Edit tour

Windows Analysis Report
qctivqtion.zip

Overview

General Information

Sample name:	qctivqtion.zip
Analysis ID:	1647222
MD5:	aeab8047a1969d292902f4b2a23de801
SHA1:	065df92f89de88374dd53a5acae646a2e69b5f75
SHA256:	086f71a123fc16c39829bcf47ec4740687a3b69921fc37d65403c081892c5ad1
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

Found suspicious ZIP file

Creates a process in suspended mode (likely to inject code)

HTML page contains hidden javascript code

Queries the volume information (name, serial number etc) of a device

Sigma detected: Explorer Process Tree Break

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 6928 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

notepad.exe (PID: 740 cmdline: "C:\Windows\System32\NOTEPAD.EXE" C:\Users\user\Desktop\Activation.cmd MD5: 27F71B12CB585541885A31BE22F61C83)

cmd.exe (PID: 1560 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Activation.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6884 cmdline: C:\Windows\system32\cmd.exe /c dir /b ..\root\Licenses16\ProPlus2019VL*.xrm-ms MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cscript.exe (PID: 6940 cmdline: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 6248 cmdline: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 6428 cmdline: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 1172 cmdline: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 2972 cmdline: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 6724 cmdline: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 6920 cmdline: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cmd.exe (PID: 1952 cmdline: C:\Windows\system32\cmd.exe /c dir /b ..\root\Licenses16\ProPlus2019VL*.xrm-ms MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cscript.exe (PID: 7064 cmdline: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 2004 cmdline: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 1416 cmdline: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 1932 cmdline: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 2128 cmdline: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 2292 cmdline: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 3108 cmdline: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 3400 cmdline: cscript //nologo ospp.vbs /unpkey:6MWKP MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 6076 cmdline: cscript //nologo ospp.vbs /inpkey:NMMKJ-6RK4F-KMJVX-8D9MJ-6MWKP MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 4640 cmdline: cscript //nologo ospp.vbs /sethst:kms7.MSGuides.com MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cscript.exe (PID: 1724 cmdline: cscript //nologo ospp.vbs /act MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

find.exe (PID: 3608 cmdline: find /i "successful" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

choice.exe (PID: 848 cmdline: choice /n /c YN /m "Would you like to visit my blog [Y,N]?" MD5: 1A9804F0C374283B094E9E55DC5EE128)

explorer.exe (PID: 5116 cmdline: explorer "http://MSGuides.com" MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 6140 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: 662F4F92FDE3557E86D110526BB578D5)

chrome.exe (PID: 5332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://msguides.com/ MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1940,i,1336669465946602264,4009943375968269981,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Sigma Signatures

System Summary

Sigma detected: Explorer Process Tree Break

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber: Data: Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, CommandLine: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 796, ProcessCommandLine: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, ProcessId: 6140, ProcessName: explorer.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms" , CommandLine: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms" , CommandLine|base64offset|contains: r+, Image: C:\Windows\System32\cscript.exe, NewProcessName: C:\Windows\System32\cscript.exe, OriginalFileName: C:\Windows\System32\cscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Activation.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1560, ParentProcessName: cmd.exe, ProcessCommandLine: cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms" , ProcessId: 6940, ProcessName: cscript.exe

Suricata Signatures

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-24T16:12:05.081661+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.16	49770	23.199.48.23	443	TCP
2025-03-24T16:12:05.100580+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.16	49778	23.199.48.23	443	TCP

Joe Sandbox Signatures

• Phishing
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: https://msguides.com/	Joe Sandbox AI: Page contains button: 'Open' Source: '0.0.pages.csv'
Source: https://msguides.com/	Joe Sandbox AI: Page contains button: 'Open' Source: '0.1.pages.csv'
Source: https://msguides.com/	Joe Sandbox AI: Page contains button: 'Open' Source: '0.3.pages.csv'

Source: https://msguides.com/

HTTP Parser: Base64 decoded: ["Windows","10.0.0","x86","","134.0.6998.36",null,0,null,"64",[["Chromium","134.0.6998.36"],["Not:A-Brand","24.0.0.0"],["Google Chrome","134.0.6998.36"]],0]

Source: https://msguides.com/

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.134:443 -> 192.168.2.16:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.162:443 -> 192.168.2.16:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.162:443 -> 192.168.2.16:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.162:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.162:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.162:443 -> 192.168.2.16:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.162:443 -> 192.168.2.16:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.9.191:443 -> 192.168.2.16:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.68:443 -> 192.168.2.16:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.200.0.174:443 -> 192.168.2.16:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.200.196.24:443 -> 192.168.2.16:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.200.196.24:443 -> 192.168.2.16:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.200.196.24:443 -> 192.168.2.16:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.200.0.174:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.16:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.164:443 -> 192.168.2.16:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.16:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.200.0.174:443 -> 192.168.2.16:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.200.0.174:443 -> 192.168.2.16:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.98:443 -> 192.168.2.16:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.49.23.1:443 -> 192.168.2.16:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.16:49866 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 38MB

Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.16:49770 -> 23.199.48.23:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.16:49778 -> 23.199.48.23:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: msguides.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/kk-star-ratings/src/core/public/css/kk-star-ratings.min.css HTTP/1.1Host: cdn.msguides.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/cache/min/1/wp-content/plugins/widget-options/assets/css/widget-options.css?ver=1740537121 HTTP/1.1Host: cdn.msguides.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/css/dist/block-library/style.min.css HTTP/1.1Host: cdn.msguides.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/kadence/assets/css/global.min.css HTTP/1.1Host: cdn.msguides.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/kadence/assets/css/header.min.css HTTP/1.1Host: cdn.msguides.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/kadence/assets/css/content.min.css HTTP/1.1Host: cdn.msguides.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/kadence/assets/css/sidebar.min.css HTTP/1.1Host: cdn.msguides.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/kadence/assets/css/footer.min.css HTTP/1.1Host: cdn.msguides.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/kk-star-ratings/src/core/public/js/kk-star-ratings.min.js HTTP/1.1Host: cdn.msguides.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-embed.min.js HTTP/1.1Host: cdn.msguides.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/kadence/assets/js/navigation.min.js HTTP/1.1Host: cdn.msguides.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/wp-rocket/assets/js/lazyload/16.1/lazyload.min.js HTTP/1.1Host: cdn.msguides.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/qmwcmk HTTP/1.1Host: webaz.eu.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/html/r20250319/r20190131/zrt_lookup_fy2021.html HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/ads?client=ca-pub-8269858869457953&output=html&adk=1812271804&adf=3025194257&abgtt=6&lmt=1742816699&plat=1%3A16777216%2C3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fmsguides.com%2F&pra=5&wgl=1&aihb=0&asro=0&ailel=1~2~4~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aiael=1~2~3~4~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aicel=33~38&aifxl=29_18~30_19&aiixl=29_5~30_6&aiapm=0.15&aiapmi=0.33938&aiact=0.7&ailct=0.65&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121274&bpp=6&bdt=1619&idt=921&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=5397107791020&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=968 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Sec-Browsing-Topics: ();p=P0000000000000000000000000000000Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/ads?client=ca-pub-8269858869457953&output=html&h=280&slotname=1770175538&adk=3856262152&adf=2712143399&pi=t.ma~as.1770175538&w=1200&abgtt=6&fwrn=4&fwrnh=100&lmt=1742816699&rafmt=1&format=1200x280&url=https%3A%2F%2Fmsguides.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121280&bpp=2&bdt=1625&idt=970&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=32&ady=88&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7Ce%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&fsb=1&dtd=976 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Sec-Browsing-Topics: ();p=P0000000000000000000000000000000Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/ads?client=ca-pub-8269858869457953&output=html&h=495&slotname=5267401563&adk=3734463499&adf=2132245819&pi=t.ma~as.5267401563&w=848&abgtt=6&lmt=1742816699&rafmt=11&format=848x495&url=https%3A%2F%2Fmsguides.com%2F&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121282&bpp=1&bdt=1627&idt=986&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=391&ady=1268&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=989 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Sec-Browsing-Topics: ();p=P0000000000000000000000000000000Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/ads?client=ca-pub-8269858869457953&output=html&h=495&slotname=5267401563&adk=3734463499&adf=1733159701&pi=t.ma~as.5267401563&w=848&abgtt=6&lmt=1742816699&rafmt=11&format=848x495&url=https%3A%2F%2Fmsguides.com%2F&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121283&bpp=1&bdt=1628&idt=996&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C848x495&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=391&ady=2657&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=999 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Sec-Browsing-Topics: ();p=P0000000000000000000000000000000Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/ads?client=ca-pub-8269858869457953&output=html&h=250&slotname=2983663782&adk=568099612&adf=1502893352&pi=t.ma~as.2983663782&w=304&abgtt=6&fwrn=4&fwrnh=100&lmt=1742816699&rafmt=1&format=304x250&url=https%3A%2F%2Fmsguides.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121284&bpp=1&bdt=1629&idt=1010&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C848x495%2C848x495&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=24&ady=464&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=6&uci=a!6&fsb=1&dtd=1013 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Sec-Browsing-Topics: ();p=P0000000000000000000000000000000Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/qmwcmk HTTP/1.1Host: webaz.eu.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/ads?client=ca-pub-8269858869457953&output=html&h=250&slotname=5418255437&adk=2622858739&adf=1949866865&pi=t.ma~as.5418255437&w=304&abgtt=6&fwrn=4&fwrnh=100&lmt=1742816699&rafmt=1&format=304x250&url=https%3A%2F%2Fmsguides.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121284&bpp=1&bdt=1629&idt=1025&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C848x495%2C848x495%2C304x250&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=24&ady=1469&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=7&uci=a!7&btvi=3&fsb=1&dtd=1028 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Sec-Browsing-Topics: ();p=P0000000000000000000000000000000Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/ads?client=ca-pub-8269858869457953&output=html&h=495&slotname=5267401563&adk=3734463499&adf=644718914&pi=t.ma~as.5267401563&w=848&abgtt=6&lmt=1742816699&rafmt=11&format=848x495&url=https%3A%2F%2Fmsguides.com%2F&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121283&bpp=1&bdt=1628&idt=1006&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc514f1f730bdc7c0%3AT%3D1742829123%3ART%3D1742829123%3AS%3DALNI_MahzfFTR5JpSVubumatvx6h54JrfA&gpic=UID%3D00001000daac5df6%3AT%3D1742829123%3ART%3D1742829123%3AS%3DALNI_MbGxKGZk0isNUK0_-L_X-3dbd6-DQ&eo_id_str=ID%3Db44224744cdf08bd%3AT%3D1742829123%3ART%3D1742829123%3AS%3DAA-AfjYu9snT8OJgF3xrMWGa3A2s&prev_fmts=0x0%2C1200x280%2C848x495%2C848x495%2C304x250%2C304x250&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=391&ady=3552&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=1802 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Sec-Browsing-Topics: ();p=P0000000000000000000000000000000Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /pagead/adview?ai=CEF40Q3bhZ_axLaqaoPMPx4rfqQ6atpvReffa0tOsDMCNtwEQASAAYMm2gomEpIARggEXY2EtcHViLTgyNjk4NTg4Njk0NTc5NTPIAQmoAwHIAwKqBLoBT9DorN-w-OliQlxakmT9oMHoCwgBin3Gzr4blTf9bgi-XI7XoGg_BL7RmIt9-Ia84ii8TWTRnyXBYRM-9DE3ppMGH_wsUThWOdSPpiIJtMmaJsPvx1ElFKkpwHb72NCl9lchZkmyBlrNAPMFKnmrf_G7GYKtLfl3ngb9OLnOlxUVbUIy7bDCNhcYG6oMUReIzqGTOJtYp0HaG-h9OxsyTvShwqpZgWNvucNeVgzeIc0a5_hWIzRL6-aegAaxj5zV3vDZjKoBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAqgHrb6xAtgHANIIJAiAYRABMgKKAjoLgECAwICAgKCogAJIvf3BOljH18u2gKOMA4AKAfoLAggBgAwB6g0TCNSS7LaAo4wDFSoNaAgdR8U35dAVAYAXAbIXHAoYEhRwdWItODI2OTg1ODg2OTQ1Nzk1MxgAGAw&sigh=Dwx6Lk_go60&uach_m=%5BUACH%5D&cid=CAQSTwCjtLzMKTFMJUj096YAULWulADhjeRZ5smtFNAZ-B04FiUHgB3YWEYjvqhXfwmEYeovPIkYHgWCYxUc9cS2aydyuhqRKVk0dkuPtWao8_oYAQ HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CLbgygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=250&slotname=2983663782&adk=568099612&adf=1502893352&pi=t.ma~as.2983663782&w=304&abgtt=6&fwrn=4&fwrnh=100&lmt=1742816699&rafmt=1&format=304x250&url=https%3A%2F%2Fmsguides.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121284&bpp=1&bdt=1629&idt=1010&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C848x495%2C848x495&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=24&ady=464&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=6&uci=a!6&fsb=1&dtd=1013Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /pagead/adview?ai=CxS-ORHbhZ87DCc-hoPMPoI654A-atpvReffa0tOsDMCNtwEQASAAYMm2gomEpIARggEXY2EtcHViLTgyNjk4NTg4Njk0NTc5NTPIAQmoAwHIAwKqBMABT9CQ-_insEIDKVBJ3RGt3p9jAzF7IjFpAMKBi7LEQJEBVbr5MR3oA1-fibkCI7tTlYN53muKxw6lU_RcgJwaoXWy8FW4mlUUwPY5RlQOVIzKm38vqIuSJOROgv_7Xn_y874307zUV4-OfrSPRe8G5omjMzADmznFqkzUz5Ac5Cq33aka4ljllnorqnXtzsju3epfXMQ2TXOkkX9lmIdckHULrleO-VcyCoG1ePECztV7nhliCfCcxWkiTRW5Ka0EgAbTxu3FlqGv--IBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAqgHrb6xAtgHANIIJAiAYRABMgKKAjoLgECAwICAgKCogAJIvf3BOli_zOW2gKOMA4AKAfoLAggBgAwB6g0TCPqs9LaAo4wDFc8QaAgdIEcO_NAVAYAXAbIXHAoYEhRwdWItODI2OTg1ODg2OTQ1Nzk1MxgAGAw&sigh=1P_IR9RoANE&uach_m=%5BUACH%5D&cid=CAQSTgCjtLzMCvHiSbtcwjki74oVIZ-l-qxMzqDl1X8Z_zwJd0TPyhwcglosBsLYnreTDwUTgQnrKMmeQLLS_39rtZGX8mJdgibZipFZhCk1BBgB HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CLbgygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=250&slotname=5418255437&adk=2622858739&adf=1949866865&pi=t.ma~as.5418255437&w=304&abgtt=6&fwrn=4&fwrnh=100&lmt=1742816699&rafmt=1&format=304x250&url=https%3A%2F%2Fmsguides.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121284&bpp=1&bdt=1629&idt=1025&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C848x495%2C848x495%2C304x250&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=24&ady=1469&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=7&uci=a!7&btvi=3&fsb=1&dtd=1028Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /log?logid=kfke&evtid=plutol1&__q=Ab4EewKELwQCEAABAIAAAgAAAABAAAEABgAAQIABAAgAMNCYCXBGUDM1OTAwNDY0MDQ3MDM5NV85NTg3ODQ4NF8xNTU5MjEyNTQ0NjAxXzBAOGJmM2JmM2U3ZGRlMTYzMDM2MTIwMjhlYWQwNTE5Y2MAzK3ZlAGYBylcj8L1KNw_KVyPwvUo3D8oaHR0cHM6Ly9tc2d1aWRlcy5jb20EVVOAtOiUFN4BTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzNC4wLjAuMCBTYWZhcmkvNTM3LjM2GG1zZ3VpZGVzLmNvbRI4Q1VVOUpGOEgIDjMwMHgyNTAQMC40NDAwMDAkcG9wdWxhci10cmVuZHMuY29tDmVhc3Rfc2MyOENVN1E3NzFFLTQ4NTEzMTI1Ny0xMy0yNQZBRFgICG51cmwAAAAAAAAAUkCO5q-LuWUCMQAAAAAAAAAAQHJ0Yi1hcHBuZXh1cy03NmQ3NzQ2YmNiLTR3Nmp3LlNDPjE3MDAwOTAwMDEwOTE3MDAzMDAwMjUwMTAwMDk5MDACEDZiMGEyMjg0AmQCEGFwcG5leHVzPjE3MDAwOTAwMDEwOTE3MDAzMDAwMjUwMTAwMDk5MDBAYjFhOTZjYmM3Mzk0NjgzNjRkMTVmMmZhMTljZGNhODUCCgACAQACMQ5CSURfQVBJGG1zZ3VpZGVzLmNvbQA HTTP/1.1Host: hblg.media.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://googleads.g.doubleclick.net/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?logid=kfke&evtid=plutol1&__q=Ab4EewKELwQCEAABAIAAAgAAAABAAAEABgAAQIABAAgAMNCYCXBGUDczNTE4MTk3NjM0MzhfMTY4MDAwOTg1NV8xNTU5MjEyNTQ0NjAxXzBANTAxNzM4YTU2M2VmZmIxYjkwYTUzMjZhZTUwZmZkZTMAzK3ZlAGYBzMzMzMzM9M_MzMzMzMz0z8oaHR0cHM6Ly9tc2d1aWRlcy5jb20EVVOAtOiUFN4BTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzNC4wLjAuMCBTYWZhcmkvNTM3LjM2GG1zZ3VpZGVzLmNvbRI4Q1VVOUpGOEgIDjMwMHgyNTAQMC4xODE0NTAkcG9wdWxhci10cmVuZHMuY29tDmVhc3Rfc2MwOENVN1E3NzFFLTQ4NTEzMTI1Ny0xMy00BkFEWAgIbnVybAAAAAAAAIBDQKLsr4u5ZQIydy_e45GeRz9AcnRiLWFwcG5leHVzLTc2ZDc3NDZiY2ItZndmOWouU0M-MTcwMDA5MDAwMTE1MTkwMDMwMDAyNTAxMDAwOTkwMAIQNmIwYTIyODQCZAIQYXBwbmV4dXM-MTcwMDA5MDAwMTE1MTkwMDMwMDAyNTAxMDAwOTkwMEBlMjU2ZmQxZThkYmViYjNhYjc3NTlhYjU0ZDMyMWE3NAIKAAIBAAIxDkJJRF9BUEkYbXNndWlkZXMuY29tAA HTTP/1.1Host: hblg.media.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://googleads.g.doubleclick.net/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /clog?logid=awelog&pixel_len_bucket=5221&__q=AbgP_wOPPAyccAi5CTRBwSEIw7EI7KFAEAv8lCDI44EEAXwu-ZwMsAEgAQgUXoAgmF1ACCoAcAO1wGQQgmjBCA4AjBIWmAHHAlMCAKACAAAAAAAAOOAAgQKAAdugDpGBIBxwAIAkFQMMqkYGWiAPOEu3DsJIAkkMDgCSgVzAD1AzNTkwMDQ2NDA0NzAzOTVfOTU4Nzg0ODRfMTU1OTIxMjU0NDYwMV8wQDhiZjNiZjNlN2RkZTE2MzAzNjEyMDI4ZWFkMDUxOWNjLEFfall3TWVDNVZGM2ktcldLUWduT0EAzK3ZlAGYBylcj8L1KNw_AAAAAAAAAAAAAAAAAAAAAClcj8L1KNw_KVyPwvUo3D-qAShodHRwczovL21zZ3VpZGVzLmNvbQAEVVMYbXNndWlkZXMuY29tEjhDVVU5SkY4SBJoZWFkZXJCaWQIDjMwMHgyNTASNDg1MTMxMjU3EjhDVTdRNzcxRQISaGVhZGVyQmlkEDAuNDQwMDAwAk8SNDg1MTMxMjU3BjEzNCRwb3B1bGFyLXRyZW5kcy5jb20IODUuMAAAAAAAAACAQUAOZWFzdF9zYwpJQUItMwAAAAAAAAAAAhR1bmFmZmVjdGVkGjB8MHx4dG1heD0zMzA0bW93eC1saXRlLTc5ZDhjZmY5ZmYtdmRwbDYyOENVN1E3NzFFLTQ4NTEzMTI1Ny0xMy0yNQIwBjIxOAQyMwZBRFgmMjAyNS0wMy0yNCAxNToxMjowMwAETUEgV2VzdCBTcHJpbmdmaWVsZBoxNzQyODI5NzI0MjI2exSuR-F6hD97FK5H4XqEP3sUrkfheoQ_ACISOFBSMTEzSkdDAHhzc0J1Y2tldD0wfHNjaD0xfGNsdD0yfHRwaT0xfGZsX3JsPTF8c3NQcm9maWxlPTB8ZGJyPTF8dHBpPTEIAQAGMTAzAjEGYWRtAgAAAAAAAAAAUkACAjACMAIwAjAAAgIxAACO5q-LuWUIMC40NAIxAAAAAAAAAAAQMC40NDAwMDASNTY4MDk5NjEyAAhmYWlsAjACMAIwQHJ0Yi1hcHBuZXh1cy03NmQ3NzQ2YmNiLTR3Nmp3LlNDBAJOBgAGAAAAFHVuYWZmZWN0ZWQ-MTcwMDA5MDAwMTA5MTcwMDMwMDAyNTAxMDAwOTkwMAphZHgtMUQ4YmYzYmYzZTdkZGUxNjMwMzYxMjAyOGVhZDA1MTljY18xABBJQUIxOS0zNgY2MTUGNzM3AjACMAIxADpob21lcGFnZV90ZWNobm9sb2d5X2NvbXB1dGluZwR2NAA-MTcwMDA5MDAwMTA5MTcwMDMwMDAyNTAxMDAwOTkwMAIwAjEAAgw_kp0MirQHtrQH0rAHnLcH4p4MABhtc2d1aWRlcy5jb22QAUFEOEZkbTRBRXhMb241aFFrOG9VZXNwdFVkZWdieGJVZkRtTF9OWENnbVViamdrMDNyeVZYdWZEVFUxZG5aeXE3TVpYTTRLegEAAAAAKHB1Yi1BRFgtMTE2MzEwMTA5MTMxkgQAMEFEWC1wdWItODI2OTg1ODg2OTQ1Nzk1MyhwdWItQURYLTExNjMxMDEwOTEzMQQeMjUweDI1MHwzMDB4MjUwAgABAAAAAPYBvAWUBR4zMDB4MjUwfDI1MHgyNTAAAQZVU0QAAAAAAADwPwAITm9uZQAAAAAAAADwvwpORVhVUxA2YjBhMjI4NCYyMDI1LTAzLTIxIDAwOjAwOjAwAixBX2pZd01lQzVWRjNpLXJXS1Fnbk9BABI4Q1VVOUpGOEgAEjhDVTdRNzcxRWoxNnwxN3w0OHwzMnwxOXwyNnwxM3w3MHwyNXwxNXwyMnwxMTR8MTh8MzR8MjB8N3wxNHwyNwIBAAAAEEVYQ0hBTkdFAQJOAgASNTY4MDk5NjEyAjIQYXBwbmV4dXOenAEMV2VhdmVyEEVYQ0hBTkdFADBBX2pZd01lQzVWRjNpLXJXS1Fnbk9BXzEAAAAAAAAAAAAOV2luZG93cw4xMTExMDExDDEwLjAuMAJkABRmODAyNWQ1OGZjDkJJRF9BUEkSNTY4MDk5NjEyAgEYdmE0azB4RDFkY1B5BjI3OAACAAIAAAAAAAAAAAAAAAAAAAECAQhiYWR2OGctdXNlMWQtZW52b3ktcnRiLWFwcG5leHVzLTQAAQAELTIKWzQ2MF0pXI_C9SjcPylcj8L1KNw_AAAIDyQzM0Fjcm9zc1Rlc3Q6dGVzdDEkY3JpdGVvX2R1cDppbnZfZHVwMEFzc2V0VXJsVGltZW91dFRlc3Q6dGVzdBZnbXA6REVGQVVMVEBiMWE5NmNiYzczOTQ2ODM2NGQxNWYyZmExOWNkY2E4NQIwGG1zZ3VpZGVzLmNvbQhodHRwAAgCAB5CU1NfVU5SRUFDSEFCTEUeQlNTX1VOUkVBQ0hBQkxFHkJTU19VTlJFQUNIQUJMRQAcTk9UX0FQUExJQ0FCTEUcTk9UX0FQUExJQ0FCTEUGQURYBHsUrkfheoQ_AAACAAICAgACBE5BBE5BAAAAAAAAAAAAAAAAAAAAALAJAAACBC0xnicCAAABCjAxMDg5AQIAHE5PVF9BUFBMSUNBQkxFAEAxNDg4ZTE0M2VmZWYwYzE2NGI0Y2MwMzAyYmMyM2E1ZgAUZ29vZ2xlLmNvbZQFCgAAAAAEAw5kZWZsYXRlCGd6aXAOZWFzdF9zYwAAABxOT1RfQVBQTElDQUJMRQIAAA5jb250cm9sKHB1Yi04MjY5ODU4ODY5NDU3OTUzAAAABjU0MwIBEm1vd3gtbGl0ZQABAQIAEjEzNC4wLjAuMA5OVCAxMC4wIENocm9tZSAtIFdpbmRvd3MBAQEBAQE&bdata=sd2%3Dnull~iurl_l%3D20~vi25%3D25~ogerpm%3D0.44~dom_b%3D1.14~scd%3Dma~rae%3D0%2C0%2C-1
Source: global traffic	HTTP traffic detected: GET /log?logid=kfke&evtid=dmmra_enc&__q=AbIFxf7T7zdHACAcAADgfS8AAP4MAEAAggAAAABQAAfAAAzeMAIAAOA_4Pt-QQFAOGJmM2JmM2U3ZGRlMTYzMDM2MTIwMjhlYWQwNTE5Y2MiTk9OX0RFRFVDVEVEX0NCRFAMMC40NDAwDDAuMDEwMAIwBFVTEjhDVVU5SkY4SBIxNTU5MjEyNTQgV2VzdCBTcHJpbmdmaWVsZA5lYXN0X3NjDDAuNDQwMBhtc2d1aWRlcy5jb20CMAIwAjEMMC40NDAwCDAuNDQGNDYwEDEwMC4wMDAwDDAuNDQwMBhtc2d1aWRlcy5jb20CMQIxBE1BBjQ2MAh0cnVlDjMwMHgyNTAUdW5hZmZlY3RlZPR7AjQMMTAuMC41gLTolBQmMjAyNS0wMy0yNCAxNToxMjowMw5CSURfQVBJBmFkeCxBX2pZd01lQzVWRjNpLXJXS1Fnbk9BBjI2NQYxMDHeAU1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzQuMC4wLjAgU2FmYXJpLzUzNy4zNhIxMzQuMC4wLjAOTlQgMTAuMAAAAAAAAAAAAirCAmhvbWVwYWdlX3RlY2hub2xvZ3lfY29tcHV0aW5nLGlhYl9jb21wdXRlcl9zb2Z0d2FyZV9hbmRfYXBwbGljYXRpb25zLGlhYl9jb21wdXRpbmcsaWFiX29wZXJhdGluZ19zeXN0ZW1zLGlhYl90ZWNobm9sb2d5X2FuZF9jb21wdXRpbmcsbG9uZ190YWlsX2hvbWVwYWdlX2NhdGNoYWxsOmhvbWVwYWdlX3RlY2hub2xvZ3lfY29tcHV0aW5nCDAuNDQACDAuNDQCMAYxMzQGMC0xAjEIMC43MhI1NjgwOTk2MTIWNDYwX0JJRF9BUEkCMAIwAjESNTY4MDk5NjEyJnBvcHVsYXItdHJlbmRzLmNvbS8CMUBydGItYXBwbmV4dXMtNzZkNzc0NmJjYi00dzZqdy5TQwwwLjQ0MDACMApmYWxzZQZFTVM-MTcwMDA5MDAwMTA5MTcwMDMwMDAyNTAxMDAwOTkwMAJkBC0xEm1vd3hfbnVsbAEBAQEAAAAAAAAAAAAAAAAAAPC_AQQxNzRtb3d4LWxpdGUtNzlkOGNmZjlmZi12ZHBsNgw5LjYuMjQCMAY1NDMAAAAMR29vZ2xlIENocm9tZSAtIFdpbmRvd3MKMDEwODkeMzAweDI1MHwyNTB4MjUwQGIxYTk2Y2JjNzM5NDY4MzY0ZDE1ZjJmYTE5Y2RjYTg1EGFwcG5leHVzEDZiMGEyMjg0BkFEWApAMTQ4OGUxNDNlZmVmMGMxNjRiNGNjMDMwMmJjMjNhNWYAMjhDVTdRNzcxRS00ODUxMzEyNTctMTMtMjUAAjEAEmhlYWRlckJpZAAAAAAAAPC_AAAAAAAA8L8AAAAAAADwvwAAAAAAAPC_AghOb25lAA HTTP/1.1Host: qsearch-a.akamaihd.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://googleads.g.doubleclick.net/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sr/2722522032/SAFEFRAME.html?ule=3685&.2.V=O&2.%297=jtt-POt&22czTdW7T=%25%25%3F1QpbkbJI%21b%28R%3A_o%3AO%25%25&22iV=%7B%2222zz%22%3A%22ND%22%2C%2222z89%22%3A%226728+DET.X53.7iV%22%2C%2222.E%22%3A%22ogoxSSxojxt%22%2C%22222z%22%3A%22AI%22%7D&2HVTbV=ojm&2z=AI&5VET=t&5VETzX28=&7zT.V=oStttKtttotKoSttjtttPOtotttKKtt&82z7=U4oj&8E.V=%21Qgnnju&9EiE=o&9HXdzzd7-E=t&9V2ET=o&E.V=4v%28SjmjOm&G2~E=t&Gi28E=t&H.V=&H7=t&HVTbV=mgt&HZ7=oSmP4PKoPjYoSmP4PKSPjYgtt&L2E7X3=t&L5V=m&T7fLTi=~88E2%3A%2F%2Fc25L.V72xzyc&V7zccc=HH%3DodP%7CJycc7Tz.ZiNTi%28X%7C~T%3Dt%7C~i.V%3DPttP&W.=oSmP4PKoPjojooPtPPg&X8W=t&Xc7TT=o&ZEJL=&ZV8P=oOOKPoPOm&ZV8o=4JNNKqk4F&ZVW=vyELiZT+%21T7XV2&ZVycZ.X=~88E2%3A%2F%2FEyELiZT_8T7XV2xzyc&Zz8=v%2AbL%2AITTm%2FfRI%2AZ-%2A-3%2F77m%2AI735ImZR%2F5I&c2EZ=t&htmlsrc=1&iP89E7=G7ZW7T&kkdd=3H%7CW%7CuAnh%2A93H&lGT3=&lV=&lZ282=ZH8H%3Dt%7C%7CZH8f%3Dt%7C%7CH8V%3DP4m%7C%7C8289E7%3D_otmt4%7C%7C8H89E7%3DWSot%7C%7C8Ez%3DO%7C%7C8z%3Do&lZ8.V=KtttotKoS&lZ8ET7=o&lZ8H.V=_Po&lZ8Z=Z8yX&lZEz=ott&lZi2=8H.V%3D_Po%7C%7Cic.V%3DWSot%7C%7C889E7%3DottoK%7C%7CE8%3Do%7C%7Cz8T%3Dtxttm%7C%7CTEz%3DtxPg%7C%7CGTEz%3Do%7C%7C88V%3Dt&lZiy5=FbM%3Dt%7C%7C%2A%21%3DD%21I%2AUQ%7C%7CAv%21M%3Dj4m%7C%7C%21%21J%3DS%7C%7CJb%3Do4jP%7C%7CNNbM%3DPbZl%21V834Is-o%29jZTm%7C%7C%21UbM%3DPt%7C%7CDb%3DmojS%7C%7CDbM%3D4%7C%7C%21v%21M%3DSmKjK4K4omjtmPmOPm4%7C%7CAb%3DmPSS&y.V=tjjSgKoo_OOSo_mSSm_Hogj_zZSZZ3zHtzjK&yiZ3=yX7&z.V=4JNS0SSoQ&z8E.V=&zT.V=m4OojoPOS&zVW=%28oOj4&zz=ND&z~XcP=&z~Xcj=&~88E2=o&eobd=4YrCvRaaBNR%2FadaCrzBHNr_Cr_BP5b%2FhyCz.XXBYPydMCe.eXB4%20YCyDB%2FDbCz%2Cz%2CieBYPydaCrzBHar%2Fd4YCrzr_znrXzWBNR%2FadMCezXn.qWBR%2Fadjx%20CzBR%2Fad%2FrDdMCzB4jYC_UszqqUerB%2FDjCz.zzz%2CzB%20jFHar%2Fd4YC_seBNhCr%7Cs7PuBkMMCzB%2FNNhRDCz%2CzB%2F%20CeB%2Fh4d4YCrzr_znrXezB%2FDYHCz.zzz%2CzBR%2FadMCz.qUBHar%2FdR%2FadMCzBR%2FadaCrzB4aHCrX._rB5%20DjC_zz_neBMMCenXBb%2FhyCz.XXBHar%2FdR%2Fadx%20Cz8zBh4Nd%20CW_nUn%2C_%2Cs%2CX%2Cq%2CeX%2CrU%2CXeBMyCeBh4NdYCWWnrzeB%2FxbCz%2Cz%2CieBDnhdMCn.X_%2CeXn.zsB4YCzB%2FdJ%2FdMCnUz.zX%2CzBRNYCruDEN6A4HyDVgG384NB%20Har%2FdMCn.nqBMjYCrresnWrUqW_sse_UqzWqeWn_nqseqseszeUrzennrenU_UqWqqWWzr_UezUWsrWrzeWqszUzXqnqrreUsnssrrWsXrrUUrUXqXUqenrzqqrneUXUr_zUqUWnz_WzXWzeq_rzBRNyCzB%2Fdj4CsLV_70eKfB%2FxjCz.zzz%2CzBDhhdvCvPvdDhhBH%2FdR%2FadMC__z.r_BP5YrhdMCz.qsBMR5YCXB44CcgB%20%20CVlBb%2FyCieBRNJCieB%20bCzB%2F%20HCrX.WBLuCnnXXBxMdR%20CeBb%2FHCzBvj4CrB%20jC4h%2FNv5kNbaYBD55d4jP%2Fbd4YCBMD4N4rCeqUBMYjCeWXrsrqernBMD4N4eCeqUBxMdjjCzBY%20CsBHar%2FdMCn.X_BjjCqeeUBRaydhCz.znWqBb4jCzBHJdbF%20Cz.WrBYJydHar%2FdMCrU.XBHN4d4YC_snBR%2Fad%2Fh4dMCr.sUBY%20rCeBb%204CzBHdD4vCWsXqBMdka%2FCz.zeBaD4jCB%20HP5Cn.nqBHN4dR%2FadMCz.__BHar%2FdNd4YCrzr_znrXzWBHN4dR%2FadaCezBx%20r_CzBbjCr_BHar%2FdNdMCz.zeB%2Fbkd%2FCcBHN4dMCs_r.WsBHar%2FdR%2FadHNCe8ieUBR%2FadjHNCzBD55d4jP%2FbdMCeBHHCzB%20Har%2Fd4YC_snB%2FkHCee.zrBar%2FdMCezzzBJ%2FdMCe.qX%2CzB%2FDYhCz.zzz%2CzB4NYCXs_ener_WB%20jFHar%2FdMCU.ssBR%2Fad%2Fh4dx%20CzBxMd4%2F%20CDRjPdMNYYb%2FBHJRCz.WrBYrhdaCezB%20HarCn.nqBnh%20kCez_r.nrBP5dy49Cz.XXBYyyd4j%2F5CRvDkkb%20jbYBYrhdMCz.qqBMdICzezsqB%2Fh4
Source: global traffic	HTTP traffic detected: GET /checksync.php?vsSync=1&cs=6&cv=31&https=1&cid=8CUU9JF8H&prvid=99%2C77%2C20000%2C294%2C262%2C460%2C461%2C462%2C4%2C313%2C10000%2C459%2C229%2C9%2C319&itype=ADX&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1 HTTP/1.1Host: contextual.media.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://googleads.g.doubleclick.net/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /clog?logid=awelog&pixel_len_bucket=5735&__q=AbgP_wOPPAyccAi5CTRBwSEIw7EI7KFAEAv8lCDI44EEAXwu-ZwMsAEgAQgUXoAgmF1ACCoAcAO1wGQQgmjBCA4AjBIemAHHAl8CAKACAAAAAAAAOOAAgQKAAdugDpGBIBxwAMAkFQMMqkYGWiAPOEu3DsJIAkkMDgCSgVzAD1A3MzUxODE5NzYzNDM4XzE2ODAwMDk4NTVfMTU1OTIxMjU0NDYwMV8wQDUwMTczOGE1NjNlZmZiMWI5MGE1MzI2YWU1MGZmZGUzLEY1STJrWm9JVXdsVVdRaFNhTVNaUHcAzK3ZlAGYBzMzMzMzM9M_AAAAAAAAAAAAAAAAAAAAADMzMzMzM9M_CtejcD0Kxz9yKGh0dHBzOi8vbXNndWlkZXMuY29tAARVUxhtc2d1aWRlcy5jb20SOENVVTlKRjhIEmhlYWRlckJpZAgOMzAweDI1MBI0ODUxMzEyNTcSOENVN1E3NzFFAhJoZWFkZXJCaWQQMC4xODE0NTACTxI0ODUxMzEyNTcGMTM0JHBvcHVsYXItdHJlbmRzLmNvbQg1Ni4wAAAAAAAAAAA1QA5lYXN0X3NjCklBQi0zAAAAAAAAAAACEHBpbm5hY2xlGjB8MHx4dG1heD0zMzA0bW93eC1saXRlLTc5ZDhjZmY5ZmYtNDU5Z2owOENVN1E3NzFFLTQ4NTEzMTI1Ny0xMy00AjAGMjE4BDIzBkFEWCYyMDI1LTAzLTI0IDE1OjEyOjA0AARNQRZzcHJpbmdmaWVsZBoxNzQyODI5NzI0NjI3exSuR-F6hD97FK5H4XqEP3sUrkfheoQ_ACISOFBSMTEzSkdDAHhzc0J1Y2tldD0wfHNjaD0xfGNsdD0zfHRwaT0xfGZsX3JsPTF8c3NQcm9maWxlPTB8ZGJyPTF8dHBpPTEIAQAGMTAzAjEGYWRtAgAAAAAAAACAQ0ACAjACMAIwAjAAAgIxAACi7K-LuWUGMC4zAjJ3L97jkZ5HPxAwLjMwMDAwMBQyNjIyODU4NzM5CDc4NDkIZmFpbAIwAjACMEBydGItYXBwbmV4dXMtNzZkNzc0NmJjYi1md2Y5ai5TQwQCTgYABgAAABBwaW5uYWNsZT4xNzAwMDkwMDAxMTUxOTAwMzAwMDI1MDEwMDA5OTAwCmFkeC0xRDUwMTczOGE1NjNlZmZiMWI5MGE1MzI2YWU1MGZmZGUzXzEAEElBQjE5LTM2BjYxNQY3MzcCMAIwAjEAOmhvbWVwYWdlX3RlY2hub2xvZ3lfY29tcHV0aW5nBHY0AD4xNzAwMDkwMDAxMTUxOTAwMzAwMDI1MDEwMDA5OTAwAjACMQACDD-SnQyKtAe2tAfSsAectwfingwAGG1zZ3VpZGVzLmNvbZABQUQ4RmRtNE1CS202bU9aYjR3eGZXNkozWW5lMTZJME5RcHYyXzVpSG1lMzJVeTVzd3oyalJaaTc0ZmNRT01vTU16ZURQY2NsAAAAAAAocHViLUFEWC0xMTYzMTAxMDkxMzGIBAAwQURYLXB1Yi04MjY5ODU4ODY5NDU3OTUzKHB1Yi1BRFgtMTE2MzEwMTA5MTMxBB4yNTB4MjUwfDMwMHgyNTAGAAEAAAAA2AG8BZQFHjMwMHgyNTB8MjUweDI1MAABBlVTRAAAAAAAAPA_AAhOb25lAgAAAAAAAPC_Ck5FWFVTEDZiMGEyMjg0JjIwMjUtMDMtMjEgMDA6MDA6MDACLEY1STJrWm9JVXdsVVdRaFNhTVNaUHcAEjhDVVU5SkY4SAASOENVN1E3NzFFajI1fDIyfDcwfDMyfDE2fDQ4fDE5fDEzfDI2fDd8MjB8MTd8MTR8Mjd8MTE0fDM0fDE4fDE1AgEAAAAQRVhDSEFOR0UBAk4CABQyNjIyODU4NzM5AjIQYXBwbmV4dXOcCBhZQk5fYWRjb2RldjLGAhBFWENIQU5HRQAwRjVJMmtab0lVd2xVV1FoU2FNU1pQd18xAAAAAAAAAAAADldpbmRvd3MOMTExMTAxMQwxMC4wLjACZAAUZjgwMjVkNThmYw5CSURfQVBJFDI2MjI4NTg3MzkEVVMEVVMCARh2YTRrMHhEMWRjUHkGMjc4AAIAAgAAAAAAAAAAAAAAAAAAAQIBCGJhZHY4Zy11c2UxZC1lbnZveS1ydGItYXBwbmV4dXMtNQABAAQtMgpbNDYwXTMzMzMzM9M_RPrt68A5xz8AAAgPJDMzQWNyb3NzVGVzdDp0ZXN0MSpjcml0ZW9fZHVwOmludl9kdXBfZGMwQXNzZXRVcmxUaW1lb3V0VGVzdDp0ZXN0FmdtcDpERUZBVUxUQGUyNTZmZDFlOGRiZWJiM2FiNzc1OWFiNTRkMzIxYTc0AjAYbXNndWlkZXMuY29tCGh0dHAACAIAHkJTU19VTlJFQUNIQUJMRR5CU1NfVU5SRUFDSEFCTEUeQlNTX1VOUkVBQ0hBQkxFABxOT1RfQVBQTElDQUJMRRxOT1RfQVBQTElDQUJMRQIBQAZBRFgEexSuR-F6hD8AAAIAAgICAAIETkEETkEAAAAAAAAAAAAAAAAAAAAAsAkAAAIELTHyLgQAAAEKMDExMDkBAAAcTk9UX0FQUExJQ0FCTEUAQGFjM2RiYjNjNmZlNjEzMTE4ZjczM2I2ZjAxY2UyNjEyABRnb29nbGUuY29tlAUKAAAAAAQDDmRlZmxhdGUIZ3ppcA5lYXN0X3NjAAAAHE5PVF9BUFBMSUNBQkxFAgAADmNvbnRyb2wocHViLTgyNjk4NTg4Njk0NTc5NTMAAAAGNTQzAgESbW93eC1saXRlAAEBAgASMTM0LjAuMC4wDk5UIDEwLjAgQ2hyb21lIC0gV2luZG93cwEBAQEBAQ&bdata=sd2%3Dnull~iurl_l%3D20~vi25%3D25~ogerpm%3D0.3~dom_b%3D1.14~scd%3Dm
Source: global traffic	HTTP traffic detected: GET /sr/2722522032/SAFEFRAME.html?ule=3672&%2Ao0=b&%2Ax7pf2=M&0pyHHH=hh%3D8QD%7C%294HHp6yNiUT6U9f%7CC6%3DM%7CCUN0%3DDMMD&4N0=I2hcpMphE0MbpEbDD%28EhDYpEY18IhpIbuIi8&4Ui2=4fp&6pZ%2A6U=CAA7x%3A%2F%2FHxo%2AN0pxRy4H&7N0=I_9%28ubuYb&A7N0=swcY1FI&Axyp=FI8u&CAA7x=8&Hx7i=M&L0=&LiA76p=8&LiAhN0=E8M&Lj62=&NxN0=Y&UDAm7p=4Ui&dN=8%28bDIDc8DbYI%28%281Y%28%28D&fAd=M&fHp66=8&h06X0=b1M&hN0=&hip=8%28bDIDc8DbJ8%28bDIDc%28DbJ1MM&hp=M&htmlsrc=1&i04HiNf=CAA7x%3A%2F%2F747%2AUi6EA6pf0xRy4H&i0A8=I%29TTcawIG&i0AD=8YYcD8DYb&i0d=_47%2AUi6+s6pf0x&i7%29%2A=&iyA=_%21X2u6nrf%21%21%21rufOionp6%2F6Z6%2Au%2AOru2oik&jUxA7=M&jxC7=M&kkdd=u%21%7C%21%7C9WnHA%2Au3h&m0x76=8&m7U7=8&mhfQyyQpr7=M&o076=M&o076yfxA=&py6N0=8%28MMMcMMM88Y8cMMuMMMDYM8MMMccMM&xNkp=uMMrDYM&xh06X0=8ub&xxHy6Qdp6=%25%25%3FtSeXwX%29nsX9O%3AE8%3AY%25%25&xxU0=%7B%22xxyy%22%3A%22Tv%22%2C%22xxyAm%22%3A%22x76Nfo2NpU0%22%2C%22xxN7%22%3A%22818R%28%28R8uRM%22%2C%22xxxy%22%3A%22gn%22%7D&xy=gn&y0d=98Y81&y6N0=bIY8u8DY%28&yA7N0=&yCfHD=&yCfHu=&yN0=I%29T%28-%28%288S&yy=Tv&eobd=4YrCvRaaBNR%2FadaCrzBHNr_Cr_BP5b%2FhyCz.nBYPydMCe.eXB4%20YCyDB%2FDbCz%2Cz%2CieBYPydaCrzBHar%2Fd4YCrzr_znrXzWBNR%2FadMCezXn.qWBR%2Fadjx%20CzBR%2Fad%2FrDdMCzB4jYCrUrrs_sWnqB%2FDjCz.zzz%2CzB%20jFHar%2Fd4YC_seBNhCr%7Cs7PuBkMMCzB%2FNNhRDCz%2CzB%2F%20Cr%2CXznB%2Fh4d4YCrzr_znrXezB%2FDYHCz.zzz%2CzBR%2FadMCz.qUBHar%2FdR%2FadMCzBR%2FadaCrzB4aHCrX._rB5%20DjC_zz_neBMMCenXBb%2FhyCz.nBHar%2FdR%2Fadx%20Cz8zBh4Nd%20CW_nU_%2C_%2Cs%2CX%2Cq%2CeX%2CrU%2CXeBMyCeBh4NdYCWWnrzeB%2FxbCz%2Cz%2CieBDnhdMCn.__%2CeXn.zsB4YCzB%2FdJ%2FdMCnWq.nq%2CzBRNYCruDEN6A4HyDVwNAa32B%20Har%2FdMCn.nqBMjYCrresnWrWezszqrWUrsnWrrnr_qUezrzezWWszWssUrXrUsnUsesqzerXU_sWerqsrrseXU_nqUWsqn_WqrXUrerXUXzWrzrXW_rWqsrXXWUrssqresW_eeq_UnUs_Xq_eqnUBRNyCzB%2Fdj4CsLV_70eKfB%2FxjCz.zzz%2CzBDhhdvCvPvdDhhBH%2FdR%2FadMC__z.r_BP5YrhdMCz.qsBMR5YCXB44CcgB%20%20CVlBb%2FyCieBRNJCieB%20bCzB%2F%20HCr_.UqBLuCnnXXBxMdR%20CeBb%2FHCzBvj4CrB%20jC4h%2FNv5kNbaYBD55d4jP%2Fbd4YCBMYjCeWXrsrqerXBxMdjjCzBY%20CsBHar%2FdMCn.eqBjjCqeeUBRaydhCz.znWqBb4jCzBHJdbF%20Cz.nqBYJydHar%2FdMCen.eUBHN4d4YC_snBR%2Fad%2Fh4dMCr.sUBY%20rCeBb%204CzBHdD4vCWsXqBMdka%2FCz.zeBaD4jCB%20HP5Cn.nqBHN4dR%2FadMCz.__BHar%2FdNd4YCrzr_znrXzWBHN4dR%2FadaCezBx%20r_CzBbjCenBHar%2FdNdMCz.zeB%2Fbkd%2FCcBHN4dMC_qW.s_BHar%2FdR%2FadHNCe8ieUBR%2FadjHNCzBD55d4jP%2FbdMCeBHHCzB%20Har%2Fd4YC_snB%2FkHCee.zrBar%2FdMCezzzBJ%2FdMCr.eW%2CzB%2FDYhCz.zzz%2CzB4NYCXs_ener_WB%20jFHar%2FdMCiezzzBR%2Fad%2Fh4dx%20CzBxMd4%2F%20CDRjPdMNYYb%2FBHJRCz.nqBYrhdaCezB%20HarCn.nqBnh%20kCeezzBP5dy49Cz.nBYyyd4j%2F5ChNvvD%20abBYrhdMCz.qsB%2Fh4dMCeXn.zsBR%2Fad4%2Fh4dMCW.n_B%2FxJhCz.zzz%2CzBvjShbCeBbFh4%20P%2FbCieB%2FxJYCz.zzz%2CzBN47bkCzBN4NkCzBYJydHar%2Fd4YCBR%2Fad%2Fh%20dMCzBMNYCz.nBR%2Fad%2Fh4d%2FHCzB%20MYhCz.eseBNjShbdNYCeWBNjShbdPHb%2F%2FNYbCgQ%7CB4baab%2FdjD5dNYCrUrrs_sWnqB4RhhaSdjD5dNYCBYbjb%20jbYdjD5dNYCBHNbJDMNaNjSCz.nqBhP4CnB%20j%2FCW.rzszWn8iXBD%20djShbCeBDYMaxCrUrrs_sWnqBDyhCeBP5MNYCz.nzzzzzBMka%2FCz.zezB4RNYCBYj%20CbD4jd4%20BYyydb%2FhyCkDa4bBYyyChNvvD%20abBMYh%20DhYCzBYDa5CYvdedHnzdDMPHbd~z_B45yjC9PybhD
