 53 0a 9e bb 6a ff 00 96 b4 9e 50 1d 28 55 d0 fd 93 28 94 3d 28 ab 9b 00 a2 97 d6 07 ec 4c 86 27 b5 31 89 3d e9 c7 9a 42 3d 2b bb ea cf b1 c9 ed d3 22 20 9a 6d 4c 57 34 dd 99 a5 ec 1a 0f 6a 88 e8 d9 9a 93 61 a5 c1 15 9b a6 d1 4a 68 88 26 29 54 54 a1 73 4e 54 c7 15 ac 22 c9 94 90 e8 b8 eb 53 25 32 35 cd 4b 18 f5 ad 95 3b 99 39 d8 70 cf 5a 77 f0 d0 a3 1c d3 b6 d3 f6 22 f6 c4 32 26 6a 16 8f 15 6c a8 34 8c 80 f1 4f d9 f9 0b da 15 57 8a 7a d3 fc bf 4a 36 62 8f 64 1e d0 17 34 fe b4 c5 5c 54 98 c5 52 a4 4f b5 1a Data Ascii: mb@2(R"Tc)%i(\DQ}vR]GB-5`LKEISjP(U(=(L'1=B=+" mLW4jaJh&)TTsNT"S%25K;9pZw"2&jl4OWzJ6bd4\TRO
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 8c 9c e0 55 7b ab db 1b 1d 3a 73 2d bd c2 2d a4 9c c8 91 ff 00 ad 70 72 30 41 27 19 c1 c9 c0 c0 ef 4f f0 ee a7 a1 4f e2 8b 5d 4f 5b d3 ae 75 2b 4b 78 d3 cc b6 6b c1 1a 85 53 9d 9e 60 07 68 1d 30 40 e3 d3 83 55 87 d5 b7 2f bf 72 e1 59 5f 53 d2 fe 06 fc 25 b6 d5 3c 36 3c 51 ad dc 5b 2e 93 0c f1 1d 49 65 65 dd 04 0d 1e f0 e1 41 39 90 9e 31 9d ca 0e 7a f1 5e a9 ff 00 0b 93 e1 af 85 74 b1 a0 78 7e da f2 ee cb 47 84 43 6e 62 01 16 7d a4 83 b5 8e 4b 13 f7 8b 1c 12 49 f5 af 9e 7c 65 f1 6e e3 4d d5 22 97 c1 93 dd e8 85 e2 37 17 10 25 d0 9a d4 c8 58 94 31 2e 08 52 8b b2 30 41 3b 82 e4 f2 4e 38 dd 2e f3 57 d4 1c 5b 41 6d 75 73 3c e0 bc 91 c5 09 39 62 46 08 fa 6e 53 9e 9f 30 f5 af 51 c6 7c 97 8a 3b 21 53 f9 4f a6 75 ff 00 da 36 d4 5a b7 f6 46 80 d1 cb e7 61 1a e6 50 Data Ascii: U{:s--pr0A'OO]O[u+KxkS`h0@U/rY_S%<6<Q[.IeeA91z^tx~GCnb}KI\|enM"7%X1.R0A;N8.W[Amus<9bFnS0Q\|;!SOu6ZFaP
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: e7 4d 82 58 e2 d5 22 64 2b 62 a0 c3 1d ce e8 fc d9 16 29 18 a8 67 8f 8c a9 e7 91 d7 3c 79 8c 16 ec f6 6f 22 d8 48 d0 44 e3 cc 90 48 48 0c 70 00 62 73 82 7d 0e 2b d8 be 1f f8 7b e2 37 c4 bf 87 36 7a 3a f8 96 53 e1 fb 59 e4 b8 48 b5 02 15 5e 71 2b 09 04 4f 18 67 7c 06 5c 97 23 1e 60 c0 20 64 f3 df 12 fc 05 af fc 3b b9 b9 d0 ee 62 b6 68 ef b4 bf b6 48 d0 ea 26 48 b6 c1 38 25 97 e5 52 c4 65 46 c3 c8 c9 39 e3 15 49 7b a4 b4 d4 9d ce 1d ad 25 17 4b 04 76 77 5f 68 9f 29 6f 0a 42 e5 e5 c0 e4 2a 8e 4e 3d 45 42 da 9b 5b 4c b6 fb e1 b9 80 00 a5 13 90 ea 40 25 5b 20 67 1d 3f 3f ad 6e 78 7f 4c d5 da e3 cc b7 f1 03 69 5a c3 44 ed 02 de 6f 8f cd 89 d0 b0 58 e5 e4 ae e1 9e 4e 10 ab 0c 91 92 4f 33 6b 04 9f 69 26 e4 17 7c 95 da 4e 4f fd f5 c8 e3 d4 54 38 2b 6a 65 28 df 73 Data Ascii: MX"d+b)g<yo"HDHHpbs}+{76z:SYH^q+Og\|\#` d;bhH&H8%ReF9I{%Kvw_h)oB*N=EB[L@%[ g??nxLiZDoXNO3ki&\|NOT8+je(s
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 1b db 4d 25 c4 24 c9 24 72 a8 7d c3 20 12 c6 40 c3 23 9e 3a e4 e6 b8 4b 24 c7 8b 2c b5 93 73 28 9a f1 05 b3 46 96 92 39 37 6a 3c 90 55 72 0a ba f2 d8 62 30 47 04 8c d7 7f 1e b9 71 2c 2e 34 8b 3d 42 77 8e dc b3 a5 ed ec d7 2b b6 35 1e 73 ac 68 59 93 01 b2 ce c7 71 ef 8c e6 b3 f5 79 6f 6e 6d 6d 3c 4b 67 71 25 aa 5d 39 8e 29 24 bb 68 e0 98 b6 14 31 0c 3e f6 37 e0 04 3c 67 93 92 6a 7e af 78 ad 6e d7 e4 11 c4 59 bb ad 1f e6 74 fe 39 6d 3e d3 e1 c5 8f 83 74 bd 52 29 1c 04 6d 42 55 26 48 e6 76 62 59 f6 e4 00 37 72 17 fd 9e 33 df 97 d6 b5 1b 48 0c 6f 73 24 7b 81 39 6f 24 96 76 23 96 89 3a 06 3e a4 80 33 d0 d6 1f 8c f5 f8 ff 00 b5 be c9 37 88 2e ec ae 0a bc 9f 68 fb 38 9e 26 24 60 23 c0 b8 2a 70 72 30 4b 60 76 ce 6a d5 e4 32 db 43 f6 8b 28 25 16 ed 1a b3 f9 36 8b Data Ascii: M%$$r} @#:K$,s(F97j<Urb0Gq,.4=Bw+5shYqyonmm<Kgq%]9)$h1>7<gj~xnYt9m>tR)mBU&HvbY7r3Hos${9o$v#:>37.h8&$`#*pr0K`vj2C(%6
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: b5 35 a2 b3 45 e1 bd 20 06 56 ca 4b 75 26 ef 35 30 41 ca a8 ca 90 70 73 9c f1 ef c6 1c d2 ea 54 a5 18 ee cf a5 b8 55 04 c7 80 7d a9 ca eb c9 d9 80 a3 27 d8 0a f8 0e 2f 8e de 2c d2 b5 59 ef 20 f1 05 f4 ad 2c ac e1 2e 6e 0c 91 aa b7 55 55 27 83 c9 1b 87 22 af eb 1f 1d fc 49 e2 9b 57 b5 fb 65 e4 56 01 99 9a d1 35 00 23 55 24 90 ac c7 e7 60 37 63 24 e4 8e b9 c0 a1 c6 56 bd 8c bd aa e8 8f 68 fd aa 3c 45 e1 ed 6b c4 1e 15 ba b3 92 2d 52 0d 1c 4b 79 7b 6c a3 e6 0b be 23 b5 81 1f 29 60 a7 83 d6 ba ff 00 17 7c 60 d3 3c 5f fd 97 e1 7f 02 78 86 4d 3b 51 d6 2e 62 55 b9 9a 2d a2 d9 59 19 ca 80 48 05 97 6e 19 41 07 a0 04 e7 8f 98 2c 25 53 f0 ef 5d d6 21 b9 8a 77 86 29 d9 94 12 55 4a 2a e5 41 20 64 fc dd 46 54 9e e7 ad 70 96 b7 ba 9c ab 6b a9 5a 3b 2a cc ee aa b1 c4 59 Data Ascii: 5E VKu&50ApsTU}'/,Y ,.nUU'"IWeV5#U$`7c$Vh<Ek-RKy{l#)`\|`<_xM;Q.bU-YHnA,%S]!w)UJA dFTpkZ;Y
