Edit tour

Windows Analysis Report
https://blog.meticulousbeaver.com/

Overview

General Information

Sample URL:	https://blog.meticulousbeaver.com/
Analysis ID:	1525650
Tags:	urlscan
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded SVGs detected

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7096 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1820,i,1892089484145676426,12606242082446039908,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6448 --field-trial-handle=1820,i,1892089484145676426,12606242082446039908,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2884 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7048 --field-trial-handle=1820,i,1892089484145676426,12606242082446039908,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2536 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://blog.meticulousbeaver.com/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /ajax/qm/?__a=1&__user=0&__comet_req=7&jazoest=2896 HTTP/1.1Host: www.instagram.comConnection: keep-aliveContent-Length: 128sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedsec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.instagram.comSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.instagram.com/meticulousbeaver/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: csrftoken=NLmocmpPtbDQUuJcBqFF-J

Source: https://blog.meticulousbeaver.com	HTTP Parser: No <meta name="author".. found
Source: https://blog.meticulousbeaver.com	HTTP Parser: No <meta name="author".. found
Source: https://blog.meticulousbeaver.com	HTTP Parser: No <meta name="author".. found
Source: https://blog.meticulousbeaver.com	HTTP Parser: No <meta