Source: global traffic	HTTP traffic detected: GET /log?logid=kfke&evtid=dmmra_enc&__q=AbIFxf7Brz9HACAcAAD-fa9HA_4PRsP-gvcMAOBQAAfQPwzesON_-P9__vv-QQFANTAxNzM4YTU2M2VmZmIxYjkwYTUzMjZhZTUwZmZkZTMkZG5fMV92MzBfYWJvdmVfcTA1DDAuMzAwMAwwLjAxMDACMARVUxI4Q1VVOUpGOEgSMTU1OTIxMjU0FnNwcmluZ2ZpZWxkDmVhc3Rfc2MQMC4xODE0NTAYbXNndWlkZXMuY29tAjEQMC4zMDAwMDAGMC4zBjQ2MBAxMDAuMDAwMAwwLjE4MTUabXNndWlkZXMuY29tLwIxBE1BBjQ2MAh0cnVlAjEOMzAweDI1MBBwaW5uYWNsZb6yiQUCNAwxMC4wLjX_y5frCyYyMDI1LTAzLTI0IDE1OjEyOjA0DkJJRF9BUEkGYWR4LEY1STJrWm9JVXdsVVdRaFNhTVNaUHeamZmZmZm5PwAzMzMzMzPTPwpzdGFnZQYyNjUGMTAx3gFNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTM0LjAuMC4wIFNhZmFyaS81MzcuMzYSMTM0LjAuMC4wDk5UIDEwLjAAAAAAAAAAAAIqwgJob21lcGFnZV90ZWNobm9sb2d5X2NvbXB1dGluZyxpYWJfY29tcHV0ZXJfc29mdHdhcmVfYW5kX2FwcGxpY2F0aW9ucyxpYWJfY29tcHV0aW5nLGlhYl9vcGVyYXRpbmdfc3lzdGVtcyxpYWJfdGVjaG5vbG9neV9hbmRfY29tcHV0aW5nLGxvbmdfdGFpbF9ob21lcGFnZV9jYXRjaGFsbDpob21lcGFnZV90ZWNobm9sb2d5X2NvbXB1dGluZxAwLjMwMDAwMAAMMC4zMDAwAjUGMTM0AjEEMTQENDAIMC4wMAgwLjMwDDAuMDAwMAIzBjAtMQIyDDAuMzkwMBQyNjIyODU4NzM5FjQ2MF9CSURfQVBJAjACMAIwAAAAAAAATkACMRQyNjIyODU4NzM5MGRtbS1zdGFnZS1mOTc5Yjc1OC04NTk5cgpmYWxzZQwwLjAwMDAKZmFsc2UENDAmcG9wdWxhci10cmVuZHMuY29tLwwwLjAwMDAMMC4wMDAwDDAuMDAwMAwwLjAwMDAMMC4wMDAwDDAuMDAwMAwwLjAwMDAMMC4wMDAwAjFAcnRiLWFwcG5leHVzLTc2ZDc3NDZiY2ItZndmOWouU0M6MjAyNS0wMy0yNCAxNToxMjowNC4zNzIxNDUwMTcUMjYyMjg1ODczORQyNjIyODU4NzM5DDAuMDAwMAwwLjAwMDAMMC4wMDAwBE5BAjACMAYwLTAGMC0wCmVxdWFsDDAuMzAwMAIwCmZhbHNlBkVNUz4xNzAwMDkwMDAxMTUxOTAwMzAwMDI1MDEwMDA5OTAwEDEuMDAwMDAwAmQELTF7FK5H4XrEP-F6FK5H4co_exSuR-F6lD8OU3VjY2VzcwZxOTkAAAAAAOSWQBZtb3d4XzE3XzQ2MAEBAQF3L97jkZ5HPwAAAAAAAPC_AQQxNzRtb3d4LWxpdGUtNzlkOGNmZjlmZi00NTlnagQ0MBBkbl8xX3YzMAw5LjYuMjR7FK5H4Xq0PwrXo3A9Csc_mpmZmZmZyT8pXI_C9SjMP3E9CtejcM0_uB6F61G4zj8AAAAAAADQP0jhehSuR9E_AAAAAAAAAAAAAAAAAAAAAHsUrkfhepQ_uB6F61G4nj97FK5H4XqkP7gehetRuK4_mpmZmZmZuT-4HoXrUbi-P6RwPQrXo8A_MzMzMzMzwz_D9Shcj8LFP1K4HoXrUcg_AjAGNTQzAAAADEdvb2dsZSBDaHJvbWUgLSBXaW5kb3dzCjAxMTA5HjMwMHgyNTB8MjUweDI1MAIxAAAAAAAA8D8AAAAAAADwPwZkZWYMcm93LXM2QGUyNTZmZDFlOGRiZWJiM2FiNzc1OWFiNTRkMzIxYTc0EGFwcG5leHVzEDZiMGEyMjg0BkFEWApAYWMzZGJiM2M2ZmU2MTMxMThmNzMzYjZmMDFjZTI2MTIAMDhDVTdRNzcxRS00ODUxMzEyNTctMTMtNAACMQASaGVhZGVyQmlkAAAAAAAA8L8AAAAAAADwvwAAAAAAAPC_AAAAAAAA8L8GMC4wAghOb25lAA HTTP/1.1Host: qsearch-a.akamaihd.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://googleads.g.doubleclick.net/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bping.php?sc=MA&vgd_hb_audit_2=155921254&vgd_rpth=%2Fv3%2Fadcode&vgd_cage=2&vgd_cdv=O1538&vgd_l2type=weaver&vgd_setup=c22&vgde_ydsp=%7B%225ON%22%3A%22Nff%22%2C%22GxNUJ7I1YJ4z7875%22%3A%22pJ1eJL%22%2C%22GxNUJ7VO4z7875%22%3A%22iiii%22%7D&vgd_hb_audit_1=8CUU9JF8H&prid=8PRVCXX19&vi=1742829123131120226&ugd=4&lper=100&wsip=170775234&requrl=https%3A%2F%2Fmsguides.com&ybn_cc_exp=0&vgd_tsce=L813&vgd_oresf=one&cid=8CU7Q771E&vgd_ydspr=1&gdpr=0&vgd_wlstp=0&lf=6&cc=US&mspa=0&ssld=%7B%22QQNN%22%3A%22Pb%22%2C%22QQN75%22%3A%22pJQ7nbEL8zyk8JjO%22%2C%22QQ8E%22%3A%22uFu.hh.uA.9%22%2C%22QQQN%22%3A%22cK%22%7D&vgd_oreqf=one&crid=485131257&vgde_bdata=QOfvzxjj~8xLjMjvf9~e8fXvfX~myJLEYv9.HH~OmYMGvu.uH~QNOvY1~L1Jv9%2C9%2Cou~OmYMjvf9~ejfLMQOvf9fX9AfH9h~8xLjMGvu9HA.ih~xLjM7UNv9~xLjMLf1MGv9~Q7OvXFW9iiFuf~L17v9.999%2C9~N7-ejfLMQOvXWu~8EvftWDmV~kGGv9~L88Ex1v9%2C9~LNvu~LEQMQOvf9fX9AfHu9~L1Oev9.999%2C9~xLjMGv9.iF~ejfLMxLjMGv9~xLjMjvf9~QjevfH.Xf~yN17vX99XAu~GGvuAH~JLEYv9.HH~ejfLMxLjMUNv949~EQ8MNvhXAFA%2CX%2CW%2CH%2Ci%2CuH%2CfF%2CHu~GYvu~EQ8MOvhhAf9u~LUJv9%2C9%2Cou~1AEMGvA.HX%2CuHA.9W~QOv9~LMBLMGvAF9.9H%2C9~x8OvfV1Z8gaQeY1PK_T4Q8~NejfLMGvA.Ai~G7OvffuWAhfFihXWWuXFi9hiuhAXAiWuiWuW9uFf9uAAfuAFXFihiihh9fXFu9FhWfhf9uhiW9F9HiAiffuFWAWWffhWHffFFfFHiHFiuAf9iifAuFHFfX9FiFhA9Xh9Hh9uiXf9~x8Yv9~LM7QvW%3DPXD6u0%2F~LU7v9.999%2C9~1EEMzvzmzM1EE~eLMxLjMGvXX9.fX~myOfEMGv9.iW~GxyOvH~QQvIK~NNvPb~JLYvou~x8Bvou~NJv9~LNevfH.h~%3DVvAAHH~UGMxNvu~JLev9~z7Qvf~N7vQEL8zyk8JjO~1yyMQ7mLJMQOv~G1Q8QfvuiF~GO7vuhHfWfiufA~G1Q8QuvuiF~UGM77v9~ONvW~ejfLMGvA.HX~77viuuF~xjYMEv9.9Ahi~JQ7v9~eBMJ-Nv9.hf~OBYMejfLMGvfF.H~e8QMQOvXWA~xLjMLEQMGvf.WF~ONfvu~JNQv9~eM1QzvhWHi~GMkjLv9.9u~j1Q7v%24%7Bj1Q7Mkj1y%7D~NemyvA.Ai~e8QMxLjMGv9.XX~ejfLM8MQOvf9fX9AfH9h~e8QMxLjMjvu9~UNfXv9~J7vfX~ejfLM8MGv9.9u~LJkMLvI~e8QMGvWXf.hW~ejfLMxLjMe8vu4ouF~xLjM7e8v9~1yyMQ7mLJMGvu~eev9~NejfLMQOvXWA~Lkevuu.9f~jfLMGvu999~BLMGvu.iH%2C9~L1OEv9.999%2C9~Q8OvHWXuAufXh~N7-ejfLMGvF.WW~xLjMLEQMUNv9~UGMQLNv1x7mMG8OOJL~eBxv9.hf~OfEMjvu9~NejfvA.Ai~AENkvu9Xf.Af~myMYQwv9.HH~OYYMQ7Lyvxz1kkJN7JO~OfEMGv9.ii~GMlv9u9Wi~LEQMGvuHA.9W~xLjMQLEQMGvh.AX~LUBEv9.999%2C9~z75EJvu~J-EQNmLJv9.WH~LUBOv9.999%2C9~8QDJkv%24%7BLJkLJQwMNmxz7JL%7D~8Q8kv9~OBYMejfLMQOv~xLjMLENMGv9~G8Ov9.HH~xLjMLEQMLev9~%24%7B%3Dj8Jz73Tmy%7D~8GNvu~zQlvf~7yQvfX9-fX9%7CA99-fX9~7Y-vfFX~Y-GU7v9~Y-wYJvu~kExLJ+vu&wshp=0&r=1742829123969&vgd_len=2343&vgd_end=1 HTTP/1.1Host: lg3.media.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://googleads.g.doubleclick.net/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bping.php?gdpr=0&vgd_tsce=L813&vgd_cdv=O1516&prid=8PRVCXX19&lper=100&wshp=0&vgd_oresf=one&cid=8CU7Q771E&requrl=https%3A%2F%2Fmsguides.com&ybn_cc_exp=0&vgd_wlstp=0&vgd_setup=c22&wsip=170775490&vgd_asn=7849&vgd_rpth=%2Fola&vgd_hb_audit_2=155921254&mspa=0&crid=485131257&vi=1742829124587765772&lf=6&vgde_bdata=QOfvzxjj~8xLjMjvf9~e8fXvfX~myJLEYv9.A~OmYMGvu.uH~QNOvY1~L1Jv9%2C9%2Cou~OmYMjvf9~ejfLMQOvf9fX9AfH9h~8xLjMGvu9HA.ih~xLjM7UNv9~xLjMLf1MGv9~Q7OvfFffWXWhAi~L17v9.999%2C9~N7-ejfLMQOvXWu~8EvftWDmV~kGGv9~L88Ex1v9%2C9~LNvf%2CH9A~LEQMQOvf9fX9AfHu9~L1Oev9.999%2C9~xLjMGv9.iF~ejfLMxLjMGv9~xLjMjvf9~QjevfH.Xf~yN17vX99XAu~GGvuAH~JLEYv9.A~ejfLMxLjMUNv949~EQ8MNvhXAFX%2CX%2CW%2CH%2Ci%2CuH%2CfF%2CHu~GYvu~EQ8MOvhhAf9u~LUJv9%2C9%2Cou~1AEMGvA.XX%2CuHA.9W~QOv9~LMBLMGvAhi.Ai%2C9~x8OvfV1Z8gaQeY1Ps8ajTq~NejfLMGvA.Ai~G7OvffuWAhfhu9W9ifhFfWAhffAfXiFu9f9u9hhW9hWWFfHfFWAFWuWi9ufHFXWhufiWffWuHFXAiFhWiAXhifHFfufHFH9hf9fHhXfhiWfHHhFfWWifuWhXuuiXFAFWXHiXuiAF~x8Yv9~LM7QvW%3DPXD6u0%2F~LU7v9.999%2C9~1EEMzvzmzM1EE~eLMxLjMGvXX9.fX~myOfEMGv9.iW~GxyOvH~QQvIK~NNvPb~JLYvou~x8Bvou~NJv9~LNevfX.Fi~%3DVvAAHH~UGMxNvu~JLev9~z7Qvf~N7vQEL8zyk8JjO~1yyMQ7mLJMQOv~GO7vuhHfWfiufH~UGM77v9~ONvW~ejfLMGvA.ui~77viuuF~xjYMEv9.9Ahi~JQ7v9~eBMJ-Nv9.Ai~OBYMejfLMGvuA.uF~e8QMQOvXWA~xLjMLEQMGvf.WF~ONfvu~JNQv9~eM1QzvhWHi~GMkjLv9.9u~j1Q7v%24%7Bj1Q7Mkj1y%7D~NemyvA.Ai~e8QMxLjMGv9.XX~ejfLM8MQOvf9fX9AfH9h~e8QMxLjMjvu9~UNfXv9~J7vuA~ejfLM8MGv9.9u~LJkMLvI~e8QMGvXih.WX~ejfLMxLjMe8vu4ouF~xLjM7e8v9~1yyMQ7mLJMGvu~eev9~NejfLMQOvXWA~Lkevuu.9f~jfLMGvu999~BLMGvf.uh%2C9~L1OEv9.999%2C9~Q8OvHWXuAufXh~N7-ejfLMGvou999~xLjMLEQMUNv9~UGMQLNv1x7mMG8OOJL~eBxv9.Ai~OfEMjvu9~NejfvA.Ai~AENkvuu99~myMYQwv9.A~OYYMQ7LyvE8zz1NjJ~OfEMGv9.iW~LEQMGvuHA.9W~xLjMQLEQMGvh.AX~LUBEv9.999%2C9~z75EJvu~J-EQNmLJvou~LUBOv9.999%2C9~8QDJkv%24%7BLJkLJQwMNmxz7JL%7D~8Q8kv9~OBYMejfLMQOv~xLjMLENMGv9~G8Ov9.A~xLjMLEQMLev9~%24%7B%3Dj8Jz73Tmy%7D~8GNvu~zQlvf~7yQvfX9-fX9%7CA99-fX9~7Y-vfF9~Y-GU7v9~Y-wYQvAf~Y-wYJv9~kExLJ+vu&ssld=%7B%22QQNN%22%3A%22Pb%22%2C%22QQN75%22%3A%22QEL8zyk8JjO%22%2C%22QQ8E%22%3A%22uFu.hh.uA.9%22%2C%22QQQN%22%3A%22cK%22%7D&vgd_ydspr=1&vgde_ydsp=%7B%221Ok%22%3A%22u%22%2C%225ON%22%3A%22J1Q7MQN%22%2C%227JQ7VO4z7875%22%3A%22uFA%22%2C%22GxNUJ7I1YJ4z7875%22%3A%223RIM1ONmOJef%22%2C%22GxNUJ7VO4z7875%22%3A%22XfF%22%2C%22N11%22%3A%22Xhhh~9%22%2C%22QEx%22%3A%22XuWX~9%22%7D&vgd_l2type=ola&vgd_oreqf=one&cc=US&vgd_hb_audit_1=8CUU9JF8H&ugd=4&sc=MA&r=1742829124349&vgd_cage=12&vgd_len=2435&vgd_end=1 HTTP/1.1Host: lg3.media.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://googleads.g.doubleclick.net/Accept-Encoding: gzip, deflate, br,
Source: global traffic	HTTP traffic detected: GET /i/ca-pub-8269858869457953?href=https%3A%2F%2Fmsguides.com&ers=2 HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/drt/s?v=r20120211 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=280&slotname=1770175538&adk=3856262152&adf=2712143399&pi=t.ma~as.1770175538&w=1200&abgtt=6&fwrn=4&fwrnh=100&lmt=1742816699&rafmt=1&format=1200x280&url=https%3A%2F%2Fmsguides.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121280&bpp=2&bdt=1625&idt=970&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=32&ady=88&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7Ce%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&fsb=1&dtd=976Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUmkzHFYYA5PpDIdVHYcTMYsts2YP0B8jEUunSDsrf9XHXlkxS_vrOPPXfieqTU
Source: global traffic	HTTP traffic detected: GET /pagead/adview?ai=CaDe5Q3bhZ63ELJ6YoPMP8eLY8QqW3Jz_eaavrb3lEmQQASCb_dIiYMm2_4iEpIARoAH9kor9A8gBAagDAcgDywSqBNsBT9B_Li8oFwWJnH0K9p_AzbZ1SLpmKfZQk6rKtdxsu_QRDCMD56HPfcE5ikQLYi5NGzKW3EG0PrIKejPZYSNY64wOwgz8rzmlFg3SyEvgNMdvPbDKh6V8UQ11xEcXYeYzRU_u7fYIVYIUHyhCp5hMB7OhhZk7i2zzT0NOOO49mjFGykijUeK6MmrMAFiZcgf-ynfgRzCJF6Rw5KLsyR6L54BrTJKB94AU0pCAR2uAdF017RaLop0dBFUiXoT8xBOzKWAZuo2svocnPDRhVS0vpwScufq65ZONvbnvwASV3J_B5QSIBYmq-YdQkgUECAQYAZIFBAgFGASAB6a2nDKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH4L2xAqgHjs4bqAeT2BuoB_DgG6gH7paxAqgH_p6xAqgHr76xAqgH98KxAtgHAfIHBBD7kgPSCCYIgGEQARgfMgKKAjoLgECAwICAgKCogAJIvf3BOlixy8u2gKOMA5oJ_QFodHRwczovL3d3dy5qdXN0YW5zd2VyLmNvbS9zaXAvanVzdGFuc3dlcj9yPXBwY3xnYXwxM3xVUy1UZWNoLVRvcGljLUNvbnRlbnQtQWxsLURldmljZXN8fCZKUEtXPSZKUERDPUMmSlBTVD1tc2d1aWRlcy5jb20mSlBBRD03MDY0MzE0Njc2NTImSlBNVD0mSlBOVz1kJkpQQUY9aW1nJkpQUkM9MSZKUENEPSZKUE9QPSZjbXBpZD0yMTQ5MTUwNDM5MyZhZ2lkPTE2NDY4Nzc2OTEwOSZmaWlkPSZ0Z3RpZD0mbnR3PWQmZHZjPWMmZ2FkX3NvdXJjZT01gAoByAsB2gwRCgsQoJzih97nzNOvARICAQPqDRMIob7mtoCjjAMVHgxoCB1xMTau2BMM0BUB-BYBgBcBshceChoIABIUcHViLTgyNjk4NTg4Njk0NTc5NTMYABgBuhcCOAGyGAkSAvlUGAEiAQDQGAHoGAE&sigh=S3TkrAbXJ-0&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCjtLzMnTS0l7HdIt5Skh3w5XAojcA_FJKGiaBtTNB3HyidN4xhfmhpBG27_UBsJd_oM9TUaAIWOorHUEt_gBE8tq6R_6PYts-5_EQvEhgB&vis=1&ebtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Attribution-Reporting-Eligible: event-source;navigation-source, triggerAttribution-Reporting-Support: webX-Client-Data: CLbgygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=280&slotname=1770175538&adk=3856262152&adf=2712143399&pi=t.ma~as.1770175538&w=1200&abgtt=6&fwrn=4&fwrnh=100&lmt=1742816699&rafmt=1&format=1200x280&url=https%3A%2F%2Fmsguides.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121280&bpp=2&bdt=1625&idt=970&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=32&ady=88&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7Ce%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2
Source: global traffic	HTTP traffic detected: GET /pagead/drt/ui HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://googleads.g.doubleclick.net/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /__media__/fonts/worksans-regular/worksans-regular.woff HTTP/1.1Host: contextual.media.netConnection: keep-aliveOrigin: https://contextual.media.netsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontSec-Fetch-Storage-Access: activeReferer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=3672&%2Ao0=b&%2Ax7pf2=M&0pyHHH=hh%3D8QD%7C%294HHp6yNiUT6U9f%7CC6%3DM%7CCUN0%3DDMMD&4N0=I2hcpMphE0MbpEbDD%28EhDYpEY18IhpIbuIi8&4Ui2=4fp&6pZ%2A6U=CAA7x%3A%2F%2FHxo%2AN0pxRy4H&7N0=I_9%28ubuYb&A7N0=swcY1FI&Axyp=FI8u&CAA7x=8&Hx7i=M&L0=&LiA76p=8&LiAhN0=E8M&Lj62=&NxN0=Y&UDAm7p=4Ui&dN=8%28bDIDc8DbYI%28%281Y%28%28D&fAd=M&fHp66=8&h06X0=b1M&hN0=&hip=8%28bDIDc8DbJ8%28bDIDc%28DbJ1MM&hp=M&htmlsrc=1&i04HiNf=CAA7x%3A%2F%2F747%2AUi6EA6pf0xRy4H&i0A8=I%29TTcawIG&i0AD=8YYcD8DYb&i0d=_47%2AUi6+s6pf0x&i7%29%2A=&iyA=_%21X2u6nrf%21%21%21rufOionp6%2F6Z6%2Au%2AOru2oik&jUxA7=M&jxC7=M&kkdd=u%21%7C%21%7C9WnHA%2Au3h&m0x76=8&m7U7=8&mhfQyyQpr7=M&o076=M&o076yfxA=&py6N0=8%28MMMcMMM88Y8cMMuMMMDYM8MMMccMM&xNkp=uMMrDYM&xh06X0=8ub&xxHy6Qdp6=%25%25%3FtSeXwX%29nsX9O%3AE8%3AY%25%25&xxU0=%7B%22xxyy%22%3A%22Tv%22%2C%22xxyAm%22%3A%22x76Nfo2NpU0%22%2C%22xxN7%22%3A%22818R%28%28R8uRM%22%2C%22xxxy%22%3A%22gn%22%7D&xy=gn&y0d=98Y81&y6N0=bIY8u8DY%28&yA7N0=&yCfHD=&yCfHu=&yN0=I%29T%28-%28%288S&yy=Tv&eobd=4YrCvRaaBNR%2FadaCrzBHNr_Cr_BP5b%2FhyCz.nBYPydMCe.eXB4%20YCyDB%2FDbCz%2Cz%2CieBYPydaCrzBHar%2Fd4YCrzr_znrXzWBNR%2FadMCezXn.qWBR%2Fadjx%20CzBR%2Fad%2FrDdMCzB4jYCrUrrs_sWnqB%2FDjCz.zzz%2CzB%20jFHar%2Fd4YC_seBNhCr%7Cs7PuBkMMCzB%2FNNhRDCz%2CzB%2F%20Cr%2CXznB%2Fh4d4YCrzr_znrXezB%2FDYHCz.zzz%2CzBR%2FadMCz.qUBHar%2FdR%2FadMCzBR%2FadaCrzB4aHCrX._rB5%20DjC_zz_neBMMCenXBb%2FhyCz.nBHar%2FdR%2Fadx%20Cz8zBh4Nd%20CW_nU_%2C_%2Cs%2CX%2Cq%2CeX%2CrU%2CXeBMyCeBh4NdYCWWnrzeB%2FxbCz%2Cz%2CieBDnhdMCn.__%2CeXn.zsB4YCzB%2FdJ%2FdMCnWq.nq%2CzBRNYCruDEN6A4HyDVwNAa32B%20Har%2FdMCn.nqBMjYCrresnWrWezszqrWUrsnWrrnr_qUezrzezWWszWssUrXrUsnUsesqzerXU_sWerqsrrseXU_nqUWsqn_WqrXUrerXUXzWrzrXW_rWqsrXXWUrssqresW_eeq_UnUs_Xq_eqnUBRNyCzB%2Fdj4CsLV_70eKfB%2FxjCz.zzz%2CzBDhhdvCvPvdDhhBH%2FdR%2FadMC__z.r_BP5YrhdMCz.qsBMR5YCXB44CcgB%20%20CVlBb%2FyCieBRNJCieB%20bCzB%2F%20HCr_.UqBLuCnnXXBxMdR%20CeBb%2FHCzBvj4CrB%20jC4h%2FNv5kNbaYBD55d4jP%2Fbd4YCBMYjCeWXrsrqerXBxMdjjCzBY%20CsBHar%2FdMCn.eqBjjCqeeUBRaydhCz.znWqBb4jCzBHJdbF%20Cz.nqBYJydHar%2FdMCen.eUBHN4d4YC_snBR%2Fad%2Fh4dMCr.sUBY%20rCeBb%204CzBHdD4vCWsXqBMdka%2FCz.zeBaD4jCB%20HP5Cn.nqBHN4dR%2FadMCz.__BHar%2FdNd4YCrzr_znrXzWBHN4dR%2FadaCezBx%20r_CzBbjCenBHar%2FdNdMCz.zeB%2Fbkd%2FCcBHN4dMC_qW.s_BHar%2FdR%2FadHNCe8ieUBR%2FadjHNCzBD55d4jP%2FbdMCeBHHCzB%20Har%2Fd4YC_snB%2FkHCee.zrBar%2FdMCezzzBJ%2FdMCr.eW%2CzB%2FDYhCz.zzz%2CzB4NYCXs_ener_WB%20jFHar%2FdMCiezzzBR%2Fad%2Fh4dx%20CzBxMd4%2F%20CDRjPdMNYYb%2FBHJR
Source: global traffic	HTTP traffic detected: GET /__media__/fonts/worksans-medium/worksans-medium.woff HTTP/1.1Host: contextual.media.netConnection: keep-aliveOrigin: https://contextual.media.netsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontSec-Fetch-Storage-Access: activeReferer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=3672&%2Ao0=b&%2Ax7pf2=M&0pyHHH=hh%3D8QD%7C%294HHp6yNiUT6U9f%7CC6%3DM%7CCUN0%3DDMMD&4N0=I2hcpMphE0MbpEbDD%28EhDYpEY18IhpIbuIi8&4Ui2=4fp&6pZ%2A6U=CAA7x%3A%2F%2FHxo%2AN0pxRy4H&7N0=I_9%28ubuYb&A7N0=swcY1FI&Axyp=FI8u&CAA7x=8&Hx7i=M&L0=&LiA76p=8&LiAhN0=E8M&Lj62=&NxN0=Y&UDAm7p=4Ui&dN=8%28bDIDc8DbYI%28%281Y%28%28D&fAd=M&fHp66=8&h06X0=b1M&hN0=&hip=8%28bDIDc8DbJ8%28bDIDc%28DbJ1MM&hp=M&htmlsrc=1&i04HiNf=CAA7x%3A%2F%2F747%2AUi6EA6pf0xRy4H&i0A8=I%29TTcawIG&i0AD=8YYcD8DYb&i0d=_47%2AUi6+s6pf0x&i7%29%2A=&iyA=_%21X2u6nrf%21%21%21rufOionp6%2F6Z6%2Au%2AOru2oik&jUxA7=M&jxC7=M&kkdd=u%21%7C%21%7C9WnHA%2Au3h&m0x76=8&m7U7=8&mhfQyyQpr7=M&o076=M&o076yfxA=&py6N0=8%28MMMcMMM88Y8cMMuMMMDYM8MMMccMM&xNkp=uMMrDYM&xh06X0=8ub&xxHy6Qdp6=%25%25%3FtSeXwX%29nsX9O%3AE8%3AY%25%25&xxU0=%7B%22xxyy%22%3A%22Tv%22%2C%22xxyAm%22%3A%22x76Nfo2NpU0%22%2C%22xxN7%22%3A%22818R%28%28R8uRM%22%2C%22xxxy%22%3A%22gn%22%7D&xy=gn&y0d=98Y81&y6N0=bIY8u8DY%28&yA7N0=&yCfHD=&yCfHu=&yN0=I%29T%28-%28%288S&yy=Tv&eobd=4YrCvRaaBNR%2FadaCrzBHNr_Cr_BP5b%2FhyCz.nBYPydMCe.eXB4%20YCyDB%2FDbCz%2Cz%2CieBYPydaCrzBHar%2Fd4YCrzr_znrXzWBNR%2FadMCezXn.qWBR%2Fadjx%20CzBR%2Fad%2FrDdMCzB4jYCrUrrs_sWnqB%2FDjCz.zzz%2CzB%20jFHar%2Fd4YC_seBNhCr%7Cs7PuBkMMCzB%2FNNhRDCz%2CzB%2F%20Cr%2CXznB%2Fh4d4YCrzr_znrXezB%2FDYHCz.zzz%2CzBR%2FadMCz.qUBHar%2FdR%2FadMCzBR%2FadaCrzB4aHCrX._rB5%20DjC_zz_neBMMCenXBb%2FhyCz.nBHar%2FdR%2Fadx%20Cz8zBh4Nd%20CW_nU_%2C_%2Cs%2CX%2Cq%2CeX%2CrU%2CXeBMyCeBh4NdYCWWnrzeB%2FxbCz%2Cz%2CieBDnhdMCn.__%2CeXn.zsB4YCzB%2FdJ%2FdMCnWq.nq%2CzBRNYCruDEN6A4HyDVwNAa32B%20Har%2FdMCn.nqBMjYCrresnWrWezszqrWUrsnWrrnr_qUezrzezWWszWssUrXrUsnUsesqzerXU_sWerqsrrseXU_nqUWsqn_WqrXUrerXUXzWrzrXW_rWqsrXXWUrssqresW_eeq_UnUs_Xq_eqnUBRNyCzB%2Fdj4CsLV_70eKfB%2FxjCz.zzz%2CzBDhhdvCvPvdDhhBH%2FdR%2FadMC__z.r_BP5YrhdMCz.qsBMR5YCXB44CcgB%20%20CVlBb%2FyCieBRNJCieB%20bCzB%2F%20HCr_.UqBLuCnnXXBxMdR%20CeBb%2FHCzBvj4CrB%20jC4h%2FNv5kNbaYBD55d4jP%2Fbd4YCBMYjCeWXrsrqerXBxMdjjCzBY%20CsBHar%2FdMCn.eqBjjCqeeUBRaydhCz.znWqBb4jCzBHJdbF%20Cz.nqBYJydHar%2FdMCen.eUBHN4d4YC_snBR%2Fad%2Fh4dMCr.sUBY%20rCeBb%204CzBHdD4vCWsXqBMdka%2FCz.zeBaD4jCB%20HP5Cn.nqBHN4dR%2FadMCz.__BHar%2FdNd4YCrzr_znrXzWBHN4dR%2FadaCezBx%20r_CzBbjCenBHar%2FdNdMCz.zeB%2Fbkd%2FCcBHN4dMC_qW.s_BHar%2FdR%2FadHNCe8ieUBR%2FadjHNCzBD55d4jP%2FbdMCeBHHCzB%20Har%2Fd4YC_snB%2FkHCee.zrBar%2FdMCezzzBJ%2FdMCr.eW%2CzB%2FDYhCz.zzz%2CzB4NYCXs_ener_WB%20jFHar%2FdMCiezzzBR%2Fad%2Fh4dx%20CzBxMd4%2F%20CDRjPdMNYYb%2FBHJRCz
Source: global traffic	HTTP traffic detected: GET /__media__/fonts/Raleway-bold/Raleway-bold.woff HTTP/1.1Host: contextual.media.netConnection: keep-aliveOrigin: https://contextual.media.netsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontSec-Fetch-Storage-Access: activeReferer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=3685&.2.V=O&2.%297=jtt-POt&22czTdW7T=%25%25%3F1QpbkbJI%21b%28R%3A_o%3AO%25%25&22iV=%7B%2222zz%22%3A%22ND%22%2C%2222z89%22%3A%226728+DET.X53.7iV%22%2C%2222.E%22%3A%22ogoxSSxojxt%22%2C%22222z%22%3A%22AI%22%7D&2HVTbV=ojm&2z=AI&5VET=t&5VETzX28=&7zT.V=oStttKtttotKoSttjtttPOtotttKKtt&82z7=U4oj&8E.V=%21Qgnnju&9EiE=o&9HXdzzd7-E=t&9V2ET=o&E.V=4v%28SjmjOm&G2~E=t&Gi28E=t&H.V=&H7=t&HVTbV=mgt&HZ7=oSmP4PKoPjYoSmP4PKSPjYgtt&L2E7X3=t&L5V=m&T7fLTi=~88E2%3A%2F%2Fc25L.V72xzyc&V7zccc=HH%3DodP%7CJycc7Tz.ZiNTi%28X%7C~T%3Dt%7C~i.V%3DPttP&W.=oSmP4PKoPjojooPtPPg&X8W=t&Xc7TT=o&ZEJL=&ZV8P=oOOKPoPOm&ZV8o=4JNNKqk4F&ZVW=vyELiZT+%21T7XV2&ZVycZ.X=~88E2%3A%2F%2FEyELiZT_8T7XV2xzyc&Zz8=v%2AbL%2AITTm%2FfRI%2AZ-%2A-3%2F77m%2AI735ImZR%2F5I&c2EZ=t&htmlsrc=1&iP89E7=G7ZW7T&kkdd=3H%7CW%7CuAnh%2A93H&lGT3=&lV=&lZ282=ZH8H%3Dt%7C%7CZH8f%3Dt%7C%7CH8V%3DP4m%7C%7C8289E7%3D_otmt4%7C%7C8H89E7%3DWSot%7C%7C8Ez%3DO%7C%7C8z%3Do&lZ8.V=KtttotKoS&lZ8ET7=o&lZ8H.V=_Po&lZ8Z=Z8yX&lZEz=ott&lZi2=8H.V%3D_Po%7C%7Cic.V%3DWSot%7C%7C889E7%3DottoK%7C%7CE8%3Do%7C%7Cz8T%3Dtxttm%7C%7CTEz%3DtxPg%7C%7CGTEz%3Do%7C%7C88V%3Dt&lZiy5=FbM%3Dt%7C%7C%2A%21%3DD%21I%2AUQ%7C%7CAv%21M%3Dj4m%7C%7C%21%21J%3DS%7C%7CJb%3Do4jP%7C%7CNNbM%3DPbZl%21V834Is-o%29jZTm%7C%7C%21UbM%3DPt%7C%7CDb%3DmojS%7C%7CDbM%3D4%7C%7C%21v%21M%3DSmKjK4K4omjtmPmOPm4%7C%7CAb%3DmPSS&y.V=tjjSgKoo_OOSo_mSSm_Hogj_zZSZZ3zHtzjK&yiZ3=yX7&z.V=4JNS0SSoQ&z8E.V=&zT.V=m4OojoPOS&zVW=%28oOj4&zz=ND&z~XcP=&z~Xcj=&~88E2=o&eobd=4YrCvRaaBNR%2FadaCrzBHNr_Cr_BP5b%2FhyCz.XXBYPydMCe.eXB4%20YCyDB%2FDbCz%2Cz%2CieBYPydaCrzBHar%2Fd4YCrzr_znrXzWBNR%2FadMCezXn.qWBR%2Fadjx%20CzBR%2Fad%2FrDdMCzB4jYC_UszqqUerB%2FDjCz.zzz%2CzB%20jFHar%2Fd4YC_seBNhCr%7Cs7PuBkMMCzB%2FNNhRDCz%2CzB%2F%20CeB%2Fh4d4YCrzr_znrXezB%2FDYHCz.zzz%2CzBR%2FadMCz.qUBHar%2FdR%2FadMCzBR%2FadaCrzB4aHCrX._rB5%20DjC_zz_neBMMCenXBb%2FhyCz.XXBHar%2FdR%2Fadx%20Cz8zBh4Nd%20CW_nUn%2C_%2Cs%2CX%2Cq%2CeX%2CrU%2CXeBMyCeBh4NdYCWWnrzeB%2FxbCz%2Cz%2CieBDnhdMCn.X_%2CeXn.zsB4YCzB%2FdJ%2FdMCnUz.zX%2CzBRNYCruDEN6A4HyDVgG384NB%20Har%2FdMCn.nqBMjYCrresnWrUqW_sse_UqzWqeWn_nqseqseszeUrzennrenU_UqWqqWWzr_UezUWsrWrzeWqszUzXqnqrreUsnssrrWsXrrUUrUXqXUqenrzqqrneUXUr_zUqUWnz_WzXWzeq_rzBRNyCzB%2Fdj4CsLV_70eKfB%2FxjCz.zzz%2CzBDhhdvCvPvdDhhBH%2FdR%2FadMC__z.r_BP5YrhdMCz.qsBMR5YCXB44CcgB%20%20CVlBb%2FyCieBRNJCieB%20bCzB%2F%20HCrX.WBLuCnnXXBxMdR%20CeBb%2FHCzBvj4CrB%20jC4h%2FNv5kNbaYBD55d4jP%2Fbd4YCBMD4N4rCeqUBMYjCeWXrsrqernBMD4N4eCeqUBxMdjjCzBY%20CsBHar%2FdMCn.X_BjjCqeeUBRay
Source: global traffic	HTTP traffic detected: GET /bql.php?vgd_len=7306&&vgd_l2type=ola&fp=13kLnkypIugqLWxj0sLpppYfTJbqSC6m-aN--zU9UANHNgx_dScKdUKTSPOk3H3wUy7LqJfmPlbLvdII-0G3wyYx307jHtcxCy-fepLp_T70F-uX2LO2wNkLDDPBc6iW4mgDcg9nuew%3D&cme=ok7z-tUSUuFVh5GGGoZdV_vG4VAR96sonDRIo50K4BMVpOa8lxLjkldskfzul-MKMCxY5YvadoB-2Tt38uxNVNtaqNaSLqsRdREJn_cX80zyz4sYg4M94y3rtOJe49b-iaUzVqLPFCsTysy82MyVYT59N_VNItqY0b3DF7zXmTh8xEDQGTux_kMVmoGuiabG2V0oI-weBkfnSDqXgOYNoqMjdbRWULHQFNeBCM4pe2FoRszTVGpzyttXOZyL08V7553kcIKk-PoNuMhUUafyaty_6sktFqQMchH3B8A15P3b8QMuMBn11aaaHbdyN6m9cx11YYM15cDPHHH2SBKmDw%3D%3D%7C%7Cd9vPLM1tRn-WLhCjY8-_mw%3D%3D%7Ct70VQkp5hFEq_Mpo4GcvlZl40KzsRjnW%7Ca0AmFUYXmD4u8YqFUhzY218uicb3s47_oeDRZgozgaM%3D%7CcPcb3VhU0BVjXgWFWEAzinttU1oq1ouO%7CTYgZYAhl6-mQmHqj14Sq9cNRfijM34GT4vAP7ZnNrp2xzrOVlrarw1MtLWmIOHY-iuauD-yXZih3xbgKO8xsMCxYnfdbcEwM9FGSoTCHotC8kWQ5fS2UsMTFn3mN35JKIbtCP-vnpjco5dhkOQcLmLwXDT7watJFSSirzMKKPZ2QnHMIOMSQvY9__FMdSeh3PUYZaoJU3Al6v_FYpSh1AQCR2hDvfU6Veqk7iSqFaQlCt1LWkoeU_nMnOCID8AD4Ck7z2XyQtP_dVpRe41hn1wzWs4e-AxuBl6NJqiKxuGtisENVRwu51W_2wxSUsivrLNgLZSAlukAUGYa2SSJA96NdUmtAjZb2MG2BRqRRULIxLnhLV8hY7B2l289d2wWI6pvECrALxPMMIArSzBFoxdV19tFBq9k6023TFUx3JwvY9Zzkjt114-nvSXuNRu2Q4gq7Qgde4p6LTmhoVTzcLw%3D%3D%7Cu8A6SM53vAcxkZY9VHWafLSuY-HKDieQ%7Cgx3D6jWGHsfkL2Qylz9cJh5jjqTfFXux%7C&subBdr=134&bdrid=460&ksu=224&fdkt=475&vgde_kbbh=ffoyxQJuOUBO&kwd[]=Check+Your+Unclaimed+Funds&kwt[]=475&kbc[]=dd351f16a13e28936a7902c2e7d53cde.d2s&kwp[]=1&kid[]=353782725&kbc2[]=eset%3D1%7Ce_st%3D70%7Ce_tks%3D0%7Ck_p_r%3D3%7Cakp%3D12%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7Crcid%3D181782%7Cclpr%3D1.000000%7Ccllvl%3D2%7Ctts%3D0.0156%7C24%3D111%7C25%3D0%7C22%3D0.0202%7C23%3D0.1416%7C7%3D0.0003%7C8%3D032402%7C13%3D0.0747%7C14%3D032411%7Ckus%3D0.4075%7Ckucs%3D0.3605%7Ckcucs%3D0.5365%7Ckssks%3D5.0000%7Cclid_fz%3D14873%7Cclid_serp%3D14873%7Cokt%3D475%7Cfc_bkt%3D475%7Cbdkt%3D475%7Cps%3D0.960%7Cps_id%3D1%7Cc1_7%3D0.0007%7Cc1_kus%3D0.4224&ktd[]=1180596124591933763840&kwd[]=Free+Window+11+Product+Key&kwt[]=492&kbc[]=937bc12ac324664cdb53a912a77a5c39.d2s&kwp[]=2&kid[]=383620239&kbc2[]=rukr%3D1%7Cakp%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7Crcid%3D25345%7Cclpr%3D0.937600%7Ccllvl%3D5%7Ctts%3D0.0217%7C24%3D158%7C25%3D1%7C22%3D0.4948%7C23%3D0.7027%7C7%3D0.0007%7C8%3D032402%7C13%3D0.0429%7C14%3D032411%7Ckus%3D0.4224%7Ckucs%3D0.4424%7Ckcucs%3D0.9997%7Ckssks%3D5.0000%7Cclid_fz%3D10384%7Cclid_serp%3D-1%7Cokt%3D492%7Cfc_bkt%3D492%7Cbdkt%3D492%7Cps%3D1.104%7Cps_id%3D1%7Cc1_7%3D0.0003%7Cc1_kus%3D0.4075&ktd[]=21250649175937077215488&kwd[]=Activate+Windows+11+for+Free&kwt[]=492&kbc[]=937bc12ac324664cdb53a912a77a5c39.d2s&kwp[]=3&kid[]=372824729&kbc2[]=rukr%3D2%7Cakp%3D2%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7Crcid%3D217625%7Cclpr%3D0.960100%7Ccllvl%3D5%7Ctts%3D0.0181%7C24%3D0%7C25%3D0%7C22%3D0.0651%7C23%3D0.7699%7C7%3D0.0005%7C8%3D032402%7C13%3D0.0392%7C14%3D032411%7Ckus%3D0.3676%7Ckucs%3D0.4440%7Ckcucs%3D0.9997%7Ckssks%3D5.0000%7Cclid_fz%3D15603%7Cclid_serp%3D-1%7Cokt%3D492%7Cfc_bkt%3D492%7Cbdkt%3D492%7Cps%3D1.104%7Cps_id%3D1&ktd[]=302367375
Source: global traffic	HTTP traffic detected: GET /bql.php?vgd_len=8567&&vgd_l2type=weaver&fp=13kLnkypIugqLWxj0sLpppYfTJbqSC6m-aN--zU9UANHNgx_dScKdUKTSPOk3H3wUy7LqJfmPlarrPQIvpcQmv3JrJx1BVWaqXPW6yoFXNiG7CRxF2FE-cQwii_4kaCQ2zJqkshxNoY%3D&cme=uFtDaIfrq4qSguhCI3brTatv_nJqbdvJgKAfGwdP_k3S8yxDXiaOne5dmtEZRU8tNigh-KzCXRjW4yALGvVeH6ajgrLzwq44BQXT7ys2Gc3HzyPEOZNDDUIkB4AMCkYxQANPzy2LJKTTRgCJ_T9Bz_-1PhlyzMUBM7CQQ1ZDeeXSZznE6SawZLImQt-hkkPXyqqGoOn7G7yXGYosalu5c-G0X2ZcPJWGQWn9t_8NhGu9kuPPQrPH609ju-6LBA8R-WM1-a-ZRoncLLF-QAMrW_L8zwHRS2AGnPHkuI9kpL499pZHW-CJJarRl-m-j7IBXV1C8AKe_ghtIyMmzY3TkQVMA3xtti7fiNX3EqRp2M9eFLrSDzUEnV4Kjy8idxxwXdq9ma5QrLasWhMYz6CdzsgOm-M4p8_DOaUsDloDgJOLe8g7f_g4p16-r0_69OG-ht4SdzCN7Yd4gez1lH669TBtD_vcXSi2wzAsNRfSoa8%3D%7C%7C93q-w6oysg_RqBm1ir42DPKBMl32PFDK%7Ca0AmFUYXmD4u8YqFUhzY218uicb3s47_oeDRZgozgaM%3D%7CcPcb3VhU0BVjXgWFWEAzinttU1oq1ouO%7CsYC017ND2GQdGNk_b4JWmNABakgkp0yuGHDxhC4vTaqndjU84HnRV2bbO1offPW_L03q8x6k2M4awzJLSEjqvBZj3oDYDhWvecQ5ERRwg6lWzfHQDCbiQ-NAS3HT8atD0_8-fWsDPe9PIrqCz1tmpRNqfkbM5EIhhXz7lWMz-441MfnE254nglw0-TnQnjB85duGNZWk92FTiwxgHHwOYv5VN3C00bwFQ9kX0u-Du7dQCJ3ZFFesF-W9fl7XE6m4YUD8zM5z0XMiUwEPZ_76qEGEThuLoRqm4dUo-s44uH76yFNF_do5qdHYQw4XlZc3KnO6V2bzTkylJnbhRdl1Vo3gJnN177kl7OIDpE0EbM6ogFueWODgW84HRUB_4xckISjtcxz-B5VfSbXsRqQXk-vsZFgf9oQ9IaKgDVPLz8Mji6TU7wS-cJrIvSGbs35PH5reMUKKBTUDs-gsDyNrBmSFmB1GAZAL%7Cu8A6SM53vAcxkZY9VHWafLSuY-HKDieQ%7Cgx3D6jWGHsfkL2Qylz9cJh5jjqTfFXux%7Cd9vPLM1tRn-WLhCjY8-_mw%3D%3D%7C&subBdr=134&bdrid=460&ksu=224&fdkt=475&vgde_kbbh=ffoyxQJuOUBO&kwd[]=Check+Your+Unclaimed+Funds&kwt[]=475&kbc[]=dd351f16a13e28936a7902c2e7d53cde.d2s&kwp[]=1&kid[]=353782725&kbc2[]=eset%3D1%7Ce_st%3D70%7Ce_tks%3D0%7Ck_p_r%3D3%7Cakp%3D12%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7Crcid%3D181782%7Cclpr%3D1.000000%7Ccllvl%3D2%7Ctts%3D0.0156%7C24%3D111%7C25%3D0%7C22%3D0.0202%7C23%3D0.1416%7C7%3D0.0004%7C8%3D032405%7C13%3D0.0747%7C14%3D032411%7Ckus%3D0.4075%7Ckucs%3D0.3605%7Ckcucs%3D0.5365%7Ckssks%3D5.0000%7Cclid_fz%3D14873%7Cclid_serp%3D14873%7Cokt%3D475%7Cfc_bkt%3D475%7Cbdkt%3D475%7Cps%3D0.960%7Cps_id%3D1%7Cc1_7%3D0.0012%7Cc1_kus%3D0.4224&ktd[]=1180596124591933763840&kwd[]=Free+Window+11+Product+Key&kwt[]=492&kbc[]=937bc12ac324664cdb53a912a77a5c39.d2s&kwp[]=2&kid[]=383620239&kbc2[]=rukr%3D1%7Cakp%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7Crcid%3D25345%7Cclpr%3D0.937600%7Ccllvl%3D5%7Ctts%3D0.0217%7C24%3D158%7C25%3D1%7C22%3D0.4948%7C23%3D0.7027%7C7%3D0.0012%7C8%3D032405%7C13%3D0.0429%7C14%3D032411%7Ckus%3D0.4224%7Ckucs%3D0.4424%7Ckcucs%3D0.9997%7Ckssks%3D5.0000%7Cclid_fz%3D10384%7Cclid_serp%3D-1%7Cokt%3D492%7Cfc_bkt%3D492%7Cbdkt%3D492%7Cps%3D1.104%7Cps_id%3D1%7Cc1_7%3D0.0004%7Cc1_kus%3D0.4075&ktd[]=21250649175937077215488&kwd[]=How+to+Check+Your+Phone+for+Malware&kwt[]=475&kbc[]=dd351f16a13e28936a7902c2e7d53cde.d2s&kwp[]=3&kid[]=353118100&kbc2[]=eset%3D1%7Ce_st%3D70%7Ce_tks%3D0%7Ck_p_r%3D4%7Cakp%3D17%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7Crcid%3D19091%7Cclpr%3D1.000000%7Ccllvl%3D1%7Ctts%3D0.0081%7C24%3D0%7C25%3D0%7C22%3D0.0651%7C23%3D0.6810%7C7%3D0.0003%7C8%3D032405%7C13%3D0.075
Source: global traffic	HTTP traffic detected: GET /pagead/drt/si?st=NO_DATA HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://googleads.g.doubleclick.net/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUlgpQkKjZkp9u4nXh-h35YqBxvWfu88GUzHmnEM_GsK9NZU2I80j__GuByapTY
Source: global traffic	HTTP traffic detected: GET /f/AGSKWxWb8IXAXAfzP9AL4B1KlIS2g2u7v4OegSh2ymsqbdv0FzoTJdCrdV_BnuQLqqlpEF8wJFeUsuU1RXlntfPtBUdelp7cR5YYj5MqJWD0TNVzcaMh-5wt5cGn8qHk9PNUhEJKa8K5SA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQyODI5MTI0LDczNTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9tc2d1aWRlcy5jb20vIixudWxsLFtbOCwiRGxXLUwtM0tKck0iXSxbOSwiZW4tVVMiXSxbMjMsIjE3NDI4MjkxMjMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwiIl0sWzI5LCJmYWxzZSJdXV0 HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /btr/view?ai=CaDe5Q3bhZ63ELJ6YoPMP8eLY8QqW3Jz_eaavrb3lEmQQASCb_dIiYMm2_4iEpIARoAH9kor9A8gBAagDAcgDywSqBNsBT9B_Li8oFwWJnH0K9p_AzbZ1SLpmKfZQk6rKtdxsu_QRDCMD56HPfcE5ikQLYi5NGzKW3EG0PrIKejPZYSNY64wOwgz8rzmlFg3SyEvgNMdvPbDKh6V8UQ11xEcXYeYzRU_u7fYIVYIUHyhCp5hMB7OhhZk7i2zzT0NOOO49mjFGykijUeK6MmrMAFiZcgf-ynfgRzCJF6Rw5KLsyR6L54BrTJKB94AU0pCAR2uAdF017RaLop0dBFUiXoT8xBOzKWAZuo2svocnPDRhVS0vpwScufq65ZONvbnvwASV3J_B5QSIBYmq-YdQkgUECAQYAZIFBAgFGASAB6a2nDKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH4L2xAqgHjs4bqAeT2BuoB_DgG6gH7paxAqgH_p6xAqgHr76xAqgH98KxAtgHAfIHBBD7kgPSCCYIgGEQARgfMgKKAjoLgECAwICAgKCogAJIvf3BOlixy8u2gKOMA5oJ_QFodHRwczovL3d3dy5qdXN0YW5zd2VyLmNvbS9zaXAvanVzdGFuc3dlcj9yPXBwY3xnYXwxM3xVUy1UZWNoLVRvcGljLUNvbnRlbnQtQWxsLURldmljZXN8fCZKUEtXPSZKUERDPUMmSlBTVD1tc2d1aWRlcy5jb20mSlBBRD03MDY0MzE0Njc2NTImSlBNVD0mSlBOVz1kJkpQQUY9aW1nJkpQUkM9MSZKUENEPSZKUE9QPSZjbXBpZD0yMTQ5MTUwNDM5MyZhZ2lkPTE2NDY4Nzc2OTEwOSZmaWlkPSZ0Z3RpZD0mbnR3PWQmZHZjPWMmZ2FkX3NvdXJjZT01gAoByAsB2gwRCgsQoJzih97nzNOvARICAQPqDRMIob7mtoCjjAMVHgxoCB1xMTau2BMM0BUB-BYBgBcBshceChoIABIUcHViLTgyNjk4NTg4Njk0NTc5NTMYABgBuhcCOAGyGAkSAvlUGAEiAQDQGAHoGAE&sigh=S3TkrAbXJ-0&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCjtLzMnTS0l7HdIt5Skh3w5XAojcA_FJKGiaBtTNB3HyidN4xhfmhpBG27_UBsJd_oM9TUaAIWOorHUEt_gBE8tq6R_6PYts-5_EQvEhgB&vis=1&ibtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Attribution-Reporting-Eligible: event-source=navigation-source, triggerAttribution-Reporting-Support: webX-Client-Data: CLbgygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=280&slotname=1770175538&adk=3856262152&adf=2712143399&pi=t.ma~as.1770175538&w=1200&abgtt=6&fwrn=4&fwrnh=100&lmt=1742816699&rafmt=1&format=1200x280&url=https%3A%2F%2Fmsguides.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121280&bpp=2&bdt=1625&idt=970&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=32&ady=88&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7Ce%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&fsb=