2025-02-27 08:47:52 UTC	16067	IN	Data Raw: 84 5e e2 68 f5 6d 2b 46 80 c6 20 08 21 75 91 e4 13 45 76 c4 f0 1a 30 a1 41 04 92 46 07 04 83 e0 7c d7 57 7f 14 b5 8d 6f 59 bb b9 9e eb 4c f0 f2 8b 97 9c 05 c3 19 37 48 15 47 dd 50 22 c0 1c 60 0e 83 9a d6 eb 5d 7a 7e 7f f0 e7 3e ae 5c ad 6b 7f c8 f2 3f 8d 37 d2 6a 1e 2c d6 2e a5 80 47 24 da 94 aa d1 ac a1 c2 ec 3b 30 18 60 36 36 e3 20 62 bd 5f f6 2f 8e 38 be 07 83 1f 12 4b ac 5d b4 c7 1f 79 81 50 33 f4 00 75 af 0e f1 7c 97 37 77 8b 2f ca b7 17 2a d2 10 7a 6e 72 5c e7 3c 75 35 ee 3f b1 24 17 6d f0 5a 56 b8 28 63 3a bc fe 49 1d 4f ca 9b b3 ed 9a c6 4d 25 bf 5f f3 37 b3 75 3e 47 ab 8b 95 5b a4 81 ce df 35 49 8c 9e 8c c3 aa 8e d9 03 9c 75 23 e8 69 eb 70 af 3b db ac e1 64 5c 02 03 0d c0 91 90 30 7b e3 9e 9d e9 9a 95 94 b3 5a b4 42 de 1b 98 c8 1b e0 90 81 bf 07 Data Ascii: ^hm+F !uEv0AF\|WoYL7HGP"`]z~>\k?7j,.G$;0`66 b_/8K]yP3u\|7w/*znr\<u5?$mZV(c:IOM%_7u>G[5Iu#ip;d\0{ZB
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: f6 10 cb 22 ac 88 40 38 32 34 64 61 98 90 4e 0e 79 1d f3 51 fc 44 f0 26 87 a1 7f 63 ea b1 68 fa 64 37 56 51 bc 51 49 6d 6e 63 79 ce 14 09 1d 83 83 24 8a 79 cb a7 3b cf 5c 0c 4b 33 cf a0 7c 3d 36 d2 fe ee ea 1b b7 08 ed 96 31 6f 90 91 b8 0e e0 fa 75 18 f5 a5 d6 65 95 bc 16 2f b5 99 26 bb ba 99 44 10 c6 d9 52 aa 48 24 e0 f2 32 78 cf 50 0f bd 2a 35 a1 ec 39 39 6e ed b9 8d 58 4b db c9 df 43 cf bc 45 a8 68 8e d1 5a de 8f b7 c9 75 28 49 ad a2 81 a5 31 28 c0 1b a3 40 0c 83 3f c3 90 58 0f 73 55 af 35 3b a1 a4 68 1a e7 91 1d 95 c2 5d 06 64 8a 46 55 59 63 62 bc 17 e5 72 57 38 3c 2f 03 b5 3b c1 9a 8a e9 de 3e b1 d4 34 e9 7f b3 a6 0e e1 66 6b 71 20 dc c1 93 71 52 70 c1 b3 d3 23 00 fb 56 e7 c4 d5 ba b7 d5 b4 eb 9d 5f 4e d3 45 cd ad d2 1b 9b 68 23 09 68 59 48 04 05 04 Data Ascii: "@824daNyQD&chd7VQQImncy$y;\K3\|=61oue/&DRH$2xP*599nXKCEhZu(I1(@?XsU5;h]dFUYcbrW8</;>4fkq qRp#V_NEh#hYH
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: be 21 2e 22 b7 93 64 f3 cc 24 d8 cc 30 1c 90 47 1f 36 30 3e 6d d8 0b 92 2a cf 89 35 2b 68 ad ae f4 2b 3b 7f 24 47 10 8c 4b 69 11 58 e1 66 08 4b 2a e0 13 80 7a 9e 84 82 31 ce 4c 2c 61 43 09 56 9e 26 4e 2e 7e 77 7a 74 de fb fc 4d a7 7d b7 2a 70 93 a8 96 ea c7 9f ea 83 45 81 24 b6 54 29 6a 76 17 c3 14 f3 b0 72 30 14 7c db 70 40 24 e4 f5 e3 93 5b da fe a5 0e a7 1a 5f cf 2b ea 90 da db a3 49 2c b1 04 90 88 c1 21 54 0e 36 09 18 9f 7d be c7 35 be c3 2c 56 eb 04 f3 16 77 40 23 11 48 38 ce 41 52 c4 12 c3 3c 60 60 13 eb c9 ac e1 a8 34 77 23 4e 9a cb cb 72 42 9b 85 05 82 00 0a 83 8e 84 11 9e 99 1c e3 d6 be 7e 9d 59 45 7b 8d bf 98 4e f1 67 a1 fe cf fe 2b 8f 40 be ba d3 b4 bb bb e8 f5 4d 59 8c d2 b5 bc 4a f1 db 44 06 51 18 f6 27 e7 24 91 c1 03 d4 57 a9 ff 00 c2 c4 f1 Data Ascii: !."d$0G60>m5+h+;$GKiXfKz1L,aCV&N.~wztM}*pE$T)jvr0\|p@$[_+I,!T6}5,Vw@#H8AR<``4w#NrB~YE{Ng+@MYJDQ'$W

Timestamp	Bytes transferred	Direction	Data
2025-02-27 08:47:51 UTC	375	OUT	GET /th?id=OADD2.10239363862713_1RWXDD5HJIZYGFTRH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2025-02-27 08:47:52 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 432769 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 8679D572E80A45D4A6469C23B2B47594 Ref B: EWR30EDGE1021 Ref C: 2025-02-27T08:47:51Z Date: Thu, 27 Feb 2025 08:47:51 GMT Connection: close
2025-02-27 08:47:52 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 30 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 30 3a 31 38 20 30 38 3a 30 37 3a 31 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.0 (Windows)2023:10:18 08:07:158C
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: f3 a9 3c d1 d4 d1 a8 68 5a ce 69 09 03 ad 57 f3 41 e6 93 cd 14 ac c2 e8 b0 58 52 97 c5 56 f3 05 2e fe d9 a4 e2 ca 52 45 8d f4 9e 65 43 e6 62 9b e6 54 f2 b0 e6 27 2f 48 5c 54 3b f3 48 5a a7 91 8f 9c 95 9f 1d 2a 36 6a 6e ea 63 30 ed 4d 40 4e 63 d9 a9 a5 b1 4c 2d 4c 6f 6a b5 03 37 31 cc f4 c6 73 48 79 a4 c5 5f 29 0e 42 33 9e f4 d6 73 dc 9a 30 77 53 59 4d 3e 51 5c 43 21 1d 69 8e e6 9c ea 45 46 dc 73 56 a2 89 e6 63 5e 4c 77 a8 9e 53 4b 27 7a 85 c1 35 a4 60 88 94 9a 09 26 35 0b be 29 ce 2a 16 15 ac 62 8c dc 86 bc 9f 9d 43 23 93 d6 a4 70 6a 36 43 d6 b4 51 21 b3 d7 04 8a 7b 51 b9 0d 60 c3 7e e7 19 35 66 3b c6 3c d7 8b ec 24 8f 5d 56 8c 8d 65 75 f5 a3 cc 1d ab 39 6e 4d 3b ed 07 fb b5 4a 9b 17 b4 46 87 9b 8e f4 79 c7 d6 a8 1b 9f 55 a4 37 20 f1 8a d6 34 6e 43 ac 8d Data Ascii: <hZiWAXRV.REeCbT'/H\T;HZ6jnc0M@NcL-Loj71sHy_)B3s0wSYM>Q\C!iEFsVc^LwSK'z5`&5)bC#pj6CQ!{Q`~5f;<$]Veu9nM;JFyU7 4nC
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 72 07 35 a3 1d de 9e f7 86 ce 3b fb 67 b8 5d d9 89 65 52 e3 68 52 72 33 9e 03 a9 ff 00 81 0f 5a f8 2f 45 d7 35 7f b4 16 ba bf 86 e5 7b c2 f9 3c fb 1e 99 fc 6b a4 b7 d6 ef 2d b5 55 9d 2f 76 6f 52 4b c6 4f 98 48 c1 da 58 1c 75 00 e7 9e 9e d5 d8 f1 d3 83 e5 94 7e ef f8 60 e7 77 b1 f6 d1 85 82 e7 07 8e 0d 37 65 7c 7a 7e 20 78 9a 0d 7a 3b f8 35 cd 41 2e df e7 13 99 09 de 02 ed cb 29 38 6e 80 64 8e 95 ea bf 0f be 36 5c de 6b 16 76 fe 25 b8 86 d2 c4 44 be 75 ca da 97 79 4a 86 04 b6 0f ca 59 8a 9c 81 80 14 fa d6 d1 c6 d3 7b e8 69 aa dc f6 d0 94 e5 4e f5 83 e1 8f 1a 78 6b 5c d1 1b 55 b6 d5 21 86 08 d5 da 55 b8 95 63 78 95 4e 0b 30 27 80 78 3f 88 f5 19 e5 fe 23 7c 67 f0 d6 87 a4 dd 0d 0a 51 ab 6a 11 e1 51 53 2b 10 05 73 e6 6f 23 0c 14 91 c7 73 9f 4a d2 75 e9 c5 6a Data Ascii: r5;g]eRhRr3Z/E5{<k-U/voRKOHXu~`w7e\|z~ xz;5A.)8nd6\kv%DuyJY{iNxk\U!UcxN0'x?#\|gQjQS+so#sJuj
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: d9 d1 b3 ed fd 68 c4 a1 dc 90 11 4a 82 80 12 4e 7d cf 5f c2 b3 e0 b6 bb 8d bc d8 9d 4f 3f c1 d3 f2 e6 ad d9 de ce 6e 0c 4f 1e 19 b3 e5 97 5c 8f 52 a0 02 07 d0 73 5a c6 51 6e cc 96 9a 27 52 4b 0d d2 85 28 a3 ee e3 86 f6 3d 41 e0 d7 a4 78 37 e3 1f 8a 34 8b 78 ac f5 18 ad 75 ab 78 b0 a0 dc b1 59 f6 e3 80 25 1d 7d 8b 29 35 e6 79 91 99 9d ca 91 ca 93 83 1e 0e 31 d3 9f 4f 6c 73 56 2c ed d1 63 73 2b c7 b4 93 85 ce 31 9e 98 c0 ff 00 0a 55 29 42 71 b4 90 e1 52 70 77 4c fa 83 c0 5f 10 fc 27 e2 c9 23 b6 b6 bb 36 1a 8c 9c 0b 1b dc 23 b9 f4 8d 81 da ff 00 40 77 7b 57 58 f6 a5 5b 04 57 c6 bf 66 8c 65 8c 80 f2 08 f9 ba f7 18 c8 e0 f4 e4 73 5e ad f0 d3 e3 2e af a1 d9 ad 8f 88 e3 7d 72 ca 34 1e 5c c2 50 2e a1 5f 42 c7 89 00 1f de c1 1e bd ab c9 c4 e5 cd 6b 4f ee 3d 1a 18 Data Ascii: hJN}_O?nO\RsZQn'RK(=Ax74xuxY%})5y1OlsV,cs+1U)BqRpwL_'#6#@w{WX[Wfes^.}r4\P._BkO=
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 13 5a b9 8f 46 86 cd 6d 94 86 8e 38 e4 95 94 e3 19 0d 23 f1 c1 e3 82 41 39 e9 c6 79 ab 53 82 f7 a3 2b 21 72 bb 5e c7 a9 78 0f e2 c7 c3 1d 2b 4f 8e fc f8 3c 1d 59 91 04 b7 46 31 e6 4a c5 49 6c 37 f0 80 c7 00 75 c1 27 8e 95 d3 f8 63 e2 0c da d8 b6 d4 35 59 f4 a1 69 1c 8d 79 1d 82 4c 3c c0 03 2a 2a b2 b3 97 2e 19 89 19 01 54 7f 0b 1e 47 86 59 f8 72 09 20 96 7d 43 54 d2 55 ad 7c b5 5b 44 99 99 dc b8 c6 e5 65 46 f9 17 39 66 e7 00 1e 09 c0 3d 57 85 fe 06 36 bf a0 7f 6d f8 7f c4 b1 dd 1f 35 e2 32 a4 6d 6e e6 54 18 c2 e4 e1 78 c1 c3 05 38 6c f0 78 a5 87 a9 52 7b a5 6f 53 25 52 77 b5 cf a3 b4 3d 5e f3 51 d2 d6 fa e2 c2 4b 25 95 89 86 39 1f 2e d1 ff 00 0b 91 81 b7 70 e7 1d 40 23 f0 e7 3e 25 f8 cb 56 d1 21 5f ec 0b 2b 5d 46 e6 17 43 73 6f 71 29 8f 2a df 75 55 81 18 Data Ascii: ZFm8#A9yS+!r^x+O<YF1JIl7u'c5YiyL<*.TGYr }CTU\|[DeF9f=W6m52mnTx8lxR{oS%Rw=^QK%9.p@#>%V!_+]FCsoq)uU
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 70 49 70 63 23 08 ab ea 32 0a fa 1e fc 8c 63 eb 4d c9 2d 12 15 9b 29 d9 5a c8 f0 b0 8e 39 23 59 24 01 98 2e f9 36 93 c6 e3 c9 51 db dc d3 63 b8 c6 ab 2c 76 e3 31 41 17 47 04 2a 63 d0 03 cf af 3c 8f 7a b5 73 7c e2 49 ad 2c ad e4 89 a5 25 5e 32 43 03 90 0e e6 e3 20 83 ce 7b 0a ad a9 42 f6 16 a2 d6 4d d2 35 c6 24 33 13 85 dd dc 80 73 90 00 c6 38 fd 69 29 68 32 2b 53 62 21 9e e6 fa 29 ae f1 0e db 60 66 f2 f6 82 70 19 86 0f 3e d9 e9 eb 59 ea a6 e6 e1 c2 42 15 9c 00 76 0c 81 91 c0 03 d7 bf f8 54 b2 5a 5c df dc 33 b6 d5 49 0f ca 09 c1 60 3b 01 e9 c5 5f 55 8e 38 85 9c 01 55 70 73 b4 72 4f 5f e7 d2 a2 53 b0 bd 46 e9 5a 44 71 c2 5e 6d a6 38 db 18 0d 90 08 ea 09 ee 7f 41 ef 57 ae 49 93 62 84 c4 69 d4 28 da 01 03 a8 3f e7 af bd 3f 0b 0d b3 c0 9e 4a e7 01 ba 1f 28 11 Data Ascii: pIpc#2cM-)Z9#Y$.6Qc,v1AG*c<zs\|I,%^2C {BM5$3s8i)h2+Sb!)`fp>YBvTZ\3I`;_U8UpsrO_SFZDq^m8AWIbi(??J(