Source: global traffic	HTTP traffic detected: GET /cksync?type=g&cs=6&gdpr=0&gdpr_consent=&google_gid=CAESEDIFtrr2wjgzI5bThk_HZRU&google_cver=1 HTTP/1.1Host: cs.media.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://contextual.media.net/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: visitor-id=3858307258137836000V10
Source: global traffic	HTTP traffic detected: GET /log?logid=kfke&evtid=dmmra_enc&__q=AbIFxf7T7zdHACAcAADgfS8AAP4MAEAAggAAAABQAAfAAAzeMAIAAOA_4Pt-QQFAOGJmM2JmM2U3ZGRlMTYzMDM2MTIwMjhlYWQwNTE5Y2MiTk9OX0RFRFVDVEVEX0NCRFAMMC40NDAwDDAuMDEwMAIwBFVTEjhDVVU5SkY4SBIxNTU5MjEyNTQgV2VzdCBTcHJpbmdmaWVsZA5lYXN0X3NjDDAuNDQwMBhtc2d1aWRlcy5jb20CMAIwAjEMMC40NDAwCDAuNDQGNDYwEDEwMC4wMDAwDDAuNDQwMBhtc2d1aWRlcy5jb20CMQIxBE1BBjQ2MAh0cnVlDjMwMHgyNTAUdW5hZmZlY3RlZPR7AjQMMTAuMC41gLTolBQmMjAyNS0wMy0yNCAxNToxMjowMw5CSURfQVBJBmFkeCxBX2pZd01lQzVWRjNpLXJXS1Fnbk9BBjI2NQYxMDHeAU1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzQuMC4wLjAgU2FmYXJpLzUzNy4zNhIxMzQuMC4wLjAOTlQgMTAuMAAAAAAAAAAAAirCAmhvbWVwYWdlX3RlY2hub2xvZ3lfY29tcHV0aW5nLGlhYl9jb21wdXRlcl9zb2Z0d2FyZV9hbmRfYXBwbGljYXRpb25zLGlhYl9jb21wdXRpbmcsaWFiX29wZXJhdGluZ19zeXN0ZW1zLGlhYl90ZWNobm9sb2d5X2FuZF9jb21wdXRpbmcsbG9uZ190YWlsX2hvbWVwYWdlX2NhdGNoYWxsOmhvbWVwYWdlX3RlY2hub2xvZ3lfY29tcHV0aW5nCDAuNDQACDAuNDQCMAYxMzQGMC0xAjEIMC43MhI1NjgwOTk2MTIWNDYwX0JJRF9BUEkCMAIwAjESNTY4MDk5NjEyJnBvcHVsYXItdHJlbmRzLmNvbS8CMUBydGItYXBwbmV4dXMtNzZkNzc0NmJjYi00dzZqdy5TQwwwLjQ0MDACMApmYWxzZQZFTVM-MTcwMDA5MDAwMTA5MTcwMDMwMDAyNTAxMDAwOTkwMAJkBC0xEm1vd3hfbnVsbAEBAQEAAAAAAAAAAAAAAAAAAPC_AQQxNzRtb3d4LWxpdGUtNzlkOGNmZjlmZi12ZHBsNgw5LjYuMjQCMAY1NDMAAAAMR29vZ2xlIENocm9tZSAtIFdpbmRvd3MKMDEwODkeMzAweDI1MHwyNTB4MjUwQGIxYTk2Y2JjNzM5NDY4MzY0ZDE1ZjJmYTE5Y2RjYTg1EGFwcG5leHVzEDZiMGEyMjg0BkFEWApAMTQ4OGUxNDNlZmVmMGMxNjRiNGNjMDMwMmJjMjNhNWYAMjhDVTdRNzcxRS00ODUxMzEyNTctMTMtMjUAAjEAEmhlYWRlckJpZAAAAAAAAPC_AAAAAAAA8L8AAAAAAADwvwAAAAAAAPC_AghOb25lAA HTTP/1.1Host: qsearch-a.akamaihd.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?logid=kfke&evtid=plutol1&__q=Ab4EewKELwQCEAABAIAAAgAAAABAAAEABgAAQIABAAgAMNCYCXBGUDM1OTAwNDY0MDQ3MDM5NV85NTg3ODQ4NF8xNTU5MjEyNTQ0NjAxXzBAOGJmM2JmM2U3ZGRlMTYzMDM2MTIwMjhlYWQwNTE5Y2MAzK3ZlAGYBylcj8L1KNw_KVyPwvUo3D8oaHR0cHM6Ly9tc2d1aWRlcy5jb20EVVOAtOiUFN4BTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzNC4wLjAuMCBTYWZhcmkvNTM3LjM2GG1zZ3VpZGVzLmNvbRI4Q1VVOUpGOEgIDjMwMHgyNTAQMC40NDAwMDAkcG9wdWxhci10cmVuZHMuY29tDmVhc3Rfc2MyOENVN1E3NzFFLTQ4NTEzMTI1Ny0xMy0yNQZBRFgICG51cmwAAAAAAAAAUkCO5q-LuWUCMQAAAAAAAAAAQHJ0Yi1hcHBuZXh1cy03NmQ3NzQ2YmNiLTR3Nmp3LlNDPjE3MDAwOTAwMDEwOTE3MDAzMDAwMjUwMTAwMDk5MDACEDZiMGEyMjg0AmQCEGFwcG5leHVzPjE3MDAwOTAwMDEwOTE3MDAzMDAwMjUwMTAwMDk5MDBAYjFhOTZjYmM3Mzk0NjgzNjRkMTVmMmZhMTljZGNhODUCCgACAQACMQ5CSURfQVBJGG1zZ3VpZGVzLmNvbQA HTTP/1.1Host: hblg.media.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: visitor-id=3858307258137836000V10
Source: global traffic	HTTP traffic detected: GET /clog?logid=awelog&pixel_len_bucket=5221&__q=AbgP_wOPPAyccAi5CTRBwSEIw7EI7KFAEAv8lCDI44EEAXwu-ZwMsAEgAQgUXoAgmF1ACCoAcAO1wGQQgmjBCA4AjBIWmAHHAlMCAKACAAAAAAAAOOAAgQKAAdugDpGBIBxwAIAkFQMMqkYGWiAPOEu3DsJIAkkMDgCSgVzAD1AzNTkwMDQ2NDA0NzAzOTVfOTU4Nzg0ODRfMTU1OTIxMjU0NDYwMV8wQDhiZjNiZjNlN2RkZTE2MzAzNjEyMDI4ZWFkMDUxOWNjLEFfall3TWVDNVZGM2ktcldLUWduT0EAzK3ZlAGYBylcj8L1KNw_AAAAAAAAAAAAAAAAAAAAAClcj8L1KNw_KVyPwvUo3D-qAShodHRwczovL21zZ3VpZGVzLmNvbQAEVVMYbXNndWlkZXMuY29tEjhDVVU5SkY4SBJoZWFkZXJCaWQIDjMwMHgyNTASNDg1MTMxMjU3EjhDVTdRNzcxRQISaGVhZGVyQmlkEDAuNDQwMDAwAk8SNDg1MTMxMjU3BjEzNCRwb3B1bGFyLXRyZW5kcy5jb20IODUuMAAAAAAAAACAQUAOZWFzdF9zYwpJQUItMwAAAAAAAAAAAhR1bmFmZmVjdGVkGjB8MHx4dG1heD0zMzA0bW93eC1saXRlLTc5ZDhjZmY5ZmYtdmRwbDYyOENVN1E3NzFFLTQ4NTEzMTI1Ny0xMy0yNQIwBjIxOAQyMwZBRFgmMjAyNS0wMy0yNCAxNToxMjowMwAETUEgV2VzdCBTcHJpbmdmaWVsZBoxNzQyODI5NzI0MjI2exSuR-F6hD97FK5H4XqEP3sUrkfheoQ_ACISOFBSMTEzSkdDAHhzc0J1Y2tldD0wfHNjaD0xfGNsdD0yfHRwaT0xfGZsX3JsPTF8c3NQcm9maWxlPTB8ZGJyPTF8dHBpPTEIAQAGMTAzAjEGYWRtAgAAAAAAAAAAUkACAjACMAIwAjAAAgIxAACO5q-LuWUIMC40NAIxAAAAAAAAAAAQMC40NDAwMDASNTY4MDk5NjEyAAhmYWlsAjACMAIwQHJ0Yi1hcHBuZXh1cy03NmQ3NzQ2YmNiLTR3Nmp3LlNDBAJOBgAGAAAAFHVuYWZmZWN0ZWQ-MTcwMDA5MDAwMTA5MTcwMDMwMDAyNTAxMDAwOTkwMAphZHgtMUQ4YmYzYmYzZTdkZGUxNjMwMzYxMjAyOGVhZDA1MTljY18xABBJQUIxOS0zNgY2MTUGNzM3AjACMAIxADpob21lcGFnZV90ZWNobm9sb2d5X2NvbXB1dGluZwR2NAA-MTcwMDA5MDAwMTA5MTcwMDMwMDAyNTAxMDAwOTkwMAIwAjEAAgw_kp0MirQHtrQH0rAHnLcH4p4MABhtc2d1aWRlcy5jb22QAUFEOEZkbTRBRXhMb241aFFrOG9VZXNwdFVkZWdieGJVZkRtTF9OWENnbVViamdrMDNyeVZYdWZEVFUxZG5aeXE3TVpYTTRLegEAAAAAKHB1Yi1BRFgtMTE2MzEwMTA5MTMxkgQAMEFEWC1wdWItODI2OTg1ODg2OTQ1Nzk1MyhwdWItQURYLTExNjMxMDEwOTEzMQQeMjUweDI1MHwzMDB4MjUwAgABAAAAAPYBvAWUBR4zMDB4MjUwfDI1MHgyNTAAAQZVU0QAAAAAAADwPwAITm9uZQAAAAAAAADwvwpORVhVUxA2YjBhMjI4NCYyMDI1LTAzLTIxIDAwOjAwOjAwAixBX2pZd01lQzVWRjNpLXJXS1Fnbk9BABI4Q1VVOUpGOEgAEjhDVTdRNzcxRWoxNnwxN3w0OHwzMnwxOXwyNnwxM3w3MHwyNXwxNXwyMnwxMTR8MTh8MzR8MjB8N3wxNHwyNwIBAAAAEEVYQ0hBTkdFAQJOAgASNTY4MDk5NjEyAjIQYXBwbmV4dXOenAEMV2VhdmVyEEVYQ0hBTkdFADBBX2pZd01lQzVWRjNpLXJXS1Fnbk9BXzEAAAAAAAAAAAAOV2luZG93cw4xMTExMDExDDEwLjAuMAJkABRmODAyNWQ1OGZjDkJJRF9BUEkSNTY4MDk5NjEyAgEYdmE0azB4RDFkY1B5BjI3OAACAAIAAAAAAAAAAAAAAAAAAAECAQhiYWR2OGctdXNlMWQtZW52b3ktcnRiLWFwcG5leHVzLTQAAQAELTIKWzQ2MF0pXI_C9SjcPylcj8L1KNw_AAAIDyQzM0Fjcm9zc1Rlc3Q6dGVzdDEkY3JpdGVvX2R1cDppbnZfZHVwMEFzc2V0VXJsVGltZW91dFRlc3Q6dGVzdBZnbXA6REVGQVVMVEBiMWE5NmNiYzczOTQ2ODM2NGQxNWYyZmExOWNkY2E4NQIwGG1zZ3VpZGVzLmNvbQhodHRwAAgCAB5CU1NfVU5SRUFDSEFCTEUeQlNTX1VOUkVBQ0hBQkxFHkJTU19VTlJFQUNIQUJMRQAcTk9UX0FQUExJQ0FCTEUcTk9UX0FQUExJQ0FCTEUGQURYBHsUrkfheoQ_AAACAAICAgACBE5BBE5BAAAAAAAAAAAAAAAAAAAAALAJAAACBC0xnicCAAABCjAxMDg5AQIAHE5PVF9BUFBMSUNBQkxFAEAxNDg4ZTE0M2VmZWYwYzE2NGI0Y2MwMzAyYmMyM2E1ZgAUZ29vZ2xlLmNvbZQFCgAAAAAEAw5kZWZsYXRlCGd6aXAOZWFzdF9zYwAAABxOT1RfQVBQTElDQUJMRQIAAA5jb250cm9sKHB1Yi04MjY5ODU4ODY5NDU3OTUzAAAABjU0MwIBEm1vd3gtbGl0ZQABAQIAEjEzNC4wLjAuMA5OVCAxMC4wIENocm9tZSAtIFdpbmRvd3MBAQEBAQE&bdata=sd2%3Dnull~iurl_l%3D20~vi25%3D25~ogerpm%3D0.44~dom_b%3D1.14~scd%3Dma~rae%3D0%2C0%2C-1
Source: global traffic	HTTP traffic detected: GET /log?logid=kfke&evtid=plutol1&__q=Ab4EewKELwQCEAABAIAAAgAAAABAAAEABgAAQIABAAgAMNCYCXBGUDczNTE4MTk3NjM0MzhfMTY4MDAwOTg1NV8xNTU5MjEyNTQ0NjAxXzBANTAxNzM4YTU2M2VmZmIxYjkwYTUzMjZhZTUwZmZkZTMAzK3ZlAGYBzMzMzMzM9M_MzMzMzMz0z8oaHR0cHM6Ly9tc2d1aWRlcy5jb20EVVOAtOiUFN4BTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzNC4wLjAuMCBTYWZhcmkvNTM3LjM2GG1zZ3VpZGVzLmNvbRI4Q1VVOUpGOEgIDjMwMHgyNTAQMC4xODE0NTAkcG9wdWxhci10cmVuZHMuY29tDmVhc3Rfc2MwOENVN1E3NzFFLTQ4NTEzMTI1Ny0xMy00BkFEWAgIbnVybAAAAAAAAIBDQKLsr4u5ZQIydy_e45GeRz9AcnRiLWFwcG5leHVzLTc2ZDc3NDZiY2ItZndmOWouU0M-MTcwMDA5MDAwMTE1MTkwMDMwMDAyNTAxMDAwOTkwMAIQNmIwYTIyODQCZAIQYXBwbmV4dXM-MTcwMDA5MDAwMTE1MTkwMDMwMDAyNTAxMDAwOTkwMEBlMjU2ZmQxZThkYmViYjNhYjc3NTlhYjU0ZDMyMWE3NAIKAAIBAAIxDkJJRF9BUEkYbXNndWlkZXMuY29tAA HTTP/1.1Host: hblg.media.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: visitor-id=3858307258137836000V10
Source: global traffic	HTTP traffic detected: GET /clog?logid=awelog&pixel_len_bucket=5735&__q=AbgP_wOPPAyccAi5CTRBwSEIw7EI7KFAEAv8lCDI44EEAXwu-ZwMsAEgAQgUXoAgmF1ACCoAcAO1wGQQgmjBCA4AjBIemAHHAl8CAKACAAAAAAAAOOAAgQKAAdugDpGBIBxwAMAkFQMMqkYGWiAPOEu3DsJIAkkMDgCSgVzAD1A3MzUxODE5NzYzNDM4XzE2ODAwMDk4NTVfMTU1OTIxMjU0NDYwMV8wQDUwMTczOGE1NjNlZmZiMWI5MGE1MzI2YWU1MGZmZGUzLEY1STJrWm9JVXdsVVdRaFNhTVNaUHcAzK3ZlAGYBzMzMzMzM9M_AAAAAAAAAAAAAAAAAAAAADMzMzMzM9M_CtejcD0Kxz9yKGh0dHBzOi8vbXNndWlkZXMuY29tAARVUxhtc2d1aWRlcy5jb20SOENVVTlKRjhIEmhlYWRlckJpZAgOMzAweDI1MBI0ODUxMzEyNTcSOENVN1E3NzFFAhJoZWFkZXJCaWQQMC4xODE0NTACTxI0ODUxMzEyNTcGMTM0JHBvcHVsYXItdHJlbmRzLmNvbQg1Ni4wAAAAAAAAAAA1QA5lYXN0X3NjCklBQi0zAAAAAAAAAAACEHBpbm5hY2xlGjB8MHx4dG1heD0zMzA0bW93eC1saXRlLTc5ZDhjZmY5ZmYtNDU5Z2owOENVN1E3NzFFLTQ4NTEzMTI1Ny0xMy00AjAGMjE4BDIzBkFEWCYyMDI1LTAzLTI0IDE1OjEyOjA0AARNQRZzcHJpbmdmaWVsZBoxNzQyODI5NzI0NjI3exSuR-F6hD97FK5H4XqEP3sUrkfheoQ_ACISOFBSMTEzSkdDAHhzc0J1Y2tldD0wfHNjaD0xfGNsdD0zfHRwaT0xfGZsX3JsPTF8c3NQcm9maWxlPTB8ZGJyPTF8dHBpPTEIAQAGMTAzAjEGYWRtAgAAAAAAAACAQ0ACAjACMAIwAjAAAgIxAACi7K-LuWUGMC4zAjJ3L97jkZ5HPxAwLjMwMDAwMBQyNjIyODU4NzM5CDc4NDkIZmFpbAIwAjACMEBydGItYXBwbmV4dXMtNzZkNzc0NmJjYi1md2Y5ai5TQwQCTgYABgAAABBwaW5uYWNsZT4xNzAwMDkwMDAxMTUxOTAwMzAwMDI1MDEwMDA5OTAwCmFkeC0xRDUwMTczOGE1NjNlZmZiMWI5MGE1MzI2YWU1MGZmZGUzXzEAEElBQjE5LTM2BjYxNQY3MzcCMAIwAjEAOmhvbWVwYWdlX3RlY2hub2xvZ3lfY29tcHV0aW5nBHY0AD4xNzAwMDkwMDAxMTUxOTAwMzAwMDI1MDEwMDA5OTAwAjACMQACDD-SnQyKtAe2tAfSsAectwfingwAGG1zZ3VpZGVzLmNvbZABQUQ4RmRtNE1CS202bU9aYjR3eGZXNkozWW5lMTZJME5RcHYyXzVpSG1lMzJVeTVzd3oyalJaaTc0ZmNRT01vTU16ZURQY2NsAAAAAAAocHViLUFEWC0xMTYzMTAxMDkxMzGIBAAwQURYLXB1Yi04MjY5ODU4ODY5NDU3OTUzKHB1Yi1BRFgtMTE2MzEwMTA5MTMxBB4yNTB4MjUwfDMwMHgyNTAGAAEAAAAA2AG8BZQFHjMwMHgyNTB8MjUweDI1MAABBlVTRAAAAAAAAPA_AAhOb25lAgAAAAAAAPC_Ck5FWFVTEDZiMGEyMjg0JjIwMjUtMDMtMjEgMDA6MDA6MDACLEY1STJrWm9JVXdsVVdRaFNhTVNaUHcAEjhDVVU5SkY4SAASOENVN1E3NzFFajI1fDIyfDcwfDMyfDE2fDQ4fDE5fDEzfDI2fDd8MjB8MTd8MTR8Mjd8MTE0fDM0fDE4fDE1AgEAAAAQRVhDSEFOR0UBAk4CABQyNjIyODU4NzM5AjIQYXBwbmV4dXOcCBhZQk5fYWRjb2RldjLGAhBFWENIQU5HRQAwRjVJMmtab0lVd2xVV1FoU2FNU1pQd18xAAAAAAAAAAAADldpbmRvd3MOMTExMTAxMQwxMC4wLjACZAAUZjgwMjVkNThmYw5CSURfQVBJFDI2MjI4NTg3MzkEVVMEVVMCARh2YTRrMHhEMWRjUHkGMjc4AAIAAgAAAAAAAAAAAAAAAAAAAQIBCGJhZHY4Zy11c2UxZC1lbnZveS1ydGItYXBwbmV4dXMtNQABAAQtMgpbNDYwXTMzMzMzM9M_RPrt68A5xz8AAAgPJDMzQWNyb3NzVGVzdDp0ZXN0MSpjcml0ZW9fZHVwOmludl9kdXBfZGMwQXNzZXRVcmxUaW1lb3V0VGVzdDp0ZXN0FmdtcDpERUZBVUxUQGUyNTZmZDFlOGRiZWJiM2FiNzc1OWFiNTRkMzIxYTc0AjAYbXNndWlkZXMuY29tCGh0dHAACAIAHkJTU19VTlJFQUNIQUJMRR5CU1NfVU5SRUFDSEFCTEUeQlNTX1VOUkVBQ0hBQkxFABxOT1RfQVBQTElDQUJMRRxOT1RfQVBQTElDQUJMRQIBQAZBRFgEexSuR-F6hD8AAAIAAgICAAIETkEETkEAAAAAAAAAAAAAAAAAAAAAsAkAAAIELTHyLgQAAAEKMDExMDkBAAAcTk9UX0FQUExJQ0FCTEUAQGFjM2RiYjNjNmZlNjEzMTE4ZjczM2I2ZjAxY2UyNjEyABRnb29nbGUuY29tlAUKAAAAAAQDDmRlZmxhdGUIZ3ppcA5lYXN0X3NjAAAAHE5PVF9BUFBMSUNBQkxFAgAADmNvbnRyb2wocHViLTgyNjk4NTg4Njk0NTc5NTMAAAAGNTQzAgESbW93eC1saXRlAAEBAgASMTM0LjAuMC4wDk5UIDEwLjAgQ2hyb21lIC0gV2luZG93cwEBAQEBAQ&bdata=sd2%3Dnull~iurl_l%3D20~vi25%3D25~ogerpm%3D0.3~dom_b%3D1.14~scd%3Dm
Source: global traffic	HTTP traffic detected: GET /log?logid=kfke&evtid=dmmra_enc&__q=AbIFxf7Brz9HACAcAAD-fa9HA_4PRsP-gvcMAOBQAAfQPwzesON_-P9__vv-QQFANTAxNzM4YTU2M2VmZmIxYjkwYTUzMjZhZTUwZmZkZTMkZG5fMV92MzBfYWJvdmVfcTA1DDAuMzAwMAwwLjAxMDACMARVUxI4Q1VVOUpGOEgSMTU1OTIxMjU0FnNwcmluZ2ZpZWxkDmVhc3Rfc2MQMC4xODE0NTAYbXNndWlkZXMuY29tAjEQMC4zMDAwMDAGMC4zBjQ2MBAxMDAuMDAwMAwwLjE4MTUabXNndWlkZXMuY29tLwIxBE1BBjQ2MAh0cnVlAjEOMzAweDI1MBBwaW5uYWNsZb6yiQUCNAwxMC4wLjX_y5frCyYyMDI1LTAzLTI0IDE1OjEyOjA0DkJJRF9BUEkGYWR4LEY1STJrWm9JVXdsVVdRaFNhTVNaUHeamZmZmZm5PwAzMzMzMzPTPwpzdGFnZQYyNjUGMTAx3gFNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTM0LjAuMC4wIFNhZmFyaS81MzcuMzYSMTM0LjAuMC4wDk5UIDEwLjAAAAAAAAAAAAIqwgJob21lcGFnZV90ZWNobm9sb2d5X2NvbXB1dGluZyxpYWJfY29tcHV0ZXJfc29mdHdhcmVfYW5kX2FwcGxpY2F0aW9ucyxpYWJfY29tcHV0aW5nLGlhYl9vcGVyYXRpbmdfc3lzdGVtcyxpYWJfdGVjaG5vbG9neV9hbmRfY29tcHV0aW5nLGxvbmdfdGFpbF9ob21lcGFnZV9jYXRjaGFsbDpob21lcGFnZV90ZWNobm9sb2d5X2NvbXB1dGluZxAwLjMwMDAwMAAMMC4zMDAwAjUGMTM0AjEEMTQENDAIMC4wMAgwLjMwDDAuMDAwMAIzBjAtMQIyDDAuMzkwMBQyNjIyODU4NzM5FjQ2MF9CSURfQVBJAjACMAIwAAAAAAAATkACMRQyNjIyODU4NzM5MGRtbS1zdGFnZS1mOTc5Yjc1OC04NTk5cgpmYWxzZQwwLjAwMDAKZmFsc2UENDAmcG9wdWxhci10cmVuZHMuY29tLwwwLjAwMDAMMC4wMDAwDDAuMDAwMAwwLjAwMDAMMC4wMDAwDDAuMDAwMAwwLjAwMDAMMC4wMDAwAjFAcnRiLWFwcG5leHVzLTc2ZDc3NDZiY2ItZndmOWouU0M6MjAyNS0wMy0yNCAxNToxMjowNC4zNzIxNDUwMTcUMjYyMjg1ODczORQyNjIyODU4NzM5DDAuMDAwMAwwLjAwMDAMMC4wMDAwBE5BAjACMAYwLTAGMC0wCmVxdWFsDDAuMzAwMAIwCmZhbHNlBkVNUz4xNzAwMDkwMDAxMTUxOTAwMzAwMDI1MDEwMDA5OTAwEDEuMDAwMDAwAmQELTF7FK5H4XrEP-F6FK5H4co_exSuR-F6lD8OU3VjY2VzcwZxOTkAAAAAAOSWQBZtb3d4XzE3XzQ2MAEBAQF3L97jkZ5HPwAAAAAAAPC_AQQxNzRtb3d4LWxpdGUtNzlkOGNmZjlmZi00NTlnagQ0MBBkbl8xX3YzMAw5LjYuMjR7FK5H4Xq0PwrXo3A9Csc_mpmZmZmZyT8pXI_C9SjMP3E9CtejcM0_uB6F61G4zj8AAAAAAADQP0jhehSuR9E_AAAAAAAAAAAAAAAAAAAAAHsUrkfhepQ_uB6F61G4nj97FK5H4XqkP7gehetRuK4_mpmZmZmZuT-4HoXrUbi-P6RwPQrXo8A_MzMzMzMzwz_D9Shcj8LFP1K4HoXrUcg_AjAGNTQzAAAADEdvb2dsZSBDaHJvbWUgLSBXaW5kb3dzCjAxMTA5HjMwMHgyNTB8MjUweDI1MAIxAAAAAAAA8D8AAAAAAADwPwZkZWYMcm93LXM2QGUyNTZmZDFlOGRiZWJiM2FiNzc1OWFiNTRkMzIxYTc0EGFwcG5leHVzEDZiMGEyMjg0BkFEWApAYWMzZGJiM2M2ZmU2MTMxMThmNzMzYjZmMDFjZTI2MTIAMDhDVTdRNzcxRS00ODUxMzEyNTctMTMtNAACMQASaGVhZGVyQmlkAAAAAAAA8L8AAAAAAADwvwAAAAAAAPC_AAAAAAAA8L8GMC4wAghOb25lAA HTTP/1.1Host: qsearch-a.akamaihd.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bping.php?gdpr=0&vgd_tsce=L813&vgd_cdv=O1516&prid=8PRVCXX19&lper=100&wshp=0&vgd_oresf=one&cid=8CU7Q771E&requrl=https%3A%2F%2Fmsguides.com&ybn_cc_exp=0&vgd_wlstp=0&vgd_setup=c22&wsip=170775490&vgd_asn=7849&vgd_rpth=%2Fola&vgd_hb_audit_2=155921254&mspa=0&crid=485131257&vi=1742829124587765772&lf=6&vgde_bdata=QOfvzxjj~8xLjMjvf9~e8fXvfX~myJLEYv9.A~OmYMGvu.uH~QNOvY1~L1Jv9%2C9%2Cou~OmYMjvf9~ejfLMQOvf9fX9AfH9h~8xLjMGvu9HA.ih~xLjM7UNv9~xLjMLf1MGv9~Q7OvfFffWXWhAi~L17v9.999%2C9~N7-ejfLMQOvXWu~8EvftWDmV~kGGv9~L88Ex1v9%2C9~LNvf%2CH9A~LEQMQOvf9fX9AfHu9~L1Oev9.999%2C9~xLjMGv9.iF~ejfLMxLjMGv9~xLjMjvf9~QjevfH.Xf~yN17vX99XAu~GGvuAH~JLEYv9.A~ejfLMxLjMUNv949~EQ8MNvhXAFX%2CX%2CW%2CH%2Ci%2CuH%2CfF%2CHu~GYvu~EQ8MOvhhAf9u~LUJv9%2C9%2Cou~1AEMGvA.XX%2CuHA.9W~QOv9~LMBLMGvAhi.Ai%2C9~x8OvfV1Z8gaQeY1Ps8ajTq~NejfLMGvA.Ai~G7OvffuWAhfhu9W9ifhFfWAhffAfXiFu9f9u9hhW9hWWFfHfFWAFWuWi9ufHFXWhufiWffWuHFXAiFhWiAXhifHFfufHFH9hf9fHhXfhiWfHHhFfWWifuWhXuuiXFAFWXHiXuiAF~x8Yv9~LM7QvW%3DPXD6u0%2F~LU7v9.999%2C9~1EEMzvzmzM1EE~eLMxLjMGvXX9.fX~myOfEMGv9.iW~GxyOvH~QQvIK~NNvPb~JLYvou~x8Bvou~NJv9~LNevfX.Fi~%3DVvAAHH~UGMxNvu~JLev9~z7Qvf~N7vQEL8zyk8JjO~1yyMQ7mLJMQOv~GO7vuhHfWfiufH~UGM77v9~ONvW~ejfLMGvA.ui~77viuuF~xjYMEv9.9Ahi~JQ7v9~eBMJ-Nv9.Ai~OBYMejfLMGvuA.uF~e8QMQOvXWA~xLjMLEQMGvf.WF~ONfvu~JNQv9~eM1QzvhWHi~GMkjLv9.9u~j1Q7v%24%7Bj1Q7Mkj1y%7D~NemyvA.Ai~e8QMxLjMGv9.XX~ejfLM8MQOvf9fX9AfH9h~e8QMxLjMjvu9~UNfXv9~J7vuA~ejfLM8MGv9.9u~LJkMLvI~e8QMGvXih.WX~ejfLMxLjMe8vu4ouF~xLjM7e8v9~1yyMQ7mLJMGvu~eev9~NejfLMQOvXWA~Lkevuu.9f~jfLMGvu999~BLMGvf.uh%2C9~L1OEv9.999%2C9~Q8OvHWXuAufXh~N7-ejfLMGvou999~xLjMLEQMUNv9~UGMQLNv1x7mMG8OOJL~eBxv9.Ai~OfEMjvu9~NejfvA.Ai~AENkvuu99~myMYQwv9.A~OYYMQ7LyvE8zz1NjJ~OfEMGv9.iW~LEQMGvuHA.9W~xLjMQLEQMGvh.AX~LUBEv9.999%2C9~z75EJvu~J-EQNmLJvou~LUBOv9.999%2C9~8QDJkv%24%7BLJkLJQwMNmxz7JL%7D~8Q8kv9~OBYMejfLMQOv~xLjMLENMGv9~G8Ov9.A~xLjMLEQMLev9~%24%7B%3Dj8Jz73Tmy%7D~8GNvu~zQlvf~7yQvfX9-fX9%7CA99-fX9~7Y-vfF9~Y-GU7v9~Y-wYQvAf~Y-wYJv9~kExLJ+vu&ssld=%7B%22QQNN%22%3A%22Pb%22%2C%22QQN75%22%3A%22QEL8zyk8JjO%22%2C%22QQ8E%22%3A%22uFu.hh.uA.9%22%2C%22QQQN%22%3A%22cK%22%7D&vgd_ydspr=1&vgde_ydsp=%7B%221Ok%22%3A%22u%22%2C%225ON%22%3A%22J1Q7MQN%22%2C%227JQ7VO4z7875%22%3A%22uFA%22%2C%22GxNUJ7I1YJ4z7875%22%3A%223RIM1ONmOJef%22%2C%22GxNUJ7VO4z7875%22%3A%22XfF%22%2C%22N11%22%3A%22Xhhh~9%22%2C%22QEx%22%3A%22XuWX~9%22%7D&vgd_l2type=ola&vgd_oreqf=one&cc=US&vgd_hb_audit_1=8CUU9JF8H&ugd=4&sc=MA&r=1742829124349&vgd_cage=12&vgd_len=2435&vgd_end=1 HTTP/1.1Host: lg3.media.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: visitor-id=3858307258137836000V10
Source: global traffic	HTTP traffic detected: GET /bping.php?sc=MA&vgd_hb_audit_2=155921254&vgd_rpth=%2Fv3%2Fadcode&vgd_cage=2&vgd_cdv=O1538&vgd_l2type=weaver&vgd_setup=c22&vgde_ydsp=%7B%225ON%22%3A%22Nff%22%2C%22GxNUJ7I1YJ4z7875%22%3A%22pJ1eJL%22%2C%22GxNUJ7VO4z7875%22%3A%22iiii%22%7D&vgd_hb_audit_1=8CUU9JF8H&prid=8PRVCXX19&vi=1742829123131120226&ugd=4&lper=100&wsip=170775234&requrl=https%3A%2F%2Fmsguides.com&ybn_cc_exp=0&vgd_tsce=L813&vgd_oresf=one&cid=8CU7Q771E&vgd_ydspr=1&gdpr=0&vgd_wlstp=0&lf=6&cc=US&mspa=0&ssld=%7B%22QQNN%22%3A%22Pb%22%2C%22QQN75%22%3A%22pJQ7nbEL8zyk8JjO%22%2C%22QQ8E%22%3A%22uFu.hh.uA.9%22%2C%22QQQN%22%3A%22cK%22%7D&vgd_oreqf=one&crid=485131257&vgde_bdata=QOfvzxjj~8xLjMjvf9~e8fXvfX~myJLEYv9.HH~OmYMGvu.uH~QNOvY1~L1Jv9%2C9%2Cou~OmYMjvf9~ejfLMQOvf9fX9AfH9h~8xLjMGvu9HA.ih~xLjM7UNv9~xLjMLf1MGv9~Q7OvXFW9iiFuf~L17v9.999%2C9~N7-ejfLMQOvXWu~8EvftWDmV~kGGv9~L88Ex1v9%2C9~LNvu~LEQMQOvf9fX9AfHu9~L1Oev9.999%2C9~xLjMGv9.iF~ejfLMxLjMGv9~xLjMjvf9~QjevfH.Xf~yN17vX99XAu~GGvuAH~JLEYv9.HH~ejfLMxLjMUNv949~EQ8MNvhXAFA%2CX%2CW%2CH%2Ci%2CuH%2CfF%2CHu~GYvu~EQ8MOvhhAf9u~LUJv9%2C9%2Cou~1AEMGvA.HX%2CuHA.9W~QOv9~LMBLMGvAF9.9H%2C9~x8OvfV1Z8gaQeY1PK_T4Q8~NejfLMGvA.Ai~G7OvffuWAhfFihXWWuXFi9hiuhAXAiWuiWuW9uFf9uAAfuAFXFihiihh9fXFu9FhWfhf9uhiW9F9HiAiffuFWAWWffhWHffFFfFHiHFiuAf9iifAuFHFfX9FiFhA9Xh9Hh9uiXf9~x8Yv9~LM7QvW%3DPXD6u0%2F~LU7v9.999%2C9~1EEMzvzmzM1EE~eLMxLjMGvXX9.fX~myOfEMGv9.iW~GxyOvH~QQvIK~NNvPb~JLYvou~x8Bvou~NJv9~LNevfH.h~%3DVvAAHH~UGMxNvu~JLev9~z7Qvf~N7vQEL8zyk8JjO~1yyMQ7mLJMQOv~G1Q8QfvuiF~GO7vuhHfWfiufA~G1Q8QuvuiF~UGM77v9~ONvW~ejfLMGvA.HX~77viuuF~xjYMEv9.9Ahi~JQ7v9~eBMJ-Nv9.hf~OBYMejfLMGvfF.H~e8QMQOvXWA~xLjMLEQMGvf.WF~ONfvu~JNQv9~eM1QzvhWHi~GMkjLv9.9u~j1Q7v%24%7Bj1Q7Mkj1y%7D~NemyvA.Ai~e8QMxLjMGv9.XX~ejfLM8MQOvf9fX9AfH9h~e8QMxLjMjvu9~UNfXv9~J7vfX~ejfLM8MGv9.9u~LJkMLvI~e8QMGvWXf.hW~ejfLMxLjMe8vu4ouF~xLjM7e8v9~1yyMQ7mLJMGvu~eev9~NejfLMQOvXWA~Lkevuu.9f~jfLMGvu999~BLMGvu.iH%2C9~L1OEv9.999%2C9~Q8OvHWXuAufXh~N7-ejfLMGvF.WW~xLjMLEQMUNv9~UGMQLNv1x7mMG8OOJL~eBxv9.hf~OfEMjvu9~NejfvA.Ai~AENkvu9Xf.Af~myMYQwv9.HH~OYYMQ7Lyvxz1kkJN7JO~OfEMGv9.ii~GMlv9u9Wi~LEQMGvuHA.9W~xLjMQLEQMGvh.AX~LUBEv9.999%2C9~z75EJvu~J-EQNmLJv9.WH~LUBOv9.999%2C9~8QDJkv%24%7BLJkLJQwMNmxz7JL%7D~8Q8kv9~OBYMejfLMQOv~xLjMLENMGv9~G8Ov9.HH~xLjMLEQMLev9~%24%7B%3Dj8Jz73Tmy%7D~8GNvu~zQlvf~7yQvfX9-fX9%7CA99-fX9~7Y-vfFX~Y-GU7v9~Y-wYJvu~kExLJ+vu&wshp=0&r=1742829123969&vgd_len=2343&vgd_end=1 HTTP/1.1Host: lg3.media.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: visitor-id=3858307258137836000V10
Source: global traffic	HTTP traffic detected: GET /f/AGSKWxUGrm4sNcz8Xi9mzW8ERGAMJwgkhvYf395hyPa54NxnCDWVktrBoZBft28NcuOqQ9V60vysCn1E10cpy2vX8WMIaBjH0UAQkbxqiN-O-yyb8QnVgK3oNyZVGiQWDoF2zB2uBnrIew==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQyODI5MTI1LDE4NDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vbXNndWlkZXMuY29tLyIsbnVsbCxbWzgsIkRsVy1MLTNLSnJNIl0sWzksImVuLVVTIl0sWzIzLCIxNzQyODI5MTIzIl0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsIiJdLFsyOSwiZmFsc2UiXV1d HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cksync?type=g&cs=6&gdpr=0&gdpr_consent=&google_gid=CAESEDIFtrr2wjgzI5bThk_HZRU&google_cver=1 HTTP/1.1Host: cs.media.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://contextual.media.net/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: visitor-id=3858307258137836000V10
Source: global traffic	HTTP traffic detected: GET /bqi.php?vgd_len=3940&&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=155921254&vgd_aref=0&vgd_tsce=L813-S813&vgd_l2type=weaver&vgd_ydspr=1&vgd_cdv=O1538&vgd_cage=3&vgd_tpid=TE6YY3G&vgd_matchstr=bb%3D1_2%7CCommercialUrlOn%7Chr%3D0%7Chlid%3D2002&vgd_pgids=0&vgd_ecrid=1700090001091700300025010009900&vgd_oreqf=one&vgd_oresf=one&lf=3&prid=8PRVCXX19&cid=8CU7Q771E&crid=485131257&requrl=https%3A%2F%2Fmsguides.com&vi=1742829123131120226&ugd=4&cc=US&sc=MA&bdrid=460&subBdr=134&ybn_cc_exp=0&vgde_bdata=QOfvzxjj~8xLjMjvf9~e8fXvfX~myJLEYv9.HH~OmYMGvu.uH~QNOvY1~L1Jv9%2C9%2Cou~OmYMjvf9~ejfLMQOvf9fX9AfH9h~8xLjMGvu9HA.ih~xLjM7UNv9~xLjMLf1MGv9~Q7OvXFW9iiFuf~L17v9.999%2C9~N7-ejfLMQOvXWu~8EvftWDmV~kGGv9~L88Ex1v9%2C9~LNvu~LEQMQOvf9fX9AfHu9~L1Oev9.999%2C9~xLjMGv9.iF~ejfLMxLjMGv9~xLjMjvf9~QjevfH.Xf~yN17vX99XAu~GGvuAH~JLEYv9.HH~ejfLMxLjMUNv949~EQ8MNvhXAFA%2CX%2CW%2CH%2Ci%2CuH%2CfF%2CHu~GYvu~EQ8MOvhhAf9u~LUJv9%2C9%2Cou~1AEMGvA.HX%2CuHA.9W~QOv9~LMBLMGvAF9.9H%2C9~x8OvfV1Z8gaQeY1PK_T4Q8~NejfLMGvA.Ai~G7OvffuWAhfFihXWWuXFi9hiuhAXAiWuiWuW9uFf9uAAfuAFXFihiihh9fXFu9FhWfhf9uhiW9F9HiAiffuFWAWWffhWHffFFfFHiHFiuAf9iifAuFHFfX9FiFhA9Xh9Hh9uiXf9~x8Yv9~LM7QvW%3DPXD6u0%2F~LU7v9.999%2C9~1EEMzvzmzM1EE~eLMxLjMGvXX9.fX~myOfEMGv9.iW~GxyOvH~QQvIK~NNvPb~JLYvou~x8Bvou~NJv9~LNevfH.h~%3DVvAAHH~UGMxNvu~JLev9~z7Qvf~N7vQEL8zyk8JjO~1yyMQ7mLJMQOv~G1Q8QfvuiF~GO7vuhHfWfiufA~G1Q8QuvuiF~UGM77v9~ONvW~ejfLMGvA.HX~77viuuF~xjYMEv9.9Ahi~JQ7v9~eBMJ-Nv9.hf~OBYMejfLMGvfF.H~e8QMQOvXWA~xLjMLEQMGvf.WF~ONfvu~JNQv9~eM1QzvhWHi~GMkjLv9.9u~j1Q7v~NemyvA.Ai~e8QMxLjMGv9.XX~ejfLM8MQOvf9fX9AfH9h~e8QMxLjMjvu9~UNfXv9~J7vfX~ejfLM8MGv9.9u~LJkMLvI~e8QMGvWXf.hW~ejfLMxLjMe8vu4ouF~xLjM7e8v9~1yyMQ7mLJMGvu~eev9~NejfLMQOvXWA~Lkevuu.9f~jfLMGvu999~BLMGvu.iH%2C9~L1OEv9.999%2C9~Q8OvHWXuAufXh~N7-ejfLMGvF.WW~xLjMLEQMUNv9~UGMQLNv1x7mMG8OOJL~eBxv9.hf~OfEMjvu9~NejfvA.Ai~AENkvu9Xf.Af~myMYQwv9.HH~OYYMQ7Lyvxz1kkJN7JO~OfEMGv9.ii~GMlv9u9Wi~LEQMGvuHA.9W~xLjMQLEQMGvh.AX~LUBEv9.999%2C9~z75EJvu~J-EQNmLJv9.WH~LUBOv9.999%2C9~8QDJkv9~8Q8kv9~OBYMejfLMQOv~xLjMLENMGv9~G8Ov9.HH~xLjMLEQMLev9~NGOEv9.HH9~875EJM8Ovuh~875EJMmeJLL8OJvKrt~QJjjJLM71yM8OvXFW9iiFuf~QxEEj5M71yM8Ov~OJ7JN7JOM71yM8Ov~e8JB1G8j875v9.hf~EmQvu~N7Lv9.9~1NM75EJvu~1OGjUvXFW9iiFuf~1YEvu~myG8Ov9.HH9999~GkjLv9.9u9~Qx8Ov~O7NvJ1Q7MQN~OYYMJLEYvk1jQJ~OYYvxz1kkJN7JO~GOEN1EOv9~O1jyv~QyY7vwmYJE1yJM7JNwzmjmy5MNmYEx78zy~QmGEv~-8OvKrtoExGoWfFiWXWWFiHXhiXA~w7Yjvu~OMQU8Ev9~~8GNvu~zQlvf~7yQvfX9-fX9%7CA99-fX9~7Y-vfFX~Y-GU7v9~Y-wYJvu~kExLJ%20vu&vgd_acid=8bf3bf3e7dde16303612028ead0519cc&cme=uFtDaIfrq4qSguhCI3brTatv_nJqbdvJgKAfGwdP_k3S8yxDXiaOne5dmtEZRU8tNigh-KzCXRjW4yALGvVeH6ajgrLzwq44BQXT7ys2Gc3HzyPEOZNDDUIkB4AMCkYxQANPzy2LJKTTRgCJ_T9Bz_-1PhlyzMUBM7CQQ1ZDeeXSZznE6SawZLImQt-hkkPXyqqGoOn7G7yXGYosalu5c-G0X2ZcPJWGQWn9t_8NhGu9kuPPQrPH609ju-6LBA8R-WM1-a-ZRoncLLF-QAMrW_L8zwHRS2AGnPHkuI9kpL499pZHW-CJJarRl-m-j7IBXV1C8AKe_ghtIyMmzY3TkQVMA3xtti7fiNX3EqRp2M9eFLrSDzUEnV4Kjy8idxxwXdq9ma5QrLasWhMYz6CdzsgOm-M4p8_DOaUsDloDgJOLe8g7f_g4p16-r0_69OG-ht4SdzCN7Yd4gez1lH669TBtD_vcXSi2wzAsNRfSoa8%3D%7C%7C93q-w6oysg_RqBm1ir42DPKBMl32PFDK%7Ca0AmFU
Source: global traffic	HTTP traffic detected: GET /cksync?type=g&cs=6&gdpr=0&gdpr_consent=&google_gid=CAESEDIFtrr2wjgzI5bThk_HZRU&google_cver=1 HTTP/1.1Host: cs.media.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: visitor-id=3858307258137836000V10; data-g=CAESEDIFtrr2wjgzI5bThk_HZRU~~6
Source: global traffic	HTTP traffic detected: GET /bqi.php?vgd_len=3940&&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=155921254&vgd_aref=0&vgd_tsce=L813-S813&vgd_l2type=weaver&vgd_ydspr=1&vgd_cdv=O1538&vgd_cage=3&vgd_tpid=TE6YY3G&vgd_matchstr=bb%3D1_2%7CCommercialUrlOn%7Chr%3D0%7Chlid%3D2002&vgd_pgids=0&vgd_ecrid=1700090001091700300025010009900&vgd_oreqf=one&vgd_oresf=one&lf=3&prid=8PRVCXX19&cid=8CU7Q771E&crid=485131257&requrl=https%3A%2F%2Fmsguides.com&vi=1742829123131120226&ugd=4&cc=US&sc=MA&bdrid=460&subBdr=134&ybn_cc_exp=0&vgde_bdata=QOfvzxjj~8xLjMjvf9~e8fXvfX~myJLEYv9.HH~OmYMGvu.uH~QNOvY1~L1Jv9%2C9%2Cou~OmYMjvf9~ejfLMQOvf9fX9AfH9h~8xLjMGvu9HA.ih~xLjM7UNv9~xLjMLf1MGv9~Q7OvXFW9iiFuf~L17v9.999%2C9~N7-ejfLMQOvXWu~8EvftWDmV~kGGv9~L88Ex1v9%2C9~LNvu~LEQMQOvf9fX9AfHu9~L1Oev9.999%2C9~xLjMGv9.iF~ejfLMxLjMGv9~xLjMjvf9~QjevfH.Xf~yN17vX99XAu~GGvuAH~JLEYv9.HH~ejfLMxLjMUNv949~EQ8MNvhXAFA%2CX%2CW%2CH%2Ci%2CuH%2CfF%2CHu~GYvu~EQ8MOvhhAf9u~LUJv9%2C9%2Cou~1AEMGvA.HX%2CuHA.9W~QOv9~LMBLMGvAF9.9H%2C9~x8OvfV1Z8gaQeY1PK_T4Q8~NejfLMGvA.Ai~G7OvffuWAhfFihXWWuXFi9hiuhAXAiWuiWuW9uFf9uAAfuAFXFihiihh9fXFu9FhWfhf9uhiW9F9HiAiffuFWAWWffhWHffFFfFHiHFiuAf9iifAuFHFfX9FiFhA9Xh9Hh9uiXf9~x8Yv9~LM7QvW%3DPXD6u0%2F~LU7v9.999%2C9~1EEMzvzmzM1EE~eLMxLjMGvXX9.fX~myOfEMGv9.iW~GxyOvH~QQvIK~NNvPb~JLYvou~x8Bvou~NJv9~LNevfH.h~%3DVvAAHH~UGMxNvu~JLev9~z7Qvf~N7vQEL8zyk8JjO~1yyMQ7mLJMQOv~G1Q8QfvuiF~GO7vuhHfWfiufA~G1Q8QuvuiF~UGM77v9~ONvW~ejfLMGvA.HX~77viuuF~xjYMEv9.9Ahi~JQ7v9~eBMJ-Nv9.hf~OBYMejfLMGvfF.H~e8QMQOvXWA~xLjMLEQMGvf.WF~ONfvu~JNQv9~eM1QzvhWHi~GMkjLv9.9u~j1Q7v~NemyvA.Ai~e8QMxLjMGv9.XX~ejfLM8MQOvf9fX9AfH9h~e8QMxLjMjvu9~UNfXv9~J7vfX~ejfLM8MGv9.9u~LJkMLvI~e8QMGvWXf.hW~ejfLMxLjMe8vu4ouF~xLjM7e8v9~1yyMQ7mLJMGvu~eev9~NejfLMQOvXWA~Lkevuu.9f~jfLMGvu999~BLMGvu.iH%2C9~L1OEv9.999%2C9~Q8OvHWXuAufXh~N7-ejfLMGvF.WW~xLjMLEQMUNv9~UGMQLNv1x7mMG8OOJL~eBxv9.hf~OfEMjvu9~NejfvA.Ai~AENkvu9Xf.Af~myMYQwv9.HH~OYYMQ7Lyvxz1kkJN7JO~OfEMGv9.ii~GMlv9u9Wi~LEQMGvuHA.9W~xLjMQLEQMGvh.AX~LUBEv9.999%2C9~z75EJvu~J-EQNmLJv9.WH~LUBOv9.999%2C9~8QDJkv9~8Q8kv9~OBYMejfLMQOv~xLjMLENMGv9~G8Ov9.HH~xLjMLEQMLev9~NGOEv9.HH9~875EJM8Ovuh~875EJMmeJLL8OJvKrt~QJjjJLM71yM8OvXFW9iiFuf~QxEEj5M71yM8Ov~OJ7JN7JOM71yM8Ov~e8JB1G8j875v9.hf~EmQvu~N7Lv9.9~1NM75EJvu~1OGjUvXFW9iiFuf~1YEvu~myG8Ov9.HH9999~GkjLv9.9u9~Qx8Ov~O7NvJ1Q7MQN~OYYMJLEYvk1jQJ~OYYvxz1kkJN7JO~GOEN1EOv9~O1jyv~QyY7vwmYJE1yJM7JNwzmjmy5MNmYEx78zy~QmGEv~-8OvKrtoExGoWfFiWXWWFiHXhiXA~w7Yjvu~OMQU8Ev9~~8GNvu~zQlvf~7yQvfX9-fX9%7CA99-fX9~7Y-vfFX~Y-GU7v9~Y-wYJvu~kExLJ%20vu&vgd_acid=8bf3bf3e7dde16303612028ead0519cc&cme=uFtDaIfrq4qSguhCI3brTatv_nJqbdvJgKAfGwdP_k3S8yxDXiaOne5dmtEZRU8tNigh-KzCXRjW4yALGvVeH6ajgrLzwq44BQXT7ys2Gc3HzyPEOZNDDUIkB4AMCkYxQANPzy2LJKTTRgCJ_T9Bz_-1PhlyzMUBM7CQQ1ZDeeXSZznE6SawZLImQt-hkkPXyqqGoOn7G7yXGYosalu5c-G0X2ZcPJWGQWn9t_8NhGu9kuPPQrPH609ju-6LBA8R-WM1-a-ZRoncLLF-QAMrW_L8zwHRS2AGnPHkuI9kpL499pZHW-CJJarRl-m-j7IBXV1C8AKe_ghtIyMmzY3TkQVMA3xtti7fiNX3EqRp2M9eFLrSDzUEnV4Kjy8idxxwXdq9ma5QrLasWhMYz6CdzsgOm-M4p8_DOaUsDloDgJOLe8g7f_g4p16-r0_69OG-ht4SdzCN7Yd4gez1lH669TBtD_vcXSi2wzAsNRfSoa8%3D%7C%7C93q-w6oysg_RqBm1ir42DPKBMl32PFDK%7Ca0AmFU
Source: global traffic	HTTP traffic detected: GET /agrp/prod/model_person_country_code_US_person_region_code_4d415f353433.json HTTP/1.1Host: www.googletagservices.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://www.googleadservices.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.googleadservices.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f/AGSKWxU5hJ3mpUbtZzHHiYFMNNiogWWcnnCKE8fQbRHOqcE6beny0yGi-G7Om81VLYDp8AMdDpB-EFIsMhQnqIvTVatOs-BcaDcNrR00zabnOrlaQBEtjuZQhFQuStyn1I2dAZILM4qcHBWtLEqBuJ8w155030wws6h_IUsfAXhjvODxNRsvjBkWRHDM7jym/_/AdsRotateNEWHeader./advanced-advertising-/150_500./bigboxad..AdvertismentBottom. HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cksync?type=g&cs=6&gdpr=0&gdpr_consent=&google_gid=CAESEDIFtrr2wjgzI5bThk_HZRU&google_cver=1 HTTP/1.1Host: cs.media.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: visitor-id=3858307258137836000V10; data-g=CAESEDIFtrr2wjgzI5bThk_HZRU~~6
Source: global traffic	HTTP traffic detected: GET /f/AGSKWxXbk2qK3O2yq0GkrVnz2WHbqbioymytjKXbUw0qvXpCwEKXtKCLRWmVUboNip0XZK42dpg3C0tl70yV07kqfo_i6tacVNt8KiZwhr-KsIHkk4iNWplwkeB3tSNmC9i5l_h0tSzi8g==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQyODI5MTI2LDkxMDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9tc2d1aWRlcy5jb20vIixudWxsLFtbOCwiRGxXLUwtM0tKck0iXSxbOSwiZW4tVVMiXSxbMjMsIjE3NDI4MjkxMjMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwiIl0sWzI5LCJmYWxzZSJdXV0 HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /.well-known/aggregation-service/v1/public-keys HTTP/1.1Host: publickeyservice.msmt.gcp.privacysandboxservices.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2017/01/cropped-logo-msguides.com_-32x32.png HTTP/1.1Host: cdn.msguides.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.197717815.1742829122; _gid=GA1.2.1886899381.1742829122; _gat_gtag_UA_64922994_7=1; __gads=ID=c514f1f730bdc7c0:T=1742829123:RT=1742829123:S=ALNI_MahzfFTR5JpSVubumatvx6h54JrfA; __gpi=UID=00001000daac5df6:T=1742829123:RT=1742829123:S=ALNI_MbGxKGZk0isNUK0_-L_X-3dbd6-DQ; __eoi=ID=b44224744cdf08bd:T=1742829123:RT=1742829123:S=AA-AfjYu9snT8OJgF3xrMWGa3A2s; FCNEC=%5B%5B%22AKsRol8QVX_1-ZFJuLH7x2idGNp1ZhzpM2NdAO_ifBGXc6LGIG0HFlASE0U64B_3yJl-WIdTCB72TxGPKeqiK4jM4kl9N1pxIMnYMSESxc8c65etpLIBt0QxLdHvDjdg7L8kxlnm2JDacDAoAjIluwZ2qt3DtXnmog%3D%3D%22%5D%5D