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 3e b5 a8 1b db c2 80 dd 5c c9 2e 64 72 01 c7 3e 9c 63 93 80 3f 2a e3 c5 4a 34 e0 a2 b7 fc 8d fe b1 39 6d a3 3a 0f 8a da f6 ab e3 cf 11 47 aa 6a b3 ad bb 9f dd 01 66 bb 63 89 41 38 dd 93 f3 1f 72 49 c6 07 61 5e 6f e2 bd 06 fa 3d f7 16 2f 77 73 0a 60 b4 8f 19 0a 7d 31 8e 3f 5a b5 7d ac ea 32 db 34 da 66 96 c9 6d 0b fc c0 a1 2f 92 00 2c 4f a7 41 81 9e d5 9f a9 f8 d7 52 96 33 65 7b 1c 51 4e b2 65 64 48 72 d8 23 05 48 1c 1f 5c f5 06 b9 29 aa ea 57 56 66 71 75 1e ec ec bf 67 69 ee af 75 e9 e2 9a 09 96 4b 4b 39 1a 40 48 11 be 4a 60 a8 5e 09 00 13 83 9c e4 9c f5 ae 57 48 d4 74 db a5 9a de 0b 7f b1 5b 5b 26 ef 3e e5 88 5b 70 4e 37 33 92 0e e2 40 18 19 24 a9 00 71 8a ed be 05 da ea 76 93 6b 17 d7 50 49 6c 20 d1 a5 78 16 58 b0 f8 3b b3 c6 49 5c 9e 72 06 4f e5 5c 5d Data Ascii: >\.dr>c?*J49m:GjfcA8rIa^o=/ws`}1?Z}24fm/,OAR3e{QNedHr#H\)WVfqugiuKK9@HJ`^WHt[[&>[pN73@$qvkPIl xX;I\rO\]
2025-02-27 08:47:52 UTC	16067	IN	Data Raw: 87 af a4 1a 3c 0d 2d a4 b6 92 48 81 a4 82 79 c4 b2 23 1e a1 98 12 18 fb 82 41 ac 25 0a 8d 6e 75 d3 95 1e 6d 16 a6 e8 5c 2e 14 01 48 d0 b3 7d e6 35 9f fd a3 ef 4b fd a0 de b5 0a 94 cd bd a4 3b 97 d6 dd 43 64 e4 d4 8b 18 1c 0f e7 59 7f 6f 6f ef 50 75 06 fe fd 0e 95 46 1e d6 08 d7 58 fd c0 fc 69 ea 8b ff 00 3d 00 ac 4f b6 b1 fe 3a 4f b6 93 c6 fa 87 87 9b 1f b6 81 bc 16 3e f2 8a 3f d1 c2 ff 00 ac cd 60 fd b0 9f e3 a5 17 67 fb f5 9b c2 cf b9 4a b4 4d e0 f6 a3 a9 34 a2 5b 51 c7 5a c1 5b bf 7a 5f b5 8a 87 84 97 76 57 b6 89 bf e6 db f6 0b 49 f6 88 07 40 2b 03 ed 8b fd ea 3e d8 3d 6b 3f a9 4b cc 6a b4 4d ff 00 b4 47 d8 0a 5f b5 28 e8 05 73 df 6d 03 f8 a9 0d f6 29 7d 41 b0 fa c4 7b 9f 9f b9 4d a4 31 c3 76 18 ce 7e be 95 19 45 2a 08 71 b8 82 08 c7 6a b2 b6 f8 e4 86 Data Ascii: <-Hy#A%num\.H}5K;CdYooPuFXi=O:O>?`gJM4[QZ[z_vWI@+>=k?KjMG_(sm)}A{M1v~E*qj
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 2b c7 93 8a 71 f2 ff 00 80 77 46 32 6a 4f b9 17 89 f4 e1 17 c5 ef 09 d8 6a 97 93 5f b5 db c7 f6 80 49 89 48 da e0 29 20 83 82 7a 8e 37 02 47 73 5d af 87 64 4b 6f 8c 5e 2c 9c 18 ad a1 b7 d2 ec 23 27 88 e3 89 40 73 80 06 02 80 3b 0a e0 7e 30 6a be 1a b6 f1 f6 85 e2 1f 0c dd 1b bb 6d 26 ee 25 94 bc d2 dc 46 59 4e ff 00 95 9d 8b 1f 94 8e 01 03 af d6 b0 75 1f 10 da 78 8a f3 5e d4 6e e5 bf b6 b8 d5 6e 53 69 86 43 1c 5e 50 1b 42 95 c1 24 81 dc 9d a0 f5 1c 93 50 b1 34 e9 dd c5 5f de bf e0 5c a8 ce 49 6b d1 23 d3 fe 2e f8 b7 4b b9 f8 69 ad 26 9d ab 5b 5d ca 20 52 d1 c5 2f 3b 49 ea 33 ee 07 d3 23 d6 b9 ef 80 b6 3e 4f 88 34 f5 81 02 1b 6f 08 c1 21 75 62 cc 0c d2 ab 92 0f 40 c7 9c 9c 71 db af 1e 77 1c 56 5f d8 ba f7 d8 98 85 5b 65 dd 33 00 77 28 75 38 39 c9 07 e5 3d Data Ascii: +qwF2jOj_IH) z7Gs]dKo^,#'@s;~0jm&%FYNux^nnSiC^PB$P4_\Ik#.Ki&[] R/;I3#>O4o!ub@qwV_[e3w(u89=
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: a7 0e 4e 32 38 53 93 c6 4f 5f 5f a5 5b f1 37 87 ae b5 1d 26 29 62 b9 32 a1 53 34 77 30 c6 ca 15 71 b8 86 53 93 c8 18 ea 4e 4f 6e 95 9b 74 61 38 a6 f4 66 75 2b 45 3b 11 d9 df 26 a3 a3 fd ad a4 96 d4 8c 9c 60 30 24 1c 06 c6 41 60 49 ea 33 8a d6 b5 8a d6 4b 48 ee cc ad 33 34 43 60 03 e4 ce 71 9e 46 79 3c fa f4 fa d5 00 17 4e b5 b5 69 a2 1b ee 23 0d f6 79 23 3b d1 ba a8 2d 81 c9 18 38 03 8f 43 4b 65 a5 df 5c e8 ed a8 c3 24 46 38 70 26 88 9d 8e 09 e4 e5 49 e0 80 41 e4 83 f5 e9 59 4b 91 eb 7b 46 fa 7f 91 34 da 7a c9 e8 6a 89 6d 82 79 09 24 6a b1 93 90 4e dc 9e a3 f0 cf 3c 73 4e b2 91 16 e8 b0 92 46 dc 86 35 8c 4b b9 76 10 46 48 ee 4f 3d 73 d4 74 ae 5b 5b 9e 1f b4 cc 6d 6f 63 48 91 df 86 01 b0 a0 02 02 9c 92 4f 3d c7 18 f7 c5 51 d0 75 4f b3 5a f9 cf 2a cb 24 a4 Data Ascii: N28SO__[7&)b2S4w0qSNOnta8fu+E;&`0$A`I3KH34C`qFy<Ni#y#;-8CKe\$F8p&IAYK{F4zjmy$jN<sNF5KvFHO=st[[mocHO=QuOZ*$

Timestamp	Bytes transferred	Direction	Data
2025-02-27 08:47:52 UTC	346	OUT	GET /th?id=OADD2.10239340418543_1PQIQEA9PYCCTOZ9T&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2025-02-27 08:47:52 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 748526 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 46E394E8A1D841858FCD4F51351BD4FB Ref B: EWR30EDGE1014 Ref C: 2025-02-27T08:47:52Z Date: Thu, 27 Feb 2025 08:47:52 GMT Connection: close
2025-02-27 08:47:52 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 30 20 32 32 3a 35 33 3a 30 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:10 22:53:088C