Source: global traffic	DNS traffic detected: DNS query: msguides.com
Source: global traffic	DNS traffic detected: DNS query: cdn.msguides.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: webaz.eu.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: hblg.media.net
Source: global traffic	DNS traffic detected: DNS query: qsearch-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: contextual.media.net
Source: global traffic	DNS traffic detected: DNS query: lg3.media.net
Source: global traffic	DNS traffic detected: DNS query: fundingchoicesmessages.google.com
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: cs.media.net
Source: global traffic	DNS traffic detected: DNS query: www.googletagservices.com
Source: global traffic	DNS traffic detected: DNS query: publickeyservice.msmt.gcp.privacysandboxservices.com
Source: global traffic	DNS traffic detected: DNS query: ep1.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: ep2.adtrafficquality.google

Source: unknown

HTTP traffic detected: POST /el/AGSKWxWdKWTgn_AXfysLAX2jztHwAbGvq3HIXouCu9raztagM_cdTe-zVBFBEiz2XTDe_bji9_0Vk1odS0yiqVcnapz-MsVVTHL6NM44EghZaet0GE5gOHWLMojeWNDmNXXaEZZOyaL5uQ== HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-aliveContent-Length: 247sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plainsec-ch-ua-mobile: ?0Accept: */*Origin: https://msguides.comX-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://msguides.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.134:443 -> 192.168.2.16:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.162:443 -> 192.168.2.16:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.162:443 -> 192.168.2.16:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.162:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.162:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.162:443 -> 192.168.2.16:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.162:443 -> 192.168.2.16:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.9.191:443 -> 192.168.2.16:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.68:443 -> 192.168.2.16:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.200.0.174:443 -> 192.168.2.16:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.200.196.24:443 -> 192.168.2.16:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.200.196.24:443 -> 192.168.2.16:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.200.196.24:443 -> 192.168.2.16:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.200.0.174:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.16:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.164:443 -> 192.168.2.16:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.16:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.200.0.174:443 -> 192.168.2.16:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.200.0.174:443 -> 192.168.2.16:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.48.23:443 -> 192.168.2.16:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.98:443 -> 192.168.2.16:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.49.23.1:443 -> 192.168.2.16:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.16:49866 version: TLS 1.2