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 8e da 28 bf dd 7f bb 5e 69 79 69 1a 5e dd 79 7f f3 cb fe 59 57 4f a8 6b 16 ef e1 1d 17 4f b3 f3 be cf a5 da c7 e6 c5 ff 00 3f 12 cb fb c7 6f fd 96 b6 9f be 67 0f 70 ea bc 0f a7 c6 97 ba 7f da 20 f3 6d e2 f3 23 97 f8 df 7b 27 f1 d3 fe 20 45 e4 de fd a2 cf ce f2 ef ed 23 8e 28 a2 83 f8 d7 fd 96 a7 e9 7a b5 93 df 7d b3 cf ff 00 5b e5 f9 5e 6f f7 7e ef df ff 00 e2 a9 fa c6 b1 1c d3 4d 71 67 ff 00 2e 1f f2 cb e4 f3 b7 ef f9 76 7f b3 51 38 1a 18 96 7e 28 d6 af 21 97 4f f2 3f 77 2d ac 76 d2 f9 50 a7 9d b2 a6 f8 77 a8 5b 7f c2 e2 d1 64 92 0f f5 b6 b2 5b 45 2c bf f3 d7 67 cb ff 00 ed 55 0b 7d 4f ce bd 8a f3 50 ff 00 c8 50 ff 00 ab ff 00 7b f8 ab 57 c2 6f f6 cf 8d 1a 2c 91 f9 32 c9 15 84 92 4b e5 7f cb bf f7 aa 21 02 a7 b1 ec da a5 a5 95 cf 87 f5 0d 3e e2 0f 36 39 Data Ascii: (^iyi^yYWOkO?ogp m#{' E#(z}[^o~Mqg.vQ8~(!O?w-vPw[d[E,gU}OPP{Wo,2K!>69
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: cf 37 cb 97 ca ff 00 d9 aa 9f 8b 2f 65 7d 6b 4f d5 24 fd ed c4 b2 fd 9a ea 5f f5 3f ba fb d1 55 0b 7d 42 3f 3a 2b 89 3f 7b 6f 17 99 fe 76 d6 33 81 a4 26 5c f8 98 96 cf a2 cb e6 41 e5 7d 97 fe 9b d6 27 c2 3b 49 26 f1 04 da 84 9e 4c 51 da c5 fe b6 6a bf e2 c7 8d fc 3f 75 1c 9f f3 ca 49 3f e0 72 54 df 0c ff 00 73 e0 5d 56 48 ff 00 d2 ae 2e ae bc b8 a2 ff 00 75 3e f5 5c 3f 86 67 2f 8c ec f4 fb df ec dd 2f cc b7 b1 ff 00 48 96 5f b4 cb 2f 93 ff 00 1f 09 25 60 eb 97 72 43 aa 45 e6 7f ac 97 f7 9e 6d 5f f1 45 ef d8 f4 b8 a4 b7 ff 00 96 b1 7e eb ff 00 b2 ae 57 ed 76 5e 4f 97 ff 00 2c e2 8b ed 3f ec 7f b5 ba 88 40 d2 73 36 2e 2e 24 49 bc bf 3e 69 6d ff 00 d6 79 b2 d3 ec de 47 ff 00 4c 8f c8 fd d7 fc b2 ff 00 9e 89 5c f4 9a c7 d9 bf d1 e3 d2 a6 8a df ca fd ef f7 fe Data Ascii: 7/e}kO$_?U}B?:+?{ov3&\A}';I&LQj?uI?rTs]VH.u>\?g//H_/%`rCEm_E~Wv^O,?@s6..$I>imyGL\
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 44 75 0b cf 23 fd 55 af ee a2 ff 00 9f 8a ce 01 33 cb b4 3b 78 e6 b2 d5 6c e3 ff 00 96 b1 57 19 e1 fb 7f b1 cd a8 47 71 e7 4b fb df 2a 2f 2a bb ff 00 0d db fd 9a f6 2f fb f7 5c de 8f 0f 93 ad 6a 11 db fe eb f7 b2 79 5f f7 df f7 69 c2 7e e1 73 81 8f e2 c7 b6 4f 0f c5 a7 ff 00 cb e7 da bf 7b 17 f1 c6 9b 3f 8a bb ff 00 01 e9 9f 6c f8 55 17 da 20 f3 63 ba 89 e4 8a 28 a1 f9 e3 db f2 57 0d e2 cd 3e 47 d6 a5 92 3f de f9 b7 5e 5f fd 74 da 9b 9a bb 9f d9 ff 00 53 91 3c 23 a8 47 24 f0 f9 76 12 fd a7 f7 bf 72 38 ab 6f b0 73 7d b3 aa d3 ed 2c af 3c 3f 15 bd c7 fa b9 62 fd ef 9b f3 d5 fd 0e de f5 3c 3f 14 77 9f ba b8 b5 97 cb ff 00 bf 7f bb dd ff 00 02 5a ad a5 dc 49 fe b2 38 26 f2 e5 ff 00 9e b0 ff 00 1f fc 0a a8 6b 9a 9d ed b7 89 ff 00 b3 e4 be 9a 2b 3b ab 58 fe cb Data Ascii: Du#U3;xlWGqK//\jy_i~sO{?lU c(W>G?^_tS<#G$vr8os},<?b<?wZI8&k+;X
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: 79 df 67 49 3f d4 cc 9f ec d7 01 a7 dd c7 6d 34 5f 68 83 cd 8f cd fd ec 5f fb 2e ea f5 7f f8 4a 23 b6 fd 9d ff 00 b4 35 48 21 bf bc d6 6e a4 b6 8a 29 61 f9 24 b8 fb bb f6 7f 72 34 fb 95 13 80 42 67 07 e2 0b 79 21 be fe d8 b7 9f ec ba 7d fd d4 9f d9 ff 00 dc b8 fe f7 c9 fe f5 66 eb 0f 1c df bc 8e 7f 36 4f fa 65 fd cf ef 53 2c f5 bb db 68 6d 6c fc f9 a5 b3 8a eb cc f2 bf e0 68 df f7 d7 c9 5a ba c5 bd b5 e7 88 75 58 e3 82 1f b3 cb a8 49 27 fc 01 9f 75 63 f0 9b 15 bc 37 69 a8 cd 0c 36 f6 f7 d0 da c9 2c 5f f3 c7 f7 d1 ed fb df ee 56 6e b9 15 cf f6 2c d2 7e fa ea 39 7f 77 14 bf f4 d7 f8 ab b9 f0 3e 99 25 cc f2 db dc 4f f6 5d 3e 5f f9 6b 2c 3b fc cf bf ff 00 8f 57 4f e0 bb 2f 0e 24 d2 c7 1d 8f 9b ac 58 5a c9 73 2c 57 7f be 4f e0 fd ed 6d 4c 8a 87 6d ae 68 ff 00 Data Ascii: ygI?m4_h_.J#5H!n)a$r4Bgy!}f6OeS,hmlhZuXI'uc7i6,_Vn,~9w>%O]>_k,;WO/$XZs,WOmLmh
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: e7 48 3f d0 35 48 af 23 9e 69 6d ee bf d6 cb ff 00 3e f5 72 e2 ee 4b 69 e5 b8 b8 f3 a2 fd d7 97 e5 56 27 da a3 4b 19 6d ed ff 00 7b 1f 9b fb af 36 6f fd 0a a6 b8 bd 92 e6 68 a3 b7 ff 00 8f 39 65 f3 3f d7 7f ab 7a e2 9c 26 7a 1c f0 2c f9 b6 4f 0f 97 24 f0 f9 9f e7 6d 4d aa 5e ff 00 c4 ce 58 e4 f3 a2 fd d4 7e 54 5e 76 cf f7 6a b6 8f 7b 6d 67 36 b5 24 73 c3 fb a9 63 ff 00 55 ff 00 2d 37 7d df f8 0d 1a 84 bf da b3 45 71 1f d8 ae a3 ff 00 59 2f 9b 32 6f ff 00 ec a9 04 07 c9 69 b3 4b fb 67 9f 34 bf 6a ff 00 96 5f f3 d2 b6 ff 00 d1 bf b6 ad 64 fd fc b1 fd 97 ec df eb bf cf fb b4 fd 42 de d9 3c 3f 69 67 fe aa df cd 8f f7 5f f3 cf fd b5 ae 6e ce f6 47 f3 ad ff 00 e5 a7 ee e3 fd ef dc f9 5e ae 99 15 0d 8b 39 64 bc d6 b5 a8 e4 9e 69 6d ff 00 d1 23 8a 2f f9 f7 f9 3e Data Ascii: H?5H#im>rKiV'Km{6oh9e?z&z,O$mM^X~T^vj{mg6$scU-7}EqY/2oiKg4j_dB<?ig_nG^9dim#/>