System Summary

Found suspicious ZIP file

Source: qctivqtion.zip

Zip Entry: Device/HarddiskVolume13/Formation/Microsoft Office 2019/Activation/Activation.cmd

Source: classification engine

Classification label: mal48.winZIP@69/31@56/6

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2920:120:WilError_03

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms"

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\explorer.exe

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\System32\NOTEPAD.EXE" C:\Users\user\Desktop\Activation.cmd
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Activation.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir /b ..\root\Licenses16\ProPlus2019VL*.xrm-ms
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir /b ..\root\Licenses16\ProPlus2019VL*.xrm-ms
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir /b ..\root\Licenses16\ProPlus2019VL*.xrm-ms
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir /b ..\root\Licenses16\ProPlus2019VL*.xrm-ms
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo ospp.vbs /unpkey:6MWKP
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo ospp.vbs /inpkey:NMMKJ-6RK4F-KMJVX-8D9MJ-6MWKP
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo ospp.vbs /sethst:kms7.MSGuides.com
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo ospp.vbs /act
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "successful"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /n /c YN /m "Would you like to visit my blog [Y,N]?"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\explorer.exe explorer "http://MSGuides.com"
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: C:\Windows\explorer.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://msguides.com/
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo ospp.vbs /unpkey:6MWKP
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo ospp.vbs /inpkey:NMMKJ-6RK4F-KMJVX-8D9MJ-6MWKP
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo ospp.vbs /sethst:kms7.MSGuides.com
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo ospp.vbs /act
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "successful"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /n /c YN /m "Would you like to visit my blog [Y,N]?"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\explorer.exe explorer "http://MSGuides.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1940,i,1336669465946602264,4009943375968269981,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
Source: C:\Windows\explorer.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://msguides.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1940,i,1336669465946602264,4009943375968269981,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Windows\System32\notepad.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: efswrt.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll

Source: C:\Windows\System32\notepad.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32

Source: C:\Windows\explorer.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir /b ..\root\Licenses16\ProPlus2019VL*.xrm-ms
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir /b ..\root\Licenses16\ProPlus2019VL*.xrm-ms
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo ospp.vbs /unpkey:6MWKP
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo ospp.vbs /inpkey:NMMKJ-6RK4F-KMJVX-8D9MJ-6MWKP
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo ospp.vbs /sethst:kms7.MSGuides.com
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo ospp.vbs /act
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "successful"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /n /c YN /m "Would you like to visit my blog [Y,N]?"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\explorer.exe explorer "http://MSGuides.com"

Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\Desktop\Activation.cmd VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\cscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	11 Process Injection	1 Rundll32	OS Credential Dumping	13 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 DLL Side-Loading	11 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Extra Window Memory Injection	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://googleads.g.doubleclick.net/pagead/adview?ai=CxS-ORHbhZ87DCc-hoPMPoI654A-atpvReffa0tOsDMCNtwEQASAAYMm2gomEpIARggEXY2EtcHViLTgyNjk4NTg4Njk0NTc5NTPIAQmoAwHIAwKqBMABT9CQ-_insEIDKVBJ3RGt3p9jAzF7IjFpAMKBi7LEQJEBVbr5MR3oA1-fibkCI7tTlYN53muKxw6lU_RcgJwaoXWy8FW4mlUUwPY5RlQOVIzKm38vqIuSJOROgv_7Xn_y874307zUV4-OfrSPRe8G5omjMzADmznFqkzUz5Ac5Cq33aka4ljllnorqnXtzsju3epfXMQ2TXOkkX9lmIdckHULrleO-VcyCoG1ePECztV7nhliCfCcxWkiTRW5Ka0EgAbTxu3FlqGv--IBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAqgHrb6xAtgHANIIJAiAYRABMgKKAjoLgECAwICAgKCogAJIvf3BOli_zOW2gKOMA4AKAfoLAggBgAwB6g0TCPqs9LaAo4wDFc8QaAgdIEcO_NAVAYAXAbIXHAoYEhRwdWItODI2OTg1ODg2OTQ1Nzk1MxgAGAw&sigh=1P_IR9RoANE&uach_m=%5BUACH%5D&cid=CAQSTgCjtLzMCvHiSbtcwjki74oVIZ-l-qxMzqDl1X8Z_zwJd0TPyhwcglosBsLYnreTDwUTgQnrKMmeQLLS_39rtZGX8mJdgibZipFZhCk1BBgB	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=495&slotname=5267401563&adk=3734463499&adf=2132245819&pi=t.ma~as.5267401563&w=848&abgtt=6&lmt=1742816699&rafmt=11&format=848x495&url=https%3A%2F%2Fmsguides.com%2F&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121282&bpp=1&bdt=1627&idt=986&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=391&ady=1268&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=989	0%	Avira URL Cloud	safe
https://contextual.media.net/checksync.php?vsSync=1&cs=6&cv=31&https=1&cid=8CUU9JF8H&prvid=99%2C77%2C20000%2C294%2C262%2C460%2C461%2C462%2C4%2C313%2C10000%2C459%2C229%2C9%2C319&itype=ADX&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1	0%	Avira URL Cloud	safe
https://contextual.media.net/__media__/fonts/Raleway-bold/Raleway-bold.woff	0%	Avira URL Cloud	safe
https://cdn.msguides.com/wp-content/uploads/2017/01/cropped-logo-msguides.com_-32x32.png	0%	Avira URL Cloud	safe
https://fundingchoicesmessages.google.com/f/AGSKWxU5hJ3mpUbtZzHHiYFMNNiogWWcnnCKE8fQbRHOqcE6beny0yGi-G7Om81VLYDp8AMdDpB-EFIsMhQnqIvTVatOs-BcaDcNrR00zabnOrlaQBEtjuZQhFQuStyn1I2dAZILM4qcHBWtLEqBuJ8w155030wws6h_IUsfAXhjvODxNRsvjBkWRHDM7jym/_/AdsRotateNEWHeader./advanced-advertising-/150_500./bigboxad..AdvertismentBottom.	0%	Avira URL Cloud	safe
https://cdn.msguides.com/wp-content/themes/kadence/assets/css/footer.min.css	0%	Avira URL Cloud	safe
https://fundingchoicesmessages.google.com/i/ca-pub-8269858869457953?href=https%3A%2F%2Fmsguides.com&ers=2	0%	Avira URL Cloud	safe
https://hblg.media.net/log?logid=kfke&evtid=plutol1&__q=Ab4EewKELwQCEAABAIAAAgAAAABAAAEABgAAQIABAAgAMNCYCXBGUDM1OTAwNDY0MDQ3MDM5NV85NTg3ODQ4NF8xNTU5MjEyNTQ0NjAxXzBAOGJmM2JmM2U3ZGRlMTYzMDM2MTIwMjhlYWQwNTE5Y2MAzK3ZlAGYBylcj8L1KNw_KVyPwvUo3D8oaHR0cHM6Ly9tc2d1aWRlcy5jb20EVVOAtOiUFN4BTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzNC4wLjAuMCBTYWZhcmkvNTM3LjM2GG1zZ3VpZGVzLmNvbRI4Q1VVOUpGOEgIDjMwMHgyNTAQMC40NDAwMDAkcG9wdWxhci10cmVuZHMuY29tDmVhc3Rfc2MyOENVN1E3NzFFLTQ4NTEzMTI1Ny0xMy0yNQZBRFgICG51cmwAAAAAAAAAUkCO5q-LuWUCMQAAAAAAAAAAQHJ0Yi1hcHBuZXh1cy03NmQ3NzQ2YmNiLTR3Nmp3LlNDPjE3MDAwOTAwMDEwOTE3MDAzMDAwMjUwMTAwMDk5MDACEDZiMGEyMjg0AmQCEGFwcG5leHVzPjE3MDAwOTAwMDEwOTE3MDAzMDAwMjUwMTAwMDk5MDBAYjFhOTZjYmM3Mzk0NjgzNjRkMTVmMmZhMTljZGNhODUCCgACAQACMQ5CSURfQVBJGG1zZ3VpZGVzLmNvbQA	0%	Avira URL Cloud	safe
https://cdn.msguides.com/wp-content/plugins/kk-star-ratings/src/core/public/css/kk-star-ratings.min.css	0%	Avira URL Cloud	safe
https://contextual.media.net/__media__/fonts/worksans-medium/worksans-medium.woff	0%	Avira URL Cloud	safe
https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=3672&%2Ao0=b&%2Ax7pf2=M&0pyHHH=hh%3D8QD%7C%294HHp6yNiUT6U9f%7CC6%3DM%7CCUN0%3DDMMD&4N0=I2hcpMphE0MbpEbDD%28EhDYpEY18IhpIbuIi8&4Ui2=4fp&6pZ%2A6U=CAA7x%3A%2F%2FHxo%2AN0pxRy4H&7N0=I_9%28ubuYb&A7N0=swcY1FI&Axyp=FI8u&CAA7x=8&Hx7i=M&L0=&LiA76p=8&LiAhN0=E8M&Lj62=&NxN0=Y&UDAm7p=4Ui&dN=8%28bDIDc8DbYI%28%281Y%28%28D&fAd=M&fHp66=8&h06X0=b1M&hN0=&hip=8%28bDIDc8DbJ8%28bDIDc%28DbJ1MM&hp=M&htmlsrc=1&i04HiNf=CAA7x%3A%2F%2F747%2AUi6EA6pf0xRy4H&i0A8=I%29TTcawIG&i0AD=8YYcD8DYb&i0d=_47%2AUi6+s6pf0x&i7%29%2A=&iyA=_%21X2u6nrf%21%21%21rufOionp6%2F6Z6%2Au%2AOru2oik&jUxA7=M&jxC7=M&kkdd=u%21%7C%21%7C9WnHA%2Au3h&m0x76=8&m7U7=8&mhfQyyQpr7=M&o076=M&o076yfxA=&py6N0=8%28MMMcMMM88Y8cMMuMMMDYM8MMMccMM&xNkp=uMMrDYM&xh06X0=8ub&xxHy6Qdp6=%25%25%3FtSeXwX%29nsX9O%3AE8%3AY%25%25&xxU0=%7B%22xxyy%22%3A%22Tv%22%2C%22xxyAm%22%3A%22x76Nfo2NpU0%22%2C%22xxN7%22%3A%22818R%28%28R8uRM%22%2C%22xxxy%22%3A%22gn%22%7D&xy=gn&y0d=98Y81&y6N0=bIY8u8DY%28&yA7N0=&yCfHD=&yCfHu=&yN0=I%29T%28-%28%288S&yy=Tv&eobd=4YrCvRaaBNR%2FadaCrzBHNr_Cr_BP5b%2FhyCz.nBYPydMCe.eXB4%20YCyDB%2FDbCz%2Cz%2CieBYPydaCrzBHar%2Fd4YCrzr_znrXzWBNR%2FadMCezXn.qWBR%2Fadjx%20CzBR%2Fad%2FrDdMCzB4jYCrUrrs_sWnqB%2FDjCz.zzz%2CzB%20jFHar%2Fd4YC_seBNhCr%7Cs7PuBkMMCzB%2FNNhRDCz%2CzB%2F%20Cr%2CXznB%2Fh4d4YCrzr_znrXezB%2FDYHCz.zzz%2CzBR%2FadMCz.qUBHar%2FdR%2FadMCzBR%2FadaCrzB4aHCrX._rB5%20DjC_zz_neBMMCenXBb%2FhyCz.nBHar%2FdR%2Fadx%20Cz8zBh4Nd%20CW_nU_%2C_%2Cs%2CX%2Cq%2CeX%2CrU%2CXeBMyCeBh4NdYCWWnrzeB%2FxbCz%2Cz%2CieBDnhdMCn.__%2CeXn.zsB4YCzB%2FdJ%2FdMCnWq.nq%2CzBRNYCruDEN6A4HyDVwNAa32B%20Har%2FdMCn.nqBMjYCrresnWrWezszqrWUrsnWrrnr_qUezrzezWWszWssUrXrUsnUsesqzerXU_sWerqsrrseXU_nqUWsqn_WqrXUrerXUXzWrzrXW_rWqsrXXWUrssqresW_eeq_UnUs_Xq_eqnUBRNyCzB%2Fdj4CsLV_70eKfB%2FxjCz.zzz%2CzBDhhdvCvPvdDhhBH%2FdR%2FadMC__z.r_BP5YrhdMCz.qsBMR5YCXB44CcgB%20%20CVlBb%2FyCieBRNJCieB%20bCzB%2F%20HCr_.UqBLuCnnXXBxMdR%20CeBb%2FHCzBvj4CrB%20jC4h%2FNv5kNbaYBD55d4jP%2Fbd4YCBMYjCeWXrsrqerXBxMdjjCzBY%20CsBHar%2FdMCn.eqBjjCqeeUBRaydhCz.znWqBb4jCzBHJdbF%20Cz.nqBYJydHar%2FdMCen.eUBHN4d4YC_snBR%2Fad%2Fh4dMCr.sUBY%20rCeBb%204CzBHdD4vCWsXqBMdka%2FCz.zeBaD4jCB%20HP5Cn.nqBHN4dR%2FadMCz.__BHar%2FdNd4YCrzr_znrXzWBHN4dR%2FadaCezBx%20r_CzBbjCenBHar%2FdNdMCz.zeB%2Fbkd%2FCcBHN4dMC_qW.s_BHar%2FdR%2FadHNCe8ieUBR%2FadjHNCzBD55d4jP%2FbdMCeBHHCzB%20Har%2Fd4YC_snB%2FkHCee.zrBar%2FdMCezzzBJ%2FdMCr.eW%2CzB%2FDYhCz.zzz%2CzB4NYCXs_ener_WB%20jFHar%2FdMCiezzzBR%2Fad%2Fh4dx%20CzBxMd4%2F%20CDRjPdMNYYb%2FBHJRCz.nqBYrhdaCezB%20HarCn.nqBnh%20kCeezzBP5dy49Cz.nBYyyd4j%2F5ChNvvD%20abBYrhdMCz.qsB%2Fh4dMCeXn.zsBR%2Fad4%2Fh4dMCW.n_B%2FxJhCz.zzz%2CzBvjShbCeBbFh4%20P%2FbCieB%2FxJYCz.zzz%2CzBN47bkCzBN4NkCzBYJydHar%2Fd4YCBR%2Fad%2Fh%20dMCzBMNYCz.nBR%2Fad%2Fh4d%2FHCzB%20MYhCz.eseBNjShbdNYCeWBNjShbdPHb%2F%2FNYbCgQ%7CB4baab%2FdjD5dNYCrUrrs_sWnqB4RhhaSdjD5dNYCBYbjb%20jbYdjD5dNYCBHNbJDMNaNjSCz.nqBhP4CnB%20j%2FCW.rzszWn8iXBD%20djShbCeBDYMaxCrUrrs_sWnqBDyhCeBP5MNYCz.nzzzzzBMka%2FCz.zezB4RNYCBYj%20CbD4jd4%20BYyydb%2FhyCkDa4bBYyyChNvvD%20abBMYh%20DhYCzBYDa5CYvdedHnzdDMPHbd~z_B45yjC9PybhD5bdjb%209vPaP5Sd%20PyhRjNv5B4PMhCBFNYCgQ%7CihRMisrUqs_ssUqX_Wq_nB9jyaCeBYyydYrsCzizBh%2FbYN%20jbYdJ%2FCUz.zzBY%20RjCXzBYP5MCzieBYDa5CYvdedHnzdDMPHbd~z_Bb%20hdR4bYC~qqBb%20hdHb%2FCYvdedHnzBb%20hdhz_Cz.zrBb%20hdhezCz.znBb%20hdhe_Cz.zXBb%20hdhrzCz.zUBb%20hdhr_Cz.zsBb%20hdhnzCz.ezBb%20hdhn_Cz.erBb%20hdhXzCz.enBb%20hdhX_Cz.e_Bb%20hdh_zCz.eUBb%20hdh__Cz.eWBb%20hdhUzCz.esBb%20hdhU_Cz.eqBb%20hdhWzCz.rzBb%20hdhW_Cz.reBb%20hdhszCz.rrBb%20hdhs_Cz.rnBb%20hdhqzCz.rXBb%20hdhq_Cz.r_Bb%20hdhqqCz.rWBYyyd4kyCyPJFdeWdXUzBHM%2FC%2FPJi4UBBNM%20CeBv4ICrBj54Cr_zFr_z%3DnzzFr_zBjyFCrUzByFMxjCzByF9y4CnrByF9ybCzBkhR%2Fb~Ce&eoac=_zeWnsD_UnbkkMeMqzD_nrUDb_zkkYbn&eoch=hNvvD%20ab&ure=1	0%	Avira URL Cloud	safe
https://fundingchoicesmessages.google.com/el/AGSKWxXUO0LTfHDe3i0Z1MPAkCkRm4Nt4MFwAgYM31AiPX0M-uEgNG1wKewp7VwlkHqexA7Rcs25aa7Qcz7dVZrpKKlT43-kUCzO3W81zW86qB2MsQKVmvtte0WYah-TLkiRnpw3vGvZog==	0%	Avira URL Cloud	safe
https://cdn.msguides.com/wp-content/cache/min/1/wp-content/plugins/widget-options/assets/css/widget-options.css?ver=1740537121	0%	Avira URL Cloud	safe
https://cdn.msguides.com/wp-content/themes/kadence/assets/css/global.min.css	0%	Avira URL Cloud	safe
https://contextual.media.net/__media__/fonts/worksans-regular/worksans-regular.woff	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=495&slotname=5267401563&adk=3734463499&adf=1733159701&pi=t.ma~as.5267401563&w=848&abgtt=6&lmt=1742816699&rafmt=11&format=848x495&url=https%3A%2F%2Fmsguides.com%2F&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121283&bpp=1&bdt=1628&idt=996&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C848x495&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=391&ady=2657&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=999	0%	Avira URL Cloud	safe
https://hblg.media.net/log?logid=kfke&evtid=plutol1&__q=Ab4EewKELwQCEAABAIAAAgAAAABAAAEABgAAQIABAAgAMNCYCXBGUDczNTE4MTk3NjM0MzhfMTY4MDAwOTg1NV8xNTU5MjEyNTQ0NjAxXzBANTAxNzM4YTU2M2VmZmIxYjkwYTUzMjZhZTUwZmZkZTMAzK3ZlAGYBzMzMzMzM9M_MzMzMzMz0z8oaHR0cHM6Ly9tc2d1aWRlcy5jb20EVVOAtOiUFN4BTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzNC4wLjAuMCBTYWZhcmkvNTM3LjM2GG1zZ3VpZGVzLmNvbRI4Q1VVOUpGOEgIDjMwMHgyNTAQMC4xODE0NTAkcG9wdWxhci10cmVuZHMuY29tDmVhc3Rfc2MwOENVN1E3NzFFLTQ4NTEzMTI1Ny0xMy00BkFEWAgIbnVybAAAAAAAAIBDQKLsr4u5ZQIydy_e45GeRz9AcnRiLWFwcG5leHVzLTc2ZDc3NDZiY2ItZndmOWouU0M-MTcwMDA5MDAwMTE1MTkwMDMwMDAyNTAxMDAwOTkwMAIQNmIwYTIyODQCZAIQYXBwbmV4dXM-MTcwMDA5MDAwMTE1MTkwMDMwMDAyNTAxMDAwOTkwMEBlMjU2ZmQxZThkYmViYjNhYjc3NTlhYjU0ZDMyMWE3NAIKAAIBAAIxDkJJRF9BUEkYbXNndWlkZXMuY29tAA	0%	Avira URL Cloud	safe
https://cdn.msguides.com/wp-content/themes/kadence/assets/css/header.min.css	0%	Avira URL Cloud	safe
https://cdn.msguides.com/wp-content/plugins/wp-rocket/assets/js/lazyload/16.1/lazyload.min.js	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=495&slotname=5267401563&adk=3734463499&adf=644718914&pi=t.ma~as.5267401563&w=848&abgtt=6&lmt=1742816699&rafmt=11&format=848x495&url=https%3A%2F%2Fmsguides.com%2F&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121283&bpp=1&bdt=1628&idt=1006&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc514f1f730bdc7c0%3AT%3D1742829123%3ART%3D1742829123%3AS%3DALNI_MahzfFTR5JpSVubumatvx6h54JrfA&gpic=UID%3D00001000daac5df6%3AT%3D1742829123%3ART%3D1742829123%3AS%3DALNI_MbGxKGZk0isNUK0_-L_X-3dbd6-DQ&eo_id_str=ID%3Db44224744cdf08bd%3AT%3D1742829123%3ART%3D1742829123%3AS%3DAA-AfjYu9snT8OJgF3xrMWGa3A2s&prev_fmts=0x0%2C1200x280%2C848x495%2C848x495%2C304x250%2C304x250&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=391&ady=3552&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=1802	0%	Avira URL Cloud	safe
https://cdn.msguides.com/wp-content/themes/kadence/assets/css/content.min.css	0%	Avira URL Cloud	safe
https://fundingchoicesmessages.google.com/f/AGSKWxUGrm4sNcz8Xi9mzW8ERGAMJwgkhvYf395hyPa54NxnCDWVktrBoZBft28NcuOqQ9V60vysCn1E10cpy2vX8WMIaBjH0UAQkbxqiN-O-yyb8QnVgK3oNyZVGiQWDoF2zB2uBnrIew==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQyODI5MTI1LDE4NDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vbXNndWlkZXMuY29tLyIsbnVsbCxbWzgsIkRsVy1MLTNLSnJNIl0sWzksImVuLVVTIl0sWzIzLCIxNzQyODI5MTIzIl0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsIiJdLFsyOSwiZmFsc2UiXV1d	0%	Avira URL Cloud	safe
https://fundingchoicesmessages.google.com/f/AGSKWxWb8IXAXAfzP9AL4B1KlIS2g2u7v4OegSh2ymsqbdv0FzoTJdCrdV_BnuQLqqlpEF8wJFeUsuU1RXlntfPtBUdelp7cR5YYj5MqJWD0TNVzcaMh-5wt5cGn8qHk9PNUhEJKa8K5SA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQyODI5MTI0LDczNTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9tc2d1aWRlcy5jb20vIixudWxsLFtbOCwiRGxXLUwtM0tKck0iXSxbOSwiZW4tVVMiXSxbMjMsIjE3NDI4MjkxMjMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwiIl0sWzI5LCJmYWxzZSJdXV0	0%	Avira URL Cloud	safe
https://fundingchoicesmessages.google.com/el/AGSKWxWdKWTgn_AXfysLAX2jztHwAbGvq3HIXouCu9raztagM_cdTe-zVBFBEiz2XTDe_bji9_0Vk1odS0yiqVcnapz-MsVVTHL6NM44EghZaet0GE5gOHWLMojeWNDmNXXaEZZOyaL5uQ==	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/adview?ai=CEF40Q3bhZ_axLaqaoPMPx4rfqQ6atpvReffa0tOsDMCNtwEQASAAYMm2gomEpIARggEXY2EtcHViLTgyNjk4NTg4Njk0NTc5NTPIAQmoAwHIAwKqBLoBT9DorN-w-OliQlxakmT9oMHoCwgBin3Gzr4blTf9bgi-XI7XoGg_BL7RmIt9-Ia84ii8TWTRnyXBYRM-9DE3ppMGH_wsUThWOdSPpiIJtMmaJsPvx1ElFKkpwHb72NCl9lchZkmyBlrNAPMFKnmrf_G7GYKtLfl3ngb9OLnOlxUVbUIy7bDCNhcYG6oMUReIzqGTOJtYp0HaG-h9OxsyTvShwqpZgWNvucNeVgzeIc0a5_hWIzRL6-aegAaxj5zV3vDZjKoBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAqgHrb6xAtgHANIIJAiAYRABMgKKAjoLgECAwICAgKCogAJIvf3BOljH18u2gKOMA4AKAfoLAggBgAwB6g0TCNSS7LaAo4wDFSoNaAgdR8U35dAVAYAXAbIXHAoYEhRwdWItODI2OTg1ODg2OTQ1Nzk1MxgAGAw&sigh=Dwx6Lk_go60&uach_m=%5BUACH%5D&cid=CAQSTwCjtLzMKTFMJUj096YAULWulADhjeRZ5smtFNAZ-B04FiUHgB3YWEYjvqhXfwmEYeovPIkYHgWCYxUc9cS2aydyuhqRKVk0dkuPtWao8_oYAQ	0%	Avira URL Cloud	safe
https://cdn.msguides.com/wp-content/plugins/kk-star-ratings/src/core/public/js/kk-star-ratings.min.js	0%	Avira URL Cloud	safe
https://webaz.eu.org/img/qmwcmk	0%	Avira URL Cloud	safe
https://cs.media.net/cksync?type=g&cs=6&gdpr=0&gdpr_consent=&google_gid=CAESEDIFtrr2wjgzI5bThk_HZRU&google_cver=1	0%	Avira URL Cloud	safe
https://cdn.msguides.com/wp-content/themes/kadence/assets/js/navigation.min.js	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/html/r20250319/r20190131/zrt_lookup_fy2021.html	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=250&slotname=2983663782&adk=568099612&adf=1502893352&pi=t.ma~as.2983663782&w=304&abgtt=6&fwrn=4&fwrnh=100&lmt=1742816699&rafmt=1&format=304x250&url=https%3A%2F%2Fmsguides.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121284&bpp=1&bdt=1629&idt=1010&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C848x495%2C848x495&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=24&ady=464&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=6&uci=a!6&fsb=1&dtd=1013	0%	Avira URL Cloud	safe
https://cdn.msguides.com/wp-includes/css/dist/block-library/style.min.css	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=250&slotname=5418255437&adk=2622858739&adf=1949866865&pi=t.ma~as.5418255437&w=304&abgtt=6&fwrn=4&fwrnh=100&lmt=1742816699&rafmt=1&format=304x250&url=https%3A%2F%2Fmsguides.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121284&bpp=1&bdt=1629&idt=1025&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C848x495%2C848x495%2C304x250&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=24&ady=1469&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=7&uci=a!7&btvi=3&fsb=1&dtd=1028	0%	Avira URL Cloud	safe
https://cdn.msguides.com/wp-content/themes/kadence/assets/css/sidebar.min.css	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=280&slotname=1770175538&adk=3856262152&adf=2712143399&pi=t.ma~as.1770175538&w=1200&abgtt=6&fwrn=4&fwrnh=100&lmt=1742816699&rafmt=1&format=1200x280&url=https%3A%2F%2Fmsguides.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121280&bpp=2&bdt=1625&idt=970&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=32&ady=88&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7Ce%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&fsb=1&dtd=976	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&adk=1812271804&adf=3025194257&abgtt=6&lmt=1742816699&plat=1%3A16777216%2C3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fmsguides.com%2F&pra=5&wgl=1&aihb=0&asro=0&ailel=1~2~4~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aiael=1~2~3~4~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aicel=33~38&aifxl=29_18~30_19&aiixl=29_5~30_6&aiapm=0.15&aiapmi=0.33938&aiact=0.7&ailct=0.65&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121274&bpp=6&bdt=1619&idt=921&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=5397107791020&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=968	0%	Avira URL Cloud	safe
https://www.googletagservices.com/agrp/prod/model_person_country_code_US_person_region_code_4d415f353433.json	0%	Avira URL Cloud	safe
https://cdn.msguides.com/wp-includes/js/wp-embed.min.js	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a267.g.akamai.net	23.200.0.174	true	false	high
www.googletagservices.com	142.250.64.98	true	false	high
ep1.adtrafficquality.google	142.250.80.2	true	false	high
cdn.msguides.com	104.21.64.1	true	false	unknown
ep2.adtrafficquality.google	142.250.176.193	true	false	high
webaz.eu.org	172.67.189.134	true	false	unknown
contextual.media.net	23.200.196.24	true	false	high
cs.media.net	23.199.48.23	true	false	high
msguides.com	104.21.64.1	true	false	unknown
googleads.g.doubleclick.net	142.251.40.194	true	false	high
www3.l.google.com	142.250.81.238	true	false	high
hblg.media.net	23.199.48.23	true	false	high
cm.g.doubleclick.net	142.251.32.98	true	false	high
lg3.media.net	23.199.48.23	true	false	high
www.google.com	142.250.64.68	true	false	high
publickeyservice-a.msmt-3.gcp.privacysandboxservices.com	34.49.23.1	true	false	high
qsearch-a.akamaihd.net	unknown	unknown	false	high
fundingchoicesmessages.google.com	unknown	unknown	false	high
publickeyservice.msmt.gcp.privacysandboxservices.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.msguides.com/wp-content/plugins/kk-star-ratings/src/core/public/css/kk-star-ratings.min.css	false	Avira URL Cloud: safe	unknown
https://www.google.com/pagead/drt/ui	false		high
https://cdn.msguides.com/wp-content/themes/kadence/assets/css/footer.min.css	false	Avira URL Cloud: safe	unknown
https://hblg.media.net/log?logid=kfke&evtid=plutol1&__q=Ab4EewKELwQCEAABAIAAAgAAAABAAAEABgAAQIABAAgAMNCYCXBGUDM1OTAwNDY0MDQ3MDM5NV85NTg3ODQ4NF8xNTU5MjEyNTQ0NjAxXzBAOGJmM2JmM2U3ZGRlMTYzMDM2MTIwMjhlYWQwNTE5Y2MAzK3ZlAGYBylcj8L1KNw_KVyPwvUo3D8oaHR0cHM6Ly9tc2d1aWRlcy5jb20EVVOAtOiUFN4BTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzNC4wLjAuMCBTYWZhcmkvNTM3LjM2GG1zZ3VpZGVzLmNvbRI4Q1VVOUpGOEgIDjMwMHgyNTAQMC40NDAwMDAkcG9wdWxhci10cmVuZHMuY29tDmVhc3Rfc2MyOENVN1E3NzFFLTQ4NTEzMTI1Ny0xMy0yNQZBRFgICG51cmwAAAAAAAAAUkCO5q-LuWUCMQAAAAAAAAAAQHJ0Yi1hcHBuZXh1cy03NmQ3NzQ2YmNiLTR3Nmp3LlNDPjE3MDAwOTAwMDEwOTE3MDAzMDAwMjUwMTAwMDk5MDACEDZiMGEyMjg0AmQCEGFwcG5leHVzPjE3MDAwOTAwMDEwOTE3MDAzMDAwMjUwMTAwMDk5MDBAYjFhOTZjYmM3Mzk0NjgzNjRkMTVmMmZhMTljZGNhODUCCgACAQACMQ5CSURfQVBJGG1zZ3VpZGVzLmNvbQA	false	Avira URL Cloud: safe	unknown
https://contextual.media.net/__media__/fonts/Raleway-bold/Raleway-bold.woff	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211	false		high
https://msguides.com/	true		unknown
https://contextual.media.net/checksync.php?vsSync=1&cs=6&cv=31&https=1&cid=8CUU9JF8H&prvid=99%2C77%2C20000%2C294%2C262%2C460%2C461%2C462%2C4%2C313%2C10000%2C459%2C229%2C9%2C319&itype=ADX&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/adview?ai=CxS-ORHbhZ87DCc-hoPMPoI654A-atpvReffa0tOsDMCNtwEQASAAYMm2gomEpIARggEXY2EtcHViLTgyNjk4NTg4Njk0NTc5NTPIAQmoAwHIAwKqBMABT9CQ-_insEIDKVBJ3RGt3p9jAzF7IjFpAMKBi7LEQJEBVbr5MR3oA1-fibkCI7tTlYN53muKxw6lU_RcgJwaoXWy8FW4mlUUwPY5RlQOVIzKm38vqIuSJOROgv_7Xn_y874307zUV4-OfrSPRe8G5omjMzADmznFqkzUz5Ac5Cq33aka4ljllnorqnXtzsju3epfXMQ2TXOkkX9lmIdckHULrleO-VcyCoG1ePECztV7nhliCfCcxWkiTRW5Ka0EgAbTxu3FlqGv--IBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAqgHrb6xAtgHANIIJAiAYRABMgKKAjoLgECAwICAgKCogAJIvf3BOli_zOW2gKOMA4AKAfoLAggBgAwB6g0TCPqs9LaAo4wDFc8QaAgdIEcO_NAVAYAXAbIXHAoYEhRwdWItODI2OTg1ODg2OTQ1Nzk1MxgAGAw&sigh=1P_IR9RoANE&uach_m=%5BUACH%5D&cid=CAQSTgCjtLzMCvHiSbtcwjki74oVIZ-l-qxMzqDl1X8Z_zwJd0TPyhwcglosBsLYnreTDwUTgQnrKMmeQLLS_39rtZGX8mJdgibZipFZhCk1BBgB	false	Avira URL Cloud: safe	unknown
https://publickeyservice.msmt.gcp.privacysandboxservices.com/.well-known/aggregation-service/v1/public-keys	false		high
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=495&slotname=5267401563&adk=3734463499&adf=2132245819&pi=t.ma~as.5267401563&w=848&abgtt=6&lmt=1742816699&rafmt=11&format=848x495&url=https%3A%2F%2Fmsguides.com%2F&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121282&bpp=1&bdt=1627&idt=986&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=391&ady=1268&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=989	false	Avira URL Cloud: safe	unknown
https://cdn.msguides.com/wp-content/uploads/2017/01/cropped-logo-msguides.com_-32x32.png	false	Avira URL Cloud: safe	unknown
https://fundingchoicesmessages.google.com/f/AGSKWxU5hJ3mpUbtZzHHiYFMNNiogWWcnnCKE8fQbRHOqcE6beny0yGi-G7Om81VLYDp8AMdDpB-EFIsMhQnqIvTVatOs-BcaDcNrR00zabnOrlaQBEtjuZQhFQuStyn1I2dAZILM4qcHBWtLEqBuJ8w155030wws6h_IUsfAXhjvODxNRsvjBkWRHDM7jym/_/AdsRotateNEWHeader./advanced-advertising-/150_500./bigboxad..AdvertismentBottom.	false	Avira URL Cloud: safe	unknown
https://fundingchoicesmessages.google.com/i/ca-pub-8269858869457953?href=https%3A%2F%2Fmsguides.com&ers=2	false	Avira URL Cloud: safe	unknown
https://contextual.media.net/__media__/fonts/worksans-medium/worksans-medium.woff	false	Avira URL Cloud: safe	unknown
https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=3672&%2Ao0=b&%2Ax7pf2=M&0pyHHH=hh%3D8QD%7C%294HHp6yNiUT6U9f%7CC6%3DM%7CCUN0%3DDMMD&4N0=I2hcpMphE0MbpEbDD%28EhDYpEY18IhpIbuIi8&4Ui2=4fp&6pZ%2A6U=CAA7x%3A%2F%2FHxo%2AN0pxRy4H&7N0=I_9%28ubuYb&A7N0=swcY1FI&Axyp=FI8u&CAA7x=8&Hx7i=M&L0=&LiA76p=8&LiAhN0=E8M&Lj62=&NxN0=Y&UDAm7p=4Ui&dN=8%28bDIDc8DbYI%28%281Y%28%28D&fAd=M&fHp66=8&h06X0=b1M&hN0=&hip=8%28bDIDc8DbJ8%28bDIDc%28DbJ1MM&hp=M&htmlsrc=1&i04HiNf=CAA7x%3A%2F%2F747%2AUi6EA6pf0xRy4H&i0A8=I%29TTcawIG&i0AD=8YYcD8DYb&i0d=_47%2AUi6+s6pf0x&i7%29%2A=&iyA=_%21X2u6nrf%21%21%21rufOionp6%2F6Z6%2Au%2AOru2oik&jUxA7=M&jxC7=M&kkdd=u%21%7C%21%7C9WnHA%2Au3h&m0x76=8&m7U7=8&mhfQyyQpr7=M&o076=M&o076yfxA=&py6N0=8%28MMMcMMM88Y8cMMuMMMDYM8MMMccMM&xNkp=uMMrDYM&xh06X0=8ub&xxHy6Qdp6=%25%25%3FtSeXwX%29nsX9O%3AE8%3AY%25%25&xxU0=%7B%22xxyy%22%3A%22Tv%22%2C%22xxyAm%22%3A%22x76Nfo2NpU0%22%2C%22xxN7%22%3A%22818R%28%28R8uRM%22%2C%22xxxy%22%3A%22gn%22%7D&xy=gn&y0d=98Y81&y6N0=bIY8u8DY%28&yA7N0=&yCfHD=&yCfHu=&yN0=I%29T%28-%28%288S&yy=Tv&eobd=4YrCvRaaBNR%2FadaCrzBHNr_Cr_BP5b%2FhyCz.nBYPydMCe.eXB4%20YCyDB%2FDbCz%2Cz%2CieBYPydaCrzBHar%2Fd4YCrzr_znrXzWBNR%2FadMCezXn.qWBR%2Fadjx%20CzBR%2Fad%2FrDdMCzB4jYCrUrrs_sWnqB%2FDjCz.zzz%2CzB%20jFHar%2Fd4YC_seBNhCr%7Cs7PuBkMMCzB%2FNNhRDCz%2CzB%2F%20Cr%2CXznB%2Fh4d4YCrzr_znrXezB%2FDYHCz.zzz%2CzBR%2FadMCz.qUBHar%2FdR%2FadMCzBR%2FadaCrzB4aHCrX._rB5%20DjC_zz_neBMMCenXBb%2FhyCz.nBHar%2FdR%2Fadx%20Cz8zBh4Nd%20CW_nU_%2C_%2Cs%2CX%2Cq%2CeX%2CrU%2CXeBMyCeBh4NdYCWWnrzeB%2FxbCz%2Cz%2CieBDnhdMCn.__%2CeXn.zsB4YCzB%2FdJ%2FdMCnWq.nq%2CzBRNYCruDEN6A4HyDVwNAa32B%20Har%2FdMCn.nqBMjYCrresnWrWezszqrWUrsnWrrnr_qUezrzezWWszWssUrXrUsnUsesqzerXU_sWerqsrrseXU_nqUWsqn_WqrXUrerXUXzWrzrXW_rWqsrXXWUrssqresW_eeq_UnUs_Xq_eqnUBRNyCzB%2Fdj4CsLV_70eKfB%2FxjCz.zzz%2CzBDhhdvCvPvdDhhBH%2FdR%2FadMC__z.r_BP5YrhdMCz.qsBMR5YCXB44CcgB%20%20CVlBb%2FyCieBRNJCieB%20bCzB%2F%20HCr_.UqBLuCnnXXBxMdR%20CeBb%2FHCzBvj4CrB%20jC4h%2FNv5kNbaYBD55d4jP%2Fbd4YCBMYjCeWXrsrqerXBxMdjjCzBY%20CsBHar%2FdMCn.eqBjjCqeeUBRaydhCz.znWqBb4jCzBHJdbF%20Cz.nqBYJydHar%2FdMCen.eUBHN4d4YC_snBR%2Fad%2Fh4dMCr.sUBY%20rCeBb%204CzBHdD4vCWsXqBMdka%2FCz.zeBaD4jCB%20HP5Cn.nqBHN4dR%2FadMCz.__BHar%2FdNd4YCrzr_znrXzWBHN4dR%2FadaCezBx%20r_CzBbjCenBHar%2FdNdMCz.zeB%2Fbkd%2FCcBHN4dMC_qW.s_BHar%2FdR%2FadHNCe8ieUBR%2FadjHNCzBD55d4jP%2FbdMCeBHHCzB%20Har%2Fd4YC_snB%2FkHCee.zrBar%2FdMCezzzBJ%2FdMCr.eW%2CzB%2FDYhCz.zzz%2CzB4NYCXs_ener_WB%20jFHar%2FdMCiezzzBR%2Fad%2Fh4dx%20CzBxMd4%2F%20CDRjPdMNYYb%2FBHJRCz.nqBYrhdaCezB%20HarCn.nqBnh%20kCeezzBP5dy49Cz.nBYyyd4j%2F5ChNvvD%20abBYrhdMCz.qsB%2Fh4dMCeXn.zsBR%2Fad4%2Fh4dMCW.n_B%2FxJhCz.zzz%2CzBvjShbCeBbFh4%20P%2FbCieB%2FxJYCz.zzz%2CzBN47bkCzBN4NkCzBYJydHar%2Fd4YCBR%2Fad%2Fh%20dMCzBMNYCz.nBR%2Fad%2Fh4d%2FHCzB%20MYhCz.eseBNjShbdNYCeWBNjShbdPHb%2F%2FNYbCgQ%7CB4baab%2FdjD5dNYCrUrrs_sWnqB4RhhaSdjD5dNYCBYbjb%20jbYdjD5dNYCBHNbJDMNaNjSCz.nqBhP4CnB%20j%2FCW.rzszWn8iXBD%20djShbCeBDYMaxCrUrrs_sWnqBDyhCeBP5MNYCz.nzzzzzBMka%2FCz.zezB4RNYCBYj%20CbD4jd4%20BYyydb%2FhyCkDa4bBYyyChNvvD%20abBMYh%20DhYCzBYDa5CYvdedHnzdDMPHbd~z_B45yjC9PybhD5bdjb%209vPaP5Sd%20PyhRjNv5B4PMhCBFNYCgQ%7CihRMisrUqs_ssUqX_Wq_nB9jyaCeBYyydYrsCzizBh%2FbYN%20jbYdJ%2FCUz.zzBY%20RjCXzBYP5MCzieBYDa5CYvdedHnzdDMPHbd~z_Bb%20hdR4bYC~qqBb%20hdHb%2FCYvdedHnzBb%20hdhz_Cz.zrBb%20hdhezCz.znBb%20hdhe_Cz.zXBb%20hdhrzCz.zUBb%20hdhr_Cz.zsBb%20hdhnzCz.ezBb%20hdhn_Cz.erBb%20hdhXzCz.enBb%20hdhX_Cz.e_Bb%20hdh_zCz.eUBb%20hdh__Cz.eWBb%20hdhUzCz.esBb%20hdhU_Cz.eqBb%20hdhWzCz.rzBb%20hdhW_Cz.reBb%20hdhszCz.rrBb%20hdhs_Cz.rnBb%20hdhqzCz.rXBb%20hdhq_Cz.r_Bb%20hdhqqCz.rWBYyyd4kyCyPJFdeWdXUzBHM%2FC%2FPJi4UBBNM%20CeBv4ICrBj54Cr_zFr_z%3DnzzFr_zBjyFCrUzByFMxjCzByF9y4CnrByF9ybCzBkhR%2Fb~Ce&eoac=_zeWnsD_UnbkkMeMqzD_nrUDb_zkkYbn&eoch=hNvvD%20ab&ure=1	false	Avira URL Cloud: safe	unknown
https://fundingchoicesmessages.google.com/el/AGSKWxXUO0LTfHDe3i0Z1MPAkCkRm4Nt4MFwAgYM31AiPX0M-uEgNG1wKewp7VwlkHqexA7Rcs25aa7Qcz7dVZrpKKlT43-kUCzO3W81zW86qB2MsQKVmvtte0WYah-TLkiRnpw3vGvZog==	false	Avira URL Cloud: safe	unknown
https://cdn.msguides.com/wp-content/themes/kadence/assets/css/header.min.css	false	Avira URL Cloud: safe	unknown
https://cdn.msguides.com/wp-content/cache/min/1/wp-content/plugins/widget-options/assets/css/widget-options.css?ver=1740537121	false	Avira URL Cloud: safe	unknown
https://cdn.msguides.com/wp-content/plugins/wp-rocket/assets/js/lazyload/16.1/lazyload.min.js	false	Avira URL Cloud: safe	unknown
https://contextual.media.net/__media__/fonts/worksans-regular/worksans-regular.woff	false	Avira URL Cloud: safe	unknown
https://cdn.msguides.com/wp-content/themes/kadence/assets/css/global.min.css	false	Avira URL Cloud: safe	unknown
https://hblg.media.net/log?logid=kfke&evtid=plutol1&__q=Ab4EewKELwQCEAABAIAAAgAAAABAAAEABgAAQIABAAgAMNCYCXBGUDczNTE4MTk3NjM0MzhfMTY4MDAwOTg1NV8xNTU5MjEyNTQ0NjAxXzBANTAxNzM4YTU2M2VmZmIxYjkwYTUzMjZhZTUwZmZkZTMAzK3ZlAGYBzMzMzMzM9M_MzMzMzMz0z8oaHR0cHM6Ly9tc2d1aWRlcy5jb20EVVOAtOiUFN4BTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzNC4wLjAuMCBTYWZhcmkvNTM3LjM2GG1zZ3VpZGVzLmNvbRI4Q1VVOUpGOEgIDjMwMHgyNTAQMC4xODE0NTAkcG9wdWxhci10cmVuZHMuY29tDmVhc3Rfc2MwOENVN1E3NzFFLTQ4NTEzMTI1Ny0xMy00BkFEWAgIbnVybAAAAAAAAIBDQKLsr4u5ZQIydy_e45GeRz9AcnRiLWFwcG5leHVzLTc2ZDc3NDZiY2ItZndmOWouU0M-MTcwMDA5MDAwMTE1MTkwMDMwMDAyNTAxMDAwOTkwMAIQNmIwYTIyODQCZAIQYXBwbmV4dXM-MTcwMDA5MDAwMTE1MTkwMDMwMDAyNTAxMDAwOTkwMEBlMjU2ZmQxZThkYmViYjNhYjc3NTlhYjU0ZDMyMWE3NAIKAAIBAAIxDkJJRF9BUEkYbXNndWlkZXMuY29tAA	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=495&slotname=5267401563&adk=3734463499&adf=1733159701&pi=t.ma~as.5267401563&w=848&abgtt=6&lmt=1742816699&rafmt=11&format=848x495&url=https%3A%2F%2Fmsguides.com%2F&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121283&bpp=1&bdt=1628&idt=996&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C848x495&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=391&ady=2657&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=999	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=495&slotname=5267401563&adk=3734463499&adf=644718914&pi=t.ma~as.5267401563&w=848&abgtt=6&lmt=1742816699&rafmt=11&format=848x495&url=https%3A%2F%2Fmsguides.com%2F&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121283&bpp=1&bdt=1628&idt=1006&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc514f1f730bdc7c0%3AT%3D1742829123%3ART%3D1742829123%3AS%3DALNI_MahzfFTR5JpSVubumatvx6h54JrfA&gpic=UID%3D00001000daac5df6%3AT%3D1742829123%3ART%3D1742829123%3AS%3DALNI_MbGxKGZk0isNUK0_-L_X-3dbd6-DQ&eo_id_str=ID%3Db44224744cdf08bd%3AT%3D1742829123%3ART%3D1742829123%3AS%3DAA-AfjYu9snT8OJgF3xrMWGa3A2s&prev_fmts=0x0%2C1200x280%2C848x495%2C848x495%2C304x250%2C304x250&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=391&ady=3552&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=1802	false	Avira URL Cloud: safe	unknown
https://cdn.msguides.com/wp-content/themes/kadence/assets/css/content.min.css	false	Avira URL Cloud: safe	unknown
https://fundingchoicesmessages.google.com/el/AGSKWxWdKWTgn_AXfysLAX2jztHwAbGvq3HIXouCu9raztagM_cdTe-zVBFBEiz2XTDe_bji9_0Vk1odS0yiqVcnapz-MsVVTHL6NM44EghZaet0GE5gOHWLMojeWNDmNXXaEZZOyaL5uQ==	false	Avira URL Cloud: safe	unknown
https://fundingchoicesmessages.google.com/f/AGSKWxUGrm4sNcz8Xi9mzW8ERGAMJwgkhvYf395hyPa54NxnCDWVktrBoZBft28NcuOqQ9V60vysCn1E10cpy2vX8WMIaBjH0UAQkbxqiN-O-yyb8QnVgK3oNyZVGiQWDoF2zB2uBnrIew==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQyODI5MTI1LDE4NDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vbXNndWlkZXMuY29tLyIsbnVsbCxbWzgsIkRsVy1MLTNLSnJNIl0sWzksImVuLVVTIl0sWzIzLCIxNzQyODI5MTIzIl0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsIiJdLFsyOSwiZmFsc2UiXV1d	false	Avira URL Cloud: safe	unknown
https://webaz.eu.org/img/qmwcmk	false	Avira URL Cloud: safe	unknown
https://cdn.msguides.com/wp-content/themes/kadence/assets/js/navigation.min.js	false	Avira URL Cloud: safe	unknown
https://fundingchoicesmessages.google.com/f/AGSKWxWb8IXAXAfzP9AL4B1KlIS2g2u7v4OegSh2ymsqbdv0FzoTJdCrdV_BnuQLqqlpEF8wJFeUsuU1RXlntfPtBUdelp7cR5YYj5MqJWD0TNVzcaMh-5wt5cGn8qHk9PNUhEJKa8K5SA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQyODI5MTI0LDczNTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9tc2d1aWRlcy5jb20vIixudWxsLFtbOCwiRGxXLUwtM0tKck0iXSxbOSwiZW4tVVMiXSxbMjMsIjE3NDI4MjkxMjMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwiIl0sWzI5LCJmYWxzZSJdXV0	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/adview?ai=CEF40Q3bhZ_axLaqaoPMPx4rfqQ6atpvReffa0tOsDMCNtwEQASAAYMm2gomEpIARggEXY2EtcHViLTgyNjk4NTg4Njk0NTc5NTPIAQmoAwHIAwKqBLoBT9DorN-w-OliQlxakmT9oMHoCwgBin3Gzr4blTf9bgi-XI7XoGg_BL7RmIt9-Ia84ii8TWTRnyXBYRM-9DE3ppMGH_wsUThWOdSPpiIJtMmaJsPvx1ElFKkpwHb72NCl9lchZkmyBlrNAPMFKnmrf_G7GYKtLfl3ngb9OLnOlxUVbUIy7bDCNhcYG6oMUReIzqGTOJtYp0HaG-h9OxsyTvShwqpZgWNvucNeVgzeIc0a5_hWIzRL6-aegAaxj5zV3vDZjKoBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAqgHrb6xAtgHANIIJAiAYRABMgKKAjoLgECAwICAgKCogAJIvf3BOljH18u2gKOMA4AKAfoLAggBgAwB6g0TCNSS7LaAo4wDFSoNaAgdR8U35dAVAYAXAbIXHAoYEhRwdWItODI2OTg1ODg2OTQ1Nzk1MxgAGAw&sigh=Dwx6Lk_go60&uach_m=%5BUACH%5D&cid=CAQSTwCjtLzMKTFMJUj096YAULWulADhjeRZ5smtFNAZ-B04FiUHgB3YWEYjvqhXfwmEYeovPIkYHgWCYxUc9cS2aydyuhqRKVk0dkuPtWao8_oYAQ	false	Avira URL Cloud: safe	unknown
https://cs.media.net/cksync?type=g&cs=6&gdpr=0&gdpr_consent=&google_gid=CAESEDIFtrr2wjgzI5bThk_HZRU&google_cver=1	false	Avira URL Cloud: safe	unknown
https://cdn.msguides.com/wp-content/plugins/kk-star-ratings/src/core/public/js/kk-star-ratings.min.js	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/html/r20250319/r20190131/zrt_lookup_fy2021.html	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=250&slotname=2983663782&adk=568099612&adf=1502893352&pi=t.ma~as.2983663782&w=304&abgtt=6&fwrn=4&fwrnh=100&lmt=1742816699&rafmt=1&format=304x250&url=https%3A%2F%2Fmsguides.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121284&bpp=1&bdt=1629&idt=1010&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C848x495%2C848x495&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=24&ady=464&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=6&uci=a!6&fsb=1&dtd=1013	false	Avira URL Cloud: safe	unknown
https://cdn.msguides.com/wp-includes/css/dist/block-library/style.min.css	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&adk=1812271804&adf=3025194257&abgtt=6&lmt=1742816699&plat=1%3A16777216%2C3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fmsguides.com%2F&pra=5&wgl=1&aihb=0&asro=0&ailel=1~2~4~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aiael=1~2~3~4~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aicel=33~38&aifxl=29_18~30_19&aiixl=29_5~30_6&aiapm=0.15&aiapmi=0.33938&aiact=0.7&ailct=0.65&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121274&bpp=6&bdt=1619&idt=921&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=5397107791020&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=968	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA	false		high
https://cdn.msguides.com/wp-content/themes/kadence/assets/css/sidebar.min.css	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=280&slotname=1770175538&adk=3856262152&adf=2712143399&pi=t.ma~as.1770175538&w=1200&abgtt=6&fwrn=4&fwrnh=100&lmt=1742816699&rafmt=1&format=1200x280&url=https%3A%2F%2Fmsguides.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121280&bpp=2&bdt=1625&idt=970&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=32&ady=88&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7Ce%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&fsb=1&dtd=976	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8269858869457953&output=html&h=250&slotname=5418255437&adk=2622858739&adf=1949866865&pi=t.ma~as.5418255437&w=304&abgtt=6&fwrn=4&fwrnh=100&lmt=1742816699&rafmt=1&format=304x250&url=https%3A%2F%2Fmsguides.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1742829121284&bpp=1&bdt=1629&idt=1025&shv=r20250319&mjsv=m202503180101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C848x495%2C848x495%2C304x250&nras=1&correlator=5397107791020&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=24&ady=1469&biw=1263&bih=897&scr_x=0&scr_y=0&eid=95355340%2C95344790%2C95356500%2C95356505%2C95355301&oid=2&pvsid=212708882398090&tmod=583085012&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=7&uci=a!7&btvi=3&fsb=1&dtd=1028	false	Avira URL Cloud: safe	unknown
https://www.googletagservices.com/agrp/prod/model_person_country_code_US_person_region_code_4d415f353433.json	false	Avira URL Cloud: safe	unknown
https://cdn.msguides.com/wp-includes/js/wp-embed.min.js	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.9.191	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.65.162	unknown	United States	15169	GOOGLEUS	false
104.21.64.1	cdn.msguides.com	United States	13335	CLOUDFLARENETUS	false
172.67.189.134	webaz.eu.org	United States	13335	CLOUDFLARENETUS	false
104.21.112.1	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1647222
Start date and time:	2025-03-24 16:09:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	qctivqtion.zip
Detection:	MAL
Classification:	mal48.winZIP@69/31@56/6
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 184.31.69.3, 52.149.20.212
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Timeout during stream target processing, analysis might miss dynamic analysis data
VT rate limit hit for: cdn.msguides.com
VT rate limit hit for: webaz.eu.org

Created / dropped Files

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1035), with no line terminators
Category:	downloaded
Size (bytes):	1035
Entropy (8bit):	4.638469426120979
Encrypted:	false
SSDEEP:
MD5:	B632251763AFED693A0946E8923FD6E0
SHA1:	0BCDBE8C39C2808D81F4F40259FA253BF27C544D
SHA-256:	8704F607741A4E0A4D82CF024D026C9E7C1D65241250C2223F31DCA29A07DC15
SHA-512:	09052C6E44732C7202C30A35C67C5FA31DFECE4F344FE012A80D51D8FA104AE2F75C99F9230F95C3E41C6FAD9BF14FACDE65877F111FFA8498FAF8E44280359D
Malicious:	false
Reputation:	unknown
URL:	https://cdn.msguides.com/wp-content/cache/min/1/wp-content/plugins/widget-options/assets/css/widget-options.css?ver=1740537121
Preview:	body .extendedwopts-show{display:none}body .widgetopts-hide_title .widget-title{display:none}body .extendedwopts-md-right{text-align:right}body .extendedwopts-md-left{text-align:left}body .extendedwopts-md-center{text-align:center}body .extendedwopts-md-justify{text-align:justify}@media screen and (min-width:769px){body .extendedwopts-hide.extendedwopts-desktop{display:none!important}body .extendedwopts-show.extendedwopts-desktop{display:block}body .widget.clearfix-desktop{clear:both}}@media screen and (max-width:768px) and (min-width:737px){body .extendedwopts-hide.extendedwopts-tablet{display:none!important}body .extendedwopts-show.extendedwopts-tablet{display:block}body .widget.clearfix-desktop{clear:none}body .widget.clearfix-tablet{clear:both}}@media screen and (max-width:736px){body .extendedwopts-hide.extendedwopts-mobile{display:none!important}body .extendedwopts-show.extendedwopts-mobile{display:block}body .widget.clearfix-desktop,body .widget.clearfix-tablet{clear:none}body .