2025-02-27 08:47:52 UTC	16384	IN	Data Raw: ae fd 52 f0 5e c5 1c f2 69 77 e6 14 97 ec 6d b3 e7 5d 9f ee d7 0e 2a 15 aa fb bc b7 89 d5 4f d9 42 3e 67 ce fe 20 f8 87 73 e1 58 75 0f 12 5e 79 3f 68 b0 8a 78 fc ab 4f 3b fd 1f 73 ec 85 7c c7 5f bb fe f7 e1 5e 5d e2 cb 8f 0c 5e 78 46 ea f3 c3 fa 56 a9 fd a1 af 5d 79 51 6a ba dc c9 f6 68 fe 7d bf 7b fb be 95 f4 1f c6 0b 5d 7b 47 f8 65 aa f8 9f 47 be be bf b7 fe cf fb 4c be 4c 09 e6 ee f2 76 7c f6 d2 7f ac 8b f8 be 5f bb fc 35 e3 ff 00 05 3e 13 cb 7f e1 18 b1 aa e8 b2 e9 fe 23 d3 d2 3b ff 00 b2 43 f6 87 d2 17 67 cf b3 73 6c fb 44 9f de fe 06 fb d5 e5 fe ef 09 fb fa fe ee b6 38 eb 73 ce 7d ce 43 fe 12 6f 11 f8 1b 54 d4 2f 34 3d 57 fb 52 ce c2 28 ec bf b4 3f d4 d9 dd da c9 0e cd 89 fd df fa 67 fe e5 5c f8 5f e3 0d 47 55 d6 b4 a8 e3 be 87 4b f3 75 08 e3 f3 62 Data Ascii: R^iwm]*OB>g sXu^y?hxO;s\|_^]^xFV]yQjh}{]{GeGLLv\|_5>#;CgslD8s}CoT/4=WR(?g\_GUKub
2025-02-27 08:47:53 UTC	16067	IN	Data Raw: c5 24 bf f2 d6 b3 9d 13 78 63 4e b6 3f 88 5e 2b 4d 6a 2f b1 ff 00 ab f3 7f e3 d7 50 b2 4d 91 c4 bf 2f cd b3 ff 00 65 ad bf 09 fc 43 d2 6f fe d7 71 ac 58 c3 a3 5e 5a ff 00 cb 29 66 7f f4 84 ff 00 a6 5f fc 4d 79 bd bf 85 25 b9 bd 96 38 ef ac a2 93 fe 9a ea 69 0c 32 7f d7 3d ab 53 5c 78 7e f5 26 f2 e4 be f3 64 f3 5e 4f 36 d2 f5 e6 ff 00 d0 d6 b1 9e 17 98 b8 63 67 ce 7a 2e b9 65 65 37 95 26 9f aa f9 b2 45 fb cf b2 7c 9b f7 b7 f0 a5 72 52 3d 92 7f a6 5e 4f 0d d4 91 79 71 f9 52 fd cf fc 7f ff 00 da a3 c3 e9 e2 7b 6f de 7f 6e 59 4b 27 fc b2 96 5d 31 26 9a a6 8f fb 6b c9 f2 e3 d5 6c bc cf 2b fd 6f d8 93 7e ff 00 f7 ba 57 2c 30 d3 81 db f5 98 4c 86 4b 2b 6b 9b 2f 32 df fd 5c bf bb 8a 28 b7 a7 fc 0f 75 33 ec 97 b6 d0 4b 1c 70 59 4b f6 5b a4 fb 55 d4 5f 3f c9 ff 00 Data Ascii: $xcN?^+Mj/PM/eCoqX^Z)f_My%8i2=S\x~&d^O6cgz.ee7&E\|rR=^OyqR{onYK']1&kl+o~W,0LK+k/2\(u3KpYK[U_?
2025-02-27 08:47:53 UTC	16384	IN	Data Raw: 03 f8 3f c4 3e 3a d2 bc 2f 1c f7 bf 67 97 cc fd ef 9d e7 7d 91 7f 87 fd 9f f7 ab e3 f2 9a 33 9d 29 62 f1 9e f7 a9 e8 4e 1c d3 8d 28 93 7c 17 b4 d3 b4 1f 0f eb 5a 3f 88 3c e9 75 cf 16 c5 e6 ea b2 c5 bd 21 b7 b5 fb ff 00 64 f3 13 fe 59 3f 7f fb e6 99 ac 7c 40 d3 a6 f1 04 ba 5c 9a 1c 32 e9 fe 6c 71 c5 6b e4 ff 00 ab b7 8e 1d af ff 00 02 fe 1d ff 00 7a ae 6a 9e 17 b2 ff 00 4a b8 b3 d5 6f 6d 74 79 7f d1 ac 2e ee e6 f9 e4 b7 df f2 36 c5 ff 00 96 6d b3 75 59 b3 f0 fe 81 e4 cb a7 c7 63 0c 51 f9 50 7f aa 9f fd 7c bb 3f 79 f3 7f bd 5f 41 85 a7 3a b3 94 f9 48 c4 c2 10 f7 79 86 68 f6 91 dc f8 63 45 d3 ee 3c ef f4 58 a4 b9 f2 a5 87 7f d9 2e 24 ff 00 96 50 7f 17 fc f3 ff 00 79 ab bf f0 9d c7 8b ed bc 23 77 a1 f8 6e c7 ec 16 f2 fe f3 50 96 29 93 ce 9f 77 c9 fe f6 dd bf Data Ascii: ?>:/g}3)bN(\|Z?<u!dY?\|@\2lqkzjJomty.6muYcQP\|?y_A:HyhcE<X.$Py#wnP)w
2025-02-27 08:47:53 UTC	16384	IN	Data Raw: e7 fd df 9b f6 69 7f e9 a2 2f dd 6a 3c 41 65 1d cf fa 3f fa df 2b f7 92 d6 6f 95 72 f0 c5 1f fc b3 a2 b4 e0 14 e1 32 fe b8 f7 09 3c 5f b8 f3 7c df de 79 b5 67 43 d4 2e 2c 3f eb 9c bf fb 2d 5c d3 ed e2 9a c7 ec f7 1f f6 cb fe 99 ff 00 bb 4c bc b1 fd cf ee ff 00 7b ff 00 4c bf dd ae 5f 6d c8 76 fb 32 85 c6 bb 2f db 7c c9 3f e5 97 fa d9 7f e7 a3 b5 66 eb 9a dc 8f 65 e5 ff 00 cb 48 a2 f2 bf 75 fd cf ee d5 9d 41 76 43 17 97 07 9b 27 9b 59 bf 67 91 ef 3f 77 fb da 7e d0 3d 99 d6 e8 7a 87 db 21 97 50 f2 3f d2 3e 4f 37 fd ca c1 f0 bd bd b4 d7 b7 57 92 7e ea 49 65 fd d7 fd 34 5a 66 96 b6 c9 0c bf 68 ff 00 a6 75 b1 24 b6 56 1f bb 92 0f f9 65 e6 4b ff 00 5c ab 68 7e f6 06 13 9f b2 99 e8 be 03 f0 7e 8b a9 59 5a dc 5c 41 65 75 1f d9 7e d3 e6 fc 8e 91 bb 7c 88 b2 6f fe Data Ascii: i/j<Ae?+or2<_\|ygC.,?-\L{L_mv2/\|?feHuAvC'Yg?w~=z!P?>O7W~Ie4Zfhu$VeK\h~~YZ\Aeu~\|o

Timestamp	Bytes transferred	Direction	Data
2025-02-27 08:47:53 UTC	375	OUT	GET /th?id=OADD2.10239340418544_1U65HGUXV07UFEU5B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2025-02-27 08:47:53 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 800536 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 6095677728D04B328965EA275DB5D657 Ref B: EWR30EDGE0316 Ref C: 2025-02-27T08:47:53Z Date: Thu, 27 Feb 2025 08:47:52 GMT Connection: close
2025-02-27 08:47:53 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1d 62 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 30 20 32 32 3a 35 32 3a 33 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``bExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:10 22:52:388
2025-02-27 08:47:53 UTC	16384	IN	Data Raw: 49 04 92 3c 92 49 73 2a 6c 91 ff 00 87 ee 73 fe 79 ae 47 52 f1 7e ad ff 00 1e b0 6a 57 7e 64 71 79 92 c9 14 bf 3f cd 44 a9 b9 cf dd 12 9a 82 d4 f4 6f 10 5d c1 7b 77 72 f0 5e 7f a2 c7 27 ef 3f bf f3 7f 8d 79 ff 00 8a bc 43 1d c6 9f 1e 9d a7 4d a8 49 04 7f eb 2f 62 8b e4 b8 7f e1 5e d5 91 7c b7 ff 00 64 de 97 97 7e 65 c4 89 fb c9 7f d9 4a 96 d6 c6 7b 7d 26 e5 d2 6f 32 49 23 f2 e4 96 29 77 fe f6 b5 50 e5 49 99 b9 29 e8 65 eb 13 c6 f6 91 d9 24 37 77 3e 5e cf 32 e6 29 53 f8 be 6d ab 57 2d e7 92 d2 19 1e 09 a6 f2 e3 fd e7 97 73 2f f7 7f bb ff 00 c4 d1 e1 1b 39 ee 34 ff 00 b6 f9 30 fe f2 4f de 79 bb 37 ee ff 00 66 b5 2f 96 07 bb d9 3d e4 3e 64 91 fe ef f7 3f eb 2b 5b db 42 21 14 fd e3 de fc 69 73 b3 c3 df da f2 43 34 91 dc 7f c7 cf df ff 00 44 8a 7b 6f 96 4f 93 Data Ascii: I<Is*lsyGR~jW~dqy?Do]{wr^'?yCMI/b^\|d~eJ{}&o2I#)wPI)e$7w>^2)SmW-s/940Oy7f/=>d?+[B!isC4D{oO
2025-02-27 08:47:53 UTC	16384	IN	Data Raw: 71 24 51 fc b1 af cb f7 ff 00 da fe 26 e9 ba b8 31 b8 65 3c 4c 22 e2 ed a5 fc 87 86 8b 9c 6e 8e c7 c4 fa 55 d2 f8 47 5b d2 7c 29 a0 69 f6 ff 00 db 1a 0d cc 11 47 6d 6a 8e df bb 43 b1 e5 9d 77 79 de 66 76 aa f6 af 99 b4 7b 1f f8 48 3c 27 73 3d f5 9c d6 5a ad be ff 00 b6 db 7f a9 f2 ee a3 f9 be eb fc c9 f3 57 d0 df 16 b5 bb 0d 27 e1 c4 be 74 d0 e9 bf d9 fb 2e 2c ad b4 8f df 3c 0f 1f dd 48 d3 ee 20 dd f7 b7 7c b5 f3 b7 c2 1d 5e ef 5d d2 75 2b a7 d6 21 bd d4 a4 bd f3 ee 7e dd 2f fc b5 d9 f3 36 ee 5f 95 ae ea d3 f6 14 1c 97 4b 1e 8c 52 73 49 f6 25 b1 82 49 7f 7e 9f e9 12 7d a5 23 f3 25 f9 d2 47 6f 97 e7 fe f2 f6 ad 4b af 3e cb 49 b9 b2 b2 bc bb b2 82 3d 4b cb b9 b6 96 5d fe 64 aa 9f 3c cf 1a 7d fc 7f f5 ab 9e f0 5f 89 7f b4 3c 79 24 09 0c d1 e9 b7 b7 3f e8 d1 Data Ascii: q$Q&1e<L"nUG[\|)iGmjCwyfv{H<'s=ZW't.,<H \|^]u+!~/6_KRsI%I~}#%GoK>I=K]d<}_<y$?
2025-02-27 08:47:53 UTC	16384	IN	Data Raw: df bf 4a 33 8c 55 93 31 67 97 49 4f 89 1e 20 d5 3c 15 36 9f a7 4f 71 7b ff 00 1e d2 c4 e9 f6 0d bf ea e3 5b 75 da 13 ff 00 66 a8 35 5d 5f 5d b8 f0 f6 89 a4 7e e7 fb 37 c3 b2 79 9e 54 5f 27 99 2c 9f f2 d6 5e ee c5 9b fe 01 54 bc 39 04 9a 7c 3a b3 ea 3e 4c 9a 95 bd cb f9 7e 6f ef a6 bb dd fd ef f3 f7 a9 ba 97 f6 4d bd a5 b7 9f e7 47 aa dc 6a 49 24 76 df f2 c6 3b 7d 9f c7 db 76 ea f7 30 18 4a 54 a0 a6 9d db 4b 53 c8 c5 49 dd c3 64 45 e2 36 7b 7d 5a 4d ff 00 bb 92 3b 64 8e db ca ff 00 3f 7a a8 78 9a 0b bb 7f 2e 0f 3a d2 e3 ed 11 fd a3 cc 8a 5f 93 7f f1 2b 37 f7 85 6a 78 f3 cc 8b c4 51 bd af 9d e7 fd 9b fd 37 f8 fc b7 ff 00 f6 6b 0f c4 cb f6 b9 a3 78 3c e8 ed 6d e3 fd df 9b f7 ff 00 ef 95 af 46 4e fa 9c 49 34 65 dc 2f da ed 3e cb ff 00 2c e4 91 23 93 ca fe e5 Data Ascii: J3U1gIO <6Oq{[uf5]_]~7yT_',^T9\|:>L~oMGjI$v;}v0JTKSIdE6{}ZM;d?zx.:_+7jxQ7kx<mFNI4e/>,#
2025-02-27 08:47:53 UTC	16384	IN	Data Raw: 3e ef b9 22 fc cd f3 7c 9e bf ee d7 1e 26 a6 32 2e 31 a1 6e 4e b7 5a af 47 ff 00 00 d3 92 16 bb 76 67 a3 69 1e 35 b4 d3 e5 d2 2c ae ac e2 93 4a d6 7f e3 df 56 bd bb 7b cb 4f de 3f cb 1f 9d b7 ef 48 db b1 e6 6d 5a f4 8b 2b bb d5 d4 ad a1 78 36 59 7d 9d fc c9 22 8b f7 41 d5 fe ef f7 bf a5 60 f8 bb 42 79 e4 99 74 1b 4f 0f a6 a9 1d bf 97 6d 6d a9 45 be d9 fb aa cb 1a f3 fe eb 2f e5 58 d0 cb e3 15 f1 05 89 d4 66 16 fa 52 5b f9 1a 94 7a 95 d2 43 37 9c ef f2 b5 bc b1 fc 98 5f e1 5f 95 99 6b 67 69 6c 51 df 6b 96 fa 17 8a 3c 3f 7b a2 ea 22 2b cb 2b cb 7f 22 e6 da 48 fa ab f1 ca b5 7e 60 fc 77 f8 65 e2 0f 85 3e 3a 97 c3 7a ec 26 44 f9 e4 d3 6f 7f e5 95 fc 1f c2 eb fe d7 f7 97 b5 7e 8c df f8 77 c4 12 ea 12 cf a7 eb d7 72 5a dc 5b f9 7e 54 b7 5f e8 f0 3a fd d9 7e 5f Data Ascii: >"\|&2.1nNZGvgi5,JV{O?HmZ+x6Y}"A`BytOmmE/XfR[zC7__kgilQk<?{"++"H~`we>:z&Do~wrZ[~T_:~_
2025-02-27 08:47:53 UTC	16384	IN	Data Raw: 4b 7d 26 6b 48 ae 7c df f9 eb 36 e5 83 6f f7 d1 b7 ab 7f b3 b0 d6 dd af 99 7b f6 98 35 49 bc cb 5f 2d 2e fc bf bf e5 bf 9c 9f 27 fb 34 df 1e 69 9e 6e 9d 73 a5 e9 7e 74 72 5e de dc db f9 97 3f 3f fd 34 67 ff 00 ec a9 26 ec 5e 97 3c 76 05 9e 58 a3 83 ce ff 00 57 5e 9d f0 76 f2 4d 77 e1 be b7 e1 7d 47 c9 b2 82 ca d9 e3 fb 4f f0 6c 97 7f de ff 00 81 d7 2f 05 b4 73 7c 3d b1 d5 e7 87 cb 93 4e bd 78 ed ae 62 f9 d2 fe dd 9f e6 57 ff 00 6a 3d fc 33 7d ea eb 7e 04 58 ce fa b7 88 2c 9e ce 6f b2 6b 56 c9 1d b7 9b 17 fa 35 c3 ae ff 00 33 6b 7b 23 d3 9c 5d 89 4e ed 1e 69 a3 cf 77 71 0c 69 ff 00 4c e8 ba 82 4b 7f bf fe b3 fd 64 7f f4 d2 b4 b4 db 69 ed fc 33 fb ff 00 26 3f ec eb d7 8e 38 ff 00 e5 b4 8e af b5 be ef f0 d6 8f 8a b5 79 f5 ab 48 ee 9e 18 7f 77 17 fa c8 a2 ff Data Ascii: K}&kH\|6o{5I_-.'4ins~tr^??4g&^<vXW^vMw}GOl/s\|=NxbWj=3}~X,okV53k{#]NiwqiLKdi3&?8yHw