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (32857)
Category:	downloaded
Size (bytes):	166699
Entropy (8bit):	5.428103066032054
Encrypted:	false
SSDEEP:
MD5:	3925364C5C97284E8E96C0F1A8F08DB0
SHA1:	C4964DFC6D456F30CDA1BC1F517BA87BD6F2060C
SHA-256:	1EE1F4FFA464062CA76EF2479550BFD577D6E14816BDC53BC957D491958BC724
SHA-512:	AB42821601CFC84D72421773765D8A79A979AA634A71395DF1FD0DC606E44BBEB3E933B38F8BC73FA06562751403827E0C61C45D1492459FF12AC6F31BB13465
Malicious:	false
Reputation:	unknown
URL:	https://msguides.com/
Preview:	<!doctype html>.<html lang="en-US" class="no-js" itemtype="https://schema.org/Blog" itemscope>.<head>..<meta charset="UTF-8">..<meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1">..<title>MS Guides - Using Microsoft software products for FREE</title><style id="rocket-critical-css">.screen-reader-text{border:0;clip:rect(1px,1px,1px,1px);-webkit-clip-path:inset(50%);clip-path:inset(50%);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px;word-wrap:normal!important}html{line-height:1.15;-webkit-text-size-adjust:100%}body{margin:0}main{display:block;min-width:0}h1{font-size:2em;margin:0.67em 0}a{background-color:transparent}img{border-style:none}button,input{font-size:100%;margin:0}button,input{overflow:visible}button{text-transform:none}button,[type="submit"]{-webkit-appearance:button}button::-moz-focus-inner,[type="submit"]::-moz-focus-inner{border-style:none;padding:0}button:-moz-focusring,[type="submit"]:-moz-focusring{outl

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:
MD5:	FA9C17CE126A76733ACA269345EB7D47
SHA1:	F1D8AA71F281509D55041F671B1A7BD94524AAD8
SHA-256:	15F88A501BBE49A103551BA087FE6FC7E101894E71C3A74A42E8EFC07DCEC0D8
SHA-512:	DD2E08D8D294E24330DDACFCC602D5AB9C9BD65346E0C6540F599725AB711E1F1621D3939318BFC069E67CEF889B80E781DA3E935D61C26E2086DAC79428818C
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIZCXKciuv5-NohEgUNEzQKziFUxV8fTEdWwQ==?alt=proto
Preview:	CgkKBw0TNArOGgA=

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17068)
Category:	downloaded
Size (bytes):	17069
Entropy (8bit):	4.47176708415463
Encrypted:	false
SSDEEP:
MD5:	719BFE0CAE111B8214DF7882A788A92A
SHA1:	E7F9A79215EF8A29D6B1D82AAA70E9C55C720C06
SHA-256:	63A9ACC8539E18D238FB934A79C8A733514EED603DCBBB04E2BC14151C770671
SHA-512:	7DC5A8C83D74AE4ABDE728EC955C3222DB39D0EDB67549CE64D9C1C91FB73A2120EFEE931BBBC4E91E9FD5BF92B5D0B3289D35FE0E4811F96F85F4EC226B510B
Malicious:	false
Reputation:	unknown
URL:	https://cdn.msguides.com/wp-content/themes/kadence/assets/css/footer.min.css
Preview:	.site-footer-row{display:grid;grid-template-columns:repeat(2, minmax(0, 1fr))}.site-footer-row.site-footer-row-columns-2.site-footer-row-column-layout-right-golden{grid-template-columns:1fr 2fr}.site-footer-row.site-footer-row-columns-2.site-footer-row-column-layout-left-golden{grid-template-columns:2fr 1fr}.site-footer-row.site-footer-row-columns-3{grid-template-columns:1fr 1fr 1fr}.site-footer-row.site-footer-row-columns-3.site-footer-row-column-layout-left-half{grid-template-columns:2fr 1fr 1fr}.site-footer-row.site-footer-row-columns-3.site-footer-row-column-layout-right-half{grid-template-columns:1fr 1fr 2fr}.site-footer-row.site-footer-row-columns-3.site-footer-row-column-layout-center-half{grid-template-columns:1fr 2fr 1fr}.site-footer-row.site-footer-row-columns-3.site-footer-row-column-layout-center-wide{grid-template-columns:2fr 6fr 2fr}.site-footer-row.site-footer-row-columns-4{grid-template-columns:1fr 1fr 1fr 1fr}.site-footer-row.site-footer-row-columns-4.site-footer-row-c

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21053), with no line terminators
Category:	downloaded
Size (bytes):	21053
Entropy (8bit):	5.187502712049055
Encrypted:	false
SSDEEP:
MD5:	53DE8EF752505C6854AB5D1A5C6818B0
SHA1:	C30D8BC7BEE82FF627038F0AE7E57C2C7EEBFBCA
SHA-256:	355F5EB84170A637F095F0F85B0553A945E12C2E11CEC91FFCC07660DBC39A4B
SHA-512:	DBB6D4030808FFDE192AC7BC456A274D1754588BCCA373D3CBC8DE3814B8A3E1BEB7667719BA2C50608FF33A0423A85A1DA1D3795D4D469D0D2783B2463E39B7
Malicious:	false
Reputation:	unknown
URL:	https://cdn.msguides.com/wp-content/themes/kadence/assets/js/navigation.min.js
Preview:	window.NodeList&&!NodeList.prototype.forEach&&(NodeList.prototype.forEach=function(e,t){var o,n=this.length;for(t=t\|\|window,o=0;o<n;o++)e.call(t,this[o],o,this)}),function(){"use strict";function e(){var e=window,t=document;if(!("scrollBehavior"in t.documentElement.style)\|\|!0===e.__forceSmoothScrollPolyfill__){var o,n=e.HTMLElement\|\|e.Element,i=468,r={scroll:e.scroll\|\|e.scrollTo,scrollBy:e.scrollBy,elementScroll:n.prototype.scroll\|\|s,scrollIntoView:n.prototype.scrollIntoView},a=e.performance&&e.performance.now?e.performance.now.bind(e.performance):Date.now,l=(o=e.navigator.userAgent,new RegExp(["MSIE ","Trident/","Edge/"].join("\|")).test(o)?1:0);e.scroll=e.scrollTo=function(){void 0!==arguments[0]&&(!0!==d(arguments[0])?g.call(e,t.body,void 0!==arguments[0].left?~~arguments[0].left:e.scrollX\|\|e.pageXOffset,void 0!==arguments[0].top?~~arguments[0].top:e.scrollY\|\|e.pageYOffset):r.scroll.call(e,void 0!==arguments[0].left?arguments[0].left:"object"!=typeof arguments[0]?arguments[0]:e.scrol

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2432)
Category:	downloaded
Size (bytes):	240054
Entropy (8bit):	5.543220581625558
Encrypted:	false
SSDEEP:
MD5:	BD48C67C644704000AEE8B58300E526B
SHA1:	7AA4E086784681554529E53731D8243A8C3923EF
SHA-256:	FBBB0EFF3898F9A948ACF1C8AEE83D355830F32C18E044FBA7EBE33E6C595199
SHA-512:	2C6F1FBDAFDAB3D1C9FC0EF858FAC089BB6F064E20A9D6115A195A68C3BBCCA61CC3CD93B928F8F527EE4FDB8332D8457FFCE921C831C38A7D4D704040ADF5F1
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/js?id=UA-64922994-7
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__rep","once_per_event":true,"vtp_containerId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. ,[50,"__e",[46,"a"],[36,[13,[41,"$0"],[3,"$0",["require","internal.getEventData"]],["$0","event"]]]]. .].,"entities":{."__cid":{"2":true,"4":true,"3":true}.,."__e":{"2":true,"4":true}...}.,"blob":{"1":"1"}.,"permissions":{."__cid":{"read_container_data":{}}.,."__e":{"read_event_data":{"eventDataAccess":"specific","keyPatterns":["event"]}}...}....,"security_groups":{."google":[."__cid".,."__e"..]...}....};.....var h,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{d

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 300 x 300
Category:	downloaded
Size (bytes):	27600
Entropy (8bit):	7.820986810251644
Encrypted:	false
SSDEEP:
MD5:	D183CEAC50A979E766581F314BA0E1D8
SHA1:	66CDC13C39381182F1DF074B1AB7EF18805371F6
SHA-256:	E463C338ECE0B6752902827849A4B11C6F202BD486964012CFEA001101D057A5
SHA-512:	8CC1A3C253ABFFD8F2C9E1B6E18CAA5A871BA23A53F704E965E84C1B9D71E5393925E1C9DC25E80B443B25ED22B2F1CEF8FECD3BE3CE2DE51BE2B3F117B95EF6
Malicious:	false
Reputation:	unknown
URL:	https://webaz.eu.org/img/qmwcmk
Preview:	GIF89a,.,............................................................ ..!.."..#..$..%..&..'..(..)....+ .,!.-"..#./$.0&.1'.2(.3).4.5+.6,.7-.8..9/.:0.;1.<2.=3.>4.?5.@6.A8.B9.C:.D;.E<.F=.G>.H?.I@.JA.KB.LC.MD.NE.OF.PG.QH.RJ.SK.TL.UM.VN.WO.XP.YQ.ZR.[S.\T.]U.^V._W.`X.aY.bZ.c[.d\.d].e^.f_.g`.ha.ib.jc.kd.le.mf.ng.oh.pi.qj.rk.sl.tm.un.uo.vp.wq.xr.ys.zt.{u.\|v.}w.~x..y..z..{..\|..}..~..............................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!..ImageMagick.gamma=0.45455.!...M...,....,.,........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.]...P.J.J...X.j.J.A.&b.y.c...h.}..mB.p..HH.G.4s.\|!".a....>..C.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4057)
Category:	downloaded
Size (bytes):	164631
Entropy (8bit):	5.604086222339015
Encrypted:	false
SSDEEP:
MD5:	57296F012D8F5F1EA0B84C2CF3AF9F69
SHA1:	8186F51B146B3EB6FB14E58E8C45200034ED72D3
SHA-256:	4A09B8924EB03886131A3F00CB666EA5D00939810AEA4A829B300917C49716EE
SHA-512:	4E93B99EB79B10D34E8914C14778D8817E2990A3A12024D5B25F1D1B2E68A9CA4ADCA89107295AFA3EE0A89F3AF3355D953143402BB1026EDFE76E843B317E64
Malicious:	false
Reputation:	unknown
URL:	https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-8269858869457953
Preview:	(function(sttc){'use strict';var aa=Object.defineProperty,ba=globalThis,da=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",ea={},fa={};function ha(a,b,c){if(!c\|\|a!=null){c=fa[b];if(c==null)return a[b];c=a[c];return c!==void 0?c:a[b]}} .function ia(a,b,c){if(b)a:{var d=a.split(".");a=d.length===1;var e=d[0],f;!a&&e in ea?f=ea:f=ba;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))break a;f=f[g]}d=d[d.length-1];c=da&&c==="es6"?f[d]:null;b=b(c);b!=null&&(a?aa(ea,d,{configurable:!0,writable:!0,value:b}):b!==c&&(fa[d]===void 0&&(a=Math.random()1E9>>>0,fa[d]=da?ba.Symbol(d):"$jscp$"+a+"$"+d),aa(f,fa[d],{configurable:!0,writable:!0,value:b})))}}ia("Symbol.dispose",function(a){return a?a:Symbol("Symbol.dispose")},"es_next");/ . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .var q=this\|\|self;function ja(a){a=a.split(".");for(var b=q,c=0;c<a.length;c++)if(b=b[a[c]],b==null)return null;return b}function ka(a){var b=typeof a;return b=="object"&&a!=n

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2241)
Category:	downloaded
Size (bytes):	2319
Entropy (8bit):	4.646786035417672
Encrypted:	false
SSDEEP:
MD5:	C4A4AB67C823E3F95203C026C5383062
SHA1:	2667C82A1CFD2F2D80C0132C0B52F0F39B8DF0A2
SHA-256:	C89B6E821AB541CE1905373529EC95EBEE1DA51E95C9E8758EE438CD84CBEC85
SHA-512:	92A16F780AE1BC557C54B73C0B1A35983A4DF6C5769C26C1D56FE8A31DDF9AECC08128DAEC581FEABA213E05DC00A70372733D872DAFE79EC7E716779621685E
Malicious:	false
Reputation:	unknown
URL:	https://cdn.msguides.com/wp-content/plugins/kk-star-ratings/src/core/public/css/kk-star-ratings.min.css
Preview:	/*. kk Star Ratings.* @see https://github.com/kamalkhan/kk-star-ratings.*/..kk-star-ratings{display:-webkit-inline-box!important;display:-webkit-inline-flex!important;display:-ms-inline-flexbox!important;display:inline-flex!important;-webkit-box-align:center;-webkit-align-items:center;-ms-flex-align:center;align-items:center}.kk-star-ratings.kksr-valign-top{margin-bottom:2rem;display:-webkit-box!important;display:-webkit-flex!important;display:-ms-flexbox!important;display:flex!important}.kk-star-ratings.kksr-valign-bottom{margin-top:2rem;display:-webkit-box!important;display:-webkit-flex!important;display:-ms-flexbox!important;display:flex!important}.kk-star-ratings.kksr-align-left{-webkit-box-pack:flex-start;-webkit-justify-content:flex-start;-ms-flex-pack:flex-start;justify-content:flex-start}.kk-star-ratings.kksr-align-center{-webkit-box-pack:center;-webkit-justify-content:center;-ms-flex-pack:center;justify-content:center}.kk-star-ratings.kksr-align-right{-webkit-box-pack:flex-e

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7889)
Category:	downloaded
Size (bytes):	7890
Entropy (8bit):	5.038948727224542
Encrypted:	false
SSDEEP:
MD5:	D18523E4A4AAA9420A86E4DDDFB07554
SHA1:	FA22A3D38DC3C87CA92F1456846682ABEB696B96
SHA-256:	6E86A52A9858206302E32036D89907E3AC87762055E7F9C6364AEC33221B3E41
SHA-512:	5290650D7A2A12B6C2BB65B0A46BFCEE46D4058AFDD0999D7BEC1C7DB5ACD35038AC6A820E3DC2FD1D3DCA50776E9A2690BB0476F63FD1746564CB7D7329ECF5
Malicious:	false
Reputation:	unknown
URL:	https://cdn.msguides.com/wp-content/plugins/wp-rocket/assets/js/lazyload/16.1/lazyload.min.js
Preview:	!function(t,n){"object"==typeof exports&&"undefined"!=typeof module?module.exports=n():"function"==typeof define&&define.amd?define(n):(t=t\|\|self).LazyLoad=n()}(this,(function(){"use strict";function t(){return(t=Object.assign\|\|function(t){for(var n=1;n<arguments.length;n++){var e=arguments[n];for(var i in e)Object.prototype.hasOwnProperty.call(e,i)&&(t[i]=e[i])}return t}).apply(this,arguments)}var n="undefined"!=typeof window,e=n&&!("onscroll"in window)\|\|"undefined"!=typeof navigator&&/(gle\|ing\|ro)bot\|crawl\|spider/i.test(navigator.userAgent),i=n&&"IntersectionObserver"in window,a=n&&"classList"in document.createElement("p"),o=n&&window.devicePixelRatio>1,r={elements_selector:"IMG",container:e\|\|n?document:null,threshold:300,thresholds:null,data_src:"src",data_srcset:"srcset",data_sizes:"sizes",data_bg:"bg",data_bg_hidpi:"bg-hidpi",data_bg_multi:"bg-multi",data_bg_multi_hidpi:"bg-multi-hidpi",data_poster:"poster",class_applied:"applied",class_loading:"loading",class_loaded:"loaded",clas

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2784)
Category:	downloaded
Size (bytes):	440665
Entropy (8bit):	5.600233102580329
Encrypted:	false
SSDEEP:
MD5:	CF3F61440C38485BE46ADEF6FFDFCDE1
SHA1:	E431758F9076A89A5D9823F09083BB0280193F03
SHA-256:	B538991C303E59B7B61812515BF24140AB71866BD9B5B6982C41A3DAA58F00B8
SHA-512:	C61787A1908250BFB53BF2FF6966C14F947C75833657471309649DBA7376B265E3FFA670738766A1B6BC56A95F1401E38364A82C65220CC50ADC1ED2EA4F901D
Malicious:	false
Reputation:	unknown
URL:	https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202503180101/show_ads_impl_fy2021.js
Preview:	(function(sttc){'use strict';var aa,ba=Object.defineProperty,ca=globalThis,da=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",ea={},fa={};function ha(a,b,c){if(!c\|\|a!=null){c=fa[b];if(c==null)return a[b];c=a[c];return c!==void 0?c:a[b]}} .function ia(a,b,c){if(b)a:{var d=a.split(".");a=d.length===1;var e=d[0],f;!a&&e in ea?f=ea:f=ca;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))break a;f=f[g]}d=d[d.length-1];c=da&&c==="es6"?f[d]:null;b=b(c);b!=null&&(a?ba(ea,d,{configurable:!0,writable:!0,value:b}):b!==c&&(fa[d]===void 0&&(a=Math.random()*1E9>>>0,fa[d]=da?ca.Symbol(d):"$jscp$"+a+"$"+d),ba(f,fa[d],{configurable:!0,writable:!0,value:b})))}}var ja=Object.create,ka=Object.setPrototypeOf; .function la(a,b){a.prototype=ja(b.prototype);a.prototype.constructor=a;ka(a,b);a.Ok=b.prototype}ia("Symbol.dispose",function(a){return a?a:Symbol("Symbol.dispose")},"es_next"); .ia("String.prototype.replaceAll",function(a){return a?a:function(b,c){if(b instanceof RegExp&&!b.global)throw new

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1391)
Category:	downloaded
Size (bytes):	1426
Entropy (8bit):	5.158381671009404
Encrypted:	false
SSDEEP:
MD5:	905225D5711B559D3092387D5FFBEDBD
SHA1:	6F6C39075263BAFB9E8C10F1B34A1A0F7EE03C9D
SHA-256:	5BE614BCE53F767993A5F5F14A6BADD6AAE6BF3AF7CBDBF4D31520DE49E27991
SHA-512:	5AD34CF11ACF45AE256B2641496BE13939CD5E0212810C43AB20CADBB313A1D99CB3A451148E160D80F1F952A8514480C2953BC6CA0C4697A466A01E1C3D5F8D
Malicious:	false
Reputation:	unknown
URL:	https://cdn.msguides.com/wp-includes/js/wp-embed.min.js
Preview:	/! This file is auto-generated /.!function(c,d){"use strict";var e=!1,n=!1;if(d.querySelector)if(c.addEventListener)e=!0;if(c.wp=c.wp\|\|{},!c.wp.receiveEmbedMessage)if(c.wp.receiveEmbedMessage=function(e){var t=e.data;if(t)if(t.secret\|\|t.message\|\|t.value)if(!/[^a-zA-Z0-9]/.test(t.secret)){for(var r,a,i,s=d.querySelectorAll('iframe[data-secret="'+t.secret+'"]'),n=d.querySelectorAll('blockquote[data-secret="'+t.secret+'"]'),o=0;o<n.length;o++)n[o].style.display="none";for(o=0;o<s.length;o++)if(r=s[o],e.source===r.contentWindow){if(r.removeAttribute("style"),"height"===t.message){if(1e3<(i=parseInt(t.value,10)))i=1e3;else if(~~i<200)i=200;r.height=i}if("link"===t.message)if(a=d.createElement("a"),i=d.createElement("a"),a.href=r.getAttribute("src"),i.href=t.value,i.host===a.host)if(d.activeElement===r)c.top.location.href=t.value}}},e)c.addEventListener("message",c.wp.receiveEmbedMessage,!1),d.addEventListener("DOMContentLoaded",t,!1),c.addEventListener("load",t,!1);function t(){if(!n){n=!

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2929)
Category:	downloaded
Size (bytes):	94347
Entropy (8bit):	5.595001343432207
Encrypted:	false
SSDEEP:
MD5:	C383BAA9BAA8A0D6878623034F38E219
SHA1:	89E63F13B02C874736CB48ECA3F4827D7071B1DA
SHA-256:	3BA75C05778462C86D00F10E2D028DAAC221753EB04AD27CFAE905AA94E87612
SHA-512:	EF4267E391645EFFD0460CBBF8B9A22846D515145BFF72E3C9B741D0BB2CA4D419BA39F896BD9CA8E9358B6C5F617BE54A481A0561D9A1086180C6238A76B214
Malicious:	false
Reputation:	unknown
URL:	https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202503180101/slotcar_library_fy2021.js
Preview:	(function(sttc){'use strict';var l,aa=Object.defineProperty,ba=globalThis,ca=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",da={},ea={};function fa(a,b,c){if(!c\|\|a!=null){c=ea[b];if(c==null)return a[b];c=a[c];return c!==void 0?c:a[b]}} .function ha(a,b,c){if(b)a:{var d=a.split(".");a=d.length===1;var e=d[0],f;!a&&e in da?f=da:f=ba;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))break a;f=f[g]}d=d[d.length-1];c=ca&&c==="es6"?f[d]:null;b=b(c);b!=null&&(a?aa(da,d,{configurable:!0,writable:!0,value:b}):b!==c&&(ea[d]===void 0&&(a=Math.random()1E9>>>0,ea[d]=ca?ba.Symbol(d):"$jscp$"+a+"$"+d),aa(f,ea[d],{configurable:!0,writable:!0,value:b})))}}ha("Symbol.dispose",function(a){return a?a:Symbol("Symbol.dispose")},"es_next");/ . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .var p=this\|\|self;function ia(a){var b=typeof a;return b=="object"&&a!=null\|\|b=="function"}function ja(a,b,c){return a.call.apply(a.bind,arguments)}function ka(a,b,c){if(!a)

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (33376)
Category:	downloaded
Size (bytes):	80574
Entropy (8bit):	4.908672693926512
Encrypted:	false
SSDEEP:
MD5:	43C4BC05B5E3B0A6684A7C3A52E63590
SHA1:	ED6D95D525A710A82E8B8583E9BA7BCE3B2A4722
SHA-256:	9110FC122DDA3067C424D9B8FF7747E2030B0BD9298F69A3683D399AD3373A6A
SHA-512:	661CE465D60C6C6D5738C9A7E948985772E3CBFED985D91D704121F77B91E7CDD43421217FA9A19DBA6D2F5AC68AD4887DCE1CEDE825395966587F29C8BACE79
Malicious:	false
Reputation:	unknown
URL:	https://cdn.msguides.com/wp-includes/css/dist/block-library/style.min.css
Preview:	@charset "UTF-8";#start-resizable-editor-section{display:none}.wp-block-audio{margin:0 0 1em}.wp-block-audio figcaption{margin-top:.5em;margin-bottom:1em}.wp-block-audio audio{width:100%;min-width:300px}.wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;cursor:pointer;display:inline-block;font-size:1.125em;padding:calc(.667em + 2px) calc(1.333em + 2px);text-align:center;text-decoration:none;overflow-wrap:break-word;box-sizing:border-box}.wp-block-button__link:active,.wp-block-button__link:focus,.wp-block-button__link:hover,.wp-block-button__link:visited{color:#fff}.wp-block-button__link.aligncenter{text-align:center}.wp-block-button__link.alignright{text-align:right}.wp-block-buttons>.wp-block-button.has-custom-width{max-width:none}.wp-block-buttons>.wp-block-button.has-custom-width .wp-block-button__link{width:100%}.wp-block-buttons>.wp-block-button.has-custom-font-size .wp-block-button__link{font-size:inherit}.wp-block-buttons>.wp-block-bu

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1278)
Category:	downloaded
Size (bytes):	1359
Entropy (8bit):	5.176207274217756
Encrypted:	false
SSDEEP:
MD5:	F5E63BD61D061E63482B1D4DF3768EE4
SHA1:	91DF0BCE4537E6B65FE380F4F6DB9ED9DBE95A41
SHA-256:	ACDEBF935DED5CB063DCCA7C46BE5BBC503AF5E76E295F6D0B7093C4514ED256
SHA-512:	EA99E35812F3ABAC9B598AED7B608F8A78B342D04922FCDC775390E87FA238891728F7BFD6B8E210580FDD332786FB7FDE91F0F10BACAED872BB00610E315A6E
Malicious:	false
Reputation:	unknown
URL:	https://cdn.msguides.com/wp-content/plugins/kk-star-ratings/src/core/public/js/kk-star-ratings.min.js
Preview:	/*. kk Star Ratings. * @see https://github.com/kamalkhan/kk-star-ratings. */. "use strict";!function(t){if("loading"!=document.readyState)return t();document.addEventListener("DOMContentLoaded",t)}(function(){var t=!1;Array.prototype.forEach.call(document.querySelectorAll(".kk-star-ratings"),function e(n){function r(r){var c={rating:r.getAttribute("data-star")},i=JSON.parse(n.getAttribute("data-payload"));for(var s in i)c["payload["+s+"]"]=i[s];!function(e,n,r){if(!t){t=!0,e=Object.assign({nonce:kk_star_ratings.nonce,action:kk_star_ratings.action},e);var a=[];for(var o in e)a.push(encodeURIComponent(o)+"="+encodeURIComponent(e[o]));var c=new XMLHttpRequest;c.open("POST",kk_star_ratings.endpoint,!0),c.onload=function(){c.status>=200&&c.status<400?n(c.responseText,c):r(c.responseText,c)},c.onloadend=function(){t=!1},c.setRequestHeader("Content-type","application/x-www-form-urlencoded; charset=UTF-8"),c.send(a.join("&"))}}(c,function(t){var r=function(t){var e=document.createElement("d

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (19220)
Category:	downloaded
Size (bytes):	19225
Entropy (8bit):	5.027785320341808
Encrypted:	false
SSDEEP:
MD5:	BEF91C5841E0F192ABAD3FB24EB96C40
SHA1:	20F58652E80C0E572C79C5FE74007F9E2DF34097
SHA-256:	FCCDD500A309D9262719C5DBC2FA3BBAE6AF205755E4FAB636FBFA1201EEEFB1
SHA-512:	96C47E7DFCF6A94BC776B6E9241DD7D8D946FB79F4A520CA129DC6AF4F8C28D190AE4321372F50F327EB93C7F96B88544117D8A59ED51F66F2A4383C054DD5CB
Malicious:	false
Reputation:	unknown
URL:	https://cdn.msguides.com/wp-content/themes/kadence/assets/css/global.min.css
Preview:	/! normalize.css v8.0.1 \| MIT License \| github.com/necolas/normalize.css /html{line-height:1.15;-webkit-text-size-adjust:100%}body{margin:0}main{display:block;min-width:0}h1{font-size:2em;margin:0.67em 0}hr{box-sizing:content-box;height:0;overflow:visible}a{background-color:transparent}abbr[title]{border-bottom:none;text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted}b,strong{font-weight:bold}code,kbd,samp{font-family:monospace, monospace;font-size:1em}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-0.25em}sup{top:-0.5em}img{border-style:none}button,input,optgroup,select,textarea{font-size:100%;margin:0}button,input{overflow:visible}button,select{text-transform:none}button,[type="button"],[type="reset"],[type="submit"]{-webkit-appearance:button}button::-moz-focus-inner,[type="button"]::-moz-focus-inner,[type="reset"]::-moz-focus-inner,[type="submit"]::-moz-focus-inner{border-

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (27740)
Category:	downloaded
Size (bytes):	27741
Entropy (8bit):	4.8982451239400175
Encrypted:	false
SSDEEP:
MD5:	DCEDCB1D334C3F8B9A42D15781F12AB3
SHA1:	EBA984B4CEF75C016822F7802E366DC2E4FACEA3
SHA-256:	A5399F2A591A15943E8EC65F64039BF22C898E7580BEFE0BEF9A140E3669308F
SHA-512:	F2A4F15E84F79B1B2F8414A4887C4016676F3FA15C17C95BC310DA7D004CDFEAC1C26D99774F358A0C602CFBC72432763476F16AAB19B07E9E5F9FE877CE202A
Malicious:	false
Reputation:	unknown
URL:	https://cdn.msguides.com/wp-content/themes/kadence/assets/css/header.min.css
Preview:	.site-branding{max-height:inherit}.site-branding a.brand{display:flex;flex-direction:row;align-items:center;text-decoration:none;color:inherit;max-height:inherit}.site-branding a.brand img{display:block}.site-branding .site-title{margin:0}.site-branding .site-description{margin:0.4375em 0 0;word-wrap:break-word}.site-branding.branding-layout-standard:not(.site-brand-logo-only) a.brand img{margin-right:1em}.site-branding.branding-layout-standard-reverse a.brand{flex-direction:row-reverse}.site-branding.branding-layout-standard-reverse a.brand img{margin-left:1em}.site-branding.branding-layout-vertical.site-title-top a.brand .site-title-wrap{order:-1}.site-branding.branding-layout-vertical.site-title-top a.brand img{margin-top:1em;margin-bottom:1em}.site-branding.branding-layout-vertical a.brand{flex-direction:column}.site-branding.branding-layout-vertical a.brand img{margin-bottom:1em}.site-branding.branding-layout-vertical-reverse a.brand{flex-direction:column-reverse}.site-branding.br

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31478)
Category:	downloaded
Size (bytes):	31479
Entropy (8bit):	4.860929473789664
Encrypted:	false
SSDEEP:
MD5:	1709841FF84F7206FBCA2457054AE93E
SHA1:	0A28E7989ABDA88136FBADC81A81B723E9876E95
SHA-256:	77727BE5AE42ACACCFCB00B74A80AE7D66646F1374F5C98561DCEB42F7ECCCC2
SHA-512:	74EE05453CEA134F24FD3BBA5D077E5718C7A71125732F1951241642702B00525E1CE610C9FA6307D3A8E7C7C5FFC09202515070A1C0B394117229BBB8DDCDD0
Malicious:	false
Reputation:	unknown
URL:	https://cdn.msguides.com/wp-content/themes/kadence/assets/css/content.min.css
Preview:	.has-drop-cap:not(:focus):first-letter{float:left;line-height:1;font-size:80px;font-weight:600;margin:0 .125em 0 0;text-transform:uppercase}.wp-block-image{margin-bottom:0}figure.wp-block-image.aligncenter img{display:inline-block}.wp-block-pullquote{border-top:0;border-bottom:0;color:var(--global-palette4)}.wp-block-pullquote blockquote{border:0;margin:0 auto;padding:2em;position:relative}.wp-block-pullquote blockquote::before{font-size:200px;line-height:40px;font-family:sans-serif;color:var(--global-palette7);z-index:0;position:absolute;left:35px;content:open-quote;top:80px}.wp-block-pullquote blockquote p{font-size:1.15em;font-style:italic;position:relative;z-index:1}.wp-block-pullquote blockquote cite{text-transform:uppercase}.wp-block-pullquote.is-style-solid-color:not(.has-background){background:var(--global-palette7)}.wp-block-pullquote.is-style-solid-color blockquote{padding:0}.wp-block-pullquote.is-style-solid-color blockquote:before{color:var(--global-palette9);left:-20px;top

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (748)
Category:	downloaded
Size (bytes):	749
Entropy (8bit):	4.828512298405984
Encrypted:	false
SSDEEP:
MD5:	E0735226A4E539DC8EC34548F42D50BD
SHA1:	354E1FC1AB0D276A92410E47494533716FD39B52
SHA-256:	51BB6E5E42DA084B36FC157BDC14D6DF9A559D918DA43FD26BC9FF80D9E1B4D0
SHA-512:	935E449AFD6F20F3D95696C624344E34C4FEFC837408D964DBFF3EEB4ED3C520EBCCFBF9B3FA29EC6686A3B30385E0D1625B2D6469B5FF445CA6370D673230D0
Malicious:	false
Reputation:	unknown
URL:	https://cdn.msguides.com/wp-content/themes/kadence/assets/css/sidebar.min.css
Preview:	.primary-sidebar{padding-top:1.5rem;padding-bottom:1.5rem;margin-left:auto;margin-right:auto}@media screen and (min-width: 768px){.primary-sidebar{padding-left:0;padding-right:0}}@media screen and (min-width: 1025px){.primary-sidebar{padding:0;margin:0}.has-sticky-sidebar #wrapper,.has-sticky-sidebar-widget #wrapper{overflow:visible}.has-sticky-sidebar .sidebar-inner-wrap,.has-sticky-sidebar-widget .primary-sidebar .widget:last-child{position:-webkit-sticky;position:sticky;top:20px;overflow-y:auto}.has-sticky-sidebar-widget .sidebar-inner-wrap{height:100%}}@media screen and (max-width: 1024px){.has-sticky-sidebar .sidebar-inner-wrap,.has-sticky-sidebar-widget .primary-sidebar .widget:last-child{max-height:none !important;overflow-y:auto}}.

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2343)
Category:	downloaded
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
Reputation:	unknown
URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.5542292966721747
Encrypted:	false
SSDEEP:
MD5:	A07A697A3F0C8AD11A573A53F6C716E9
SHA1:	3ACEFF14F9F62CCF18FC60EDC107A724ADA2A050
SHA-256:	82779C8AAD19BF0628043DE5C28E5345AEE1823226189B1E731DBD24E07DAA43
SHA-512:	087F81CBB240115DC355BC3FB54A6D24E47EF45FD70832D8DF55D40B214897013DE6B21485A8BBDF1FD227A964396656F5297499678EF300F96E6BC2999293CE
Malicious:	false
Reputation:	unknown
Preview:	Press any key to continue . . .

Static File Info

General

File type:	Zip archive data, at least v4.5 to extract, compression method=deflate
Entropy (8bit):	7.487200238236628
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	qctivqtion.zip
File size:	1'504 bytes
MD5:	aeab8047a1969d292902f4b2a23de801
SHA1:	065df92f89de88374dd53a5acae646a2e69b5f75
SHA256:	086f71a123fc16c39829bcf47ec4740687a3b69921fc37d65403c081892c5ad1
SHA512:	f6fc339c0cc6cc27936f19834e1058b99b49cc1734e2edd39270d18ba3d86b486e944158e9c23d92d53a83c6640dd42f5f9c273b95c374b5802bc853253cf9de
SSDEEP:	24:NZd/iFQoBEDY/59RXBhu8qqsD7bWJM2kSK8EYCxY8HAhjbvt+Ko7bpwW4/iFQocY:NZRimDYFWL9SJTkSAHQAK8eZip
TLSH:	1C31E9A65A17E049C6D70F3A532CDB417A6ACE138133708EEC291A15EC99B008F1B72F
File Content Preview:	PK..-...........p.u.......Q...Device/HarddiskVolume13/Formation/Microsoft Office 2019/Activation/Activation.cmd............................q.T.K..%.'...L5..}io...=../I..P-..e ?:/.0e.x..!^W.i..O.._................(...aY.Q.<......E....y.:....;a.....@....[.<

File Icon


Icon Hash:	1c1c1e4e4ececedc

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report qctivqtion.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 96

Chrome Cache Entry: 97

Chrome Cache Entry: 98

Chrome Cache Entry: 99

\Device\Null

Static File Info

General

File Icon

Windows Analysis Report
qctivqtion.zip