2025-02-27 08:47:53 UTC	16384	IN	Data Raw: f0 e6 7b af 0f c5 ad ff 00 c2 37 a8 6a 3a 56 ab 6c 97 91 5c db 7f b5 f7 93 fb eb b3 f8 bf 3a fa 65 84 c3 61 ea c5 a9 72 db 45 ad 8f 2b 9a ee ed 5c e9 75 cb a8 ff 00 b5 ae 6c a0 d6 26 92 09 2e 7c cb 9b 9b 68 9d 2d a4 45 44 fd d7 95 d3 f7 7e bf de a7 e8 f6 d6 97 77 71 ec 9a 68 e4 f3 7c bf dd 4b f3 ff 00 e3 be b5 4f c3 9e 23 bb b7 f0 6f f6 45 96 9b 0e 9d a5 49 be de da 48 be 7f b5 ff 00 cf 5d db fe e3 6e fe e5 59 f0 ae bd 69 a5 6a d6 37 57 5a 6f 99 1c 77 29 6f 24 91 43 bd e3 4d fb 7e ed 7a fa 31 45 d8 f4 6b ed 3e 3d 27 4f 8f 54 82 18 ae 2e bf e3 de 39 25 b4 df f6 7d df 7b d9 7e 6a 3c 39 14 77 7e 1e b1 47 d1 e6 b2 8e 38 d3 fd 1a 5d 9b 37 ff 00 7b ff 00 66 ae 6a e3 5e d0 af 61 be f0 f7 8b fe d7 24 76 57 2f 1c 72 58 cb be 1f fc 76 ba 3d 57 5e b4 fe c3 b1 d4 6c Data Ascii: {7j:Vl\:earE+\ul&.\|h-ED~wqh\|KO#oEIH]nYij7WZow)o$CM~z1Ek>='OT.9%}{~j<9w~G8]7{fj^a$vW/rXv=W^l
2025-02-27 08:47:53 UTC	16067	IN	Data Raw: 6d 73 a8 3c cf 68 ff 00 dd 6f 96 b6 7e 21 69 1a 16 83 6b 1e 89 e1 ef b5 d9 6b 97 b7 2f e5 c7 2e cf 27 e5 7f 9a 29 13 f9 3d 55 bb d3 2e ed ff 00 e2 6f 6b 0c d2 5f 5b c7 e4 5c c7 73 2f fc 7c 6d fe f3 7f 7b d2 be a2 34 d3 93 76 d4 f2 27 55 a4 92 7a 12 c7 15 fd bc df f1 f9 a7 c7 1c 7f eb 3f d1 37 ff 00 e3 ad f7 e9 f1 c7 3d bc 3f 6a fe d2 86 df cb d9 1f fc 83 d3 66 cd ff 00 dc a6 69 ba 84 17 b7 5f 3f fa 3c 9e 5a 79 96 d7 3f 24 d6 ef fd d7 fe 8c b5 2c 97 30 79 32 41 04 d0 f9 9f f5 d7 7d 4d a1 17 b1 77 9b 56 b9 d5 43 e0 4d 67 c6 9e 2c d4 b4 4f 0f e9 b0 f8 9b 55 8e da 1f b4 7d a6 54 4b 4b 0f 93 67 ef 1f a7 1f c3 b7 e6 af 7c fd 9e 7e 15 7c 34 f0 95 e4 5a 4d ed e5 a7 88 7c 55 a3 3a 60 de c7 9f b0 b2 63 fe 3d 51 be e0 f9 97 a7 35 f3 f7 ec db f1 03 55 d3 6c f5 2b 5d Data Ascii: ms<ho~!ikk/.')=U.ok_[\s/\|m{4v'Uz?7=?jfi_?<Zy?$,0y2A}MwVCMg,OU}TKKg\|~\|4ZM\|U:`c=Q5Ul+]
2025-02-27 08:47:53 UTC	16384	IN	Data Raw: 67 f6 1c 1a 7f d9 a7 86 1f 2e 3f b3 3d bc 92 45 fe e7 de 6f f6 ab 5f c3 8b 1d bc d1 e9 09 e4 c7 07 d9 be d7 fd ff 00 9d 9f 6b 55 5d d2 5c 5d dc cf 6b 0c d7 33 db c7 e5 c5 24 52 ff 00 ac dd fa 57 44 61 65 a1 93 96 a6 5e 9b 69 f6 7f b3 6c fd e7 97 e7 47 24 71 7f cf 26 aa 5e 1c b6 93 50 f1 0c 9a 5e a3 0c d7 11 c7 73 f6 fb 2f b8 ff 00 bd d9 b2 5f 93 fe f8 ad bd 56 58 22 d4 23 82 7f f4 8f 32 44 b7 8e 48 be 4f 9e 9f e1 fb 3f b5 f8 9a 37 8e 18 7f 77 be e3 f8 ff 00 85 36 7f 0f fb 35 cb ca e3 5d 58 da e9 d3 7a 06 8f a5 41 a3 ea 12 4f 6b e7 7e f2 37 8e e7 f7 df 26 fd ff 00 77 65 32 d6 09 e5 bb b6 74 86 19 23 ff 00 57 ff 00 5c df 7f cc f5 bd 7d 63 3c b3 7c f0 da 7e f3 fd fd ff 00 ce a0 83 cf 8a d2 4f dc c3 e5 f9 9f f2 ca 2f f5 7b 6b a3 91 b3 1e 64 63 78 99 63 fb 25 Data Ascii: g.?=Eo_kU]\]k3$RWDae^ilG$q&^P^s/_VX"#2DHO?7w65]XzAOk~7&we2t#W\}c<\|~O/{kdcxc%
2025-02-27 08:47:53 UTC	16384	IN	Data Raw: 00 b7 67 b1 7f 86 af ea b7 9a b2 78 b3 fb 2e 7b 3f f4 59 3f 79 1d ec 52 fc ff 00 32 7f e3 95 83 e1 9d 5e 34 86 e7 4b b5 fb 27 ee ff 00 d5 c7 ff 00 3e fb 9d 1f 62 ed ae ff 00 c4 17 9f 68 d7 2e 5d fc 9f dd ec 8f ca 96 2f f6 2b a6 9c 54 92 77 df 51 54 93 5f 23 b6 f0 ae b5 05 df 84 ed ad 52 18 63 ba b2 93 fd 1a 48 a2 fd ce f5 4f bd 56 20 bc b4 fb 54 70 7d b2 d3 f7 9f bc 92 4f b9 5c bf c2 b6 8e ef 50 d4 a0 9e 69 bc bb 79 21 93 f7 51 7f 7b fe 9a 7f 75 ba 15 fc 6a be ab a1 f8 96 e3 50 d6 f5 4b a9 b4 fb 8b 1f 9e de db 49 8a d1 fc eb 3d af f2 3b 7f 73 e5 f9 ce df bd 54 ec a5 6b 0a f2 68 e8 74 ad 56 d2 df cc d3 a0 bc 86 e2 3f 33 ec fe 5c b7 7b fc bf e2 56 f9 bd 69 de 0b d6 bf b5 62 8b ed b6 73 69 d2 5b dc bf fa 34 bb 3f 78 9f c0 df 2f f0 bd 73 be 0b d3 e4 d3 34 fb Data Ascii: gx.{?Y?yR2^4K'>bh.]/+TwQT_#RcHOV Tp}O\Piy!Q{ujPKI=;sTkhtV?3\{Vibsi[4?x/s4

Target ID:	0
Start time:	03:46:39
Start date:	27/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	03:46:45
Start date:	27/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1948,i,484534398703970958,5957363080685509193,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	03:46:51
Start date:	27/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://almalinuooslkq.buzz/4QGWTd6946YDMa182ykwhlvdffu768ZUQNXKDLBYLUDLF9449HXJI1823I9"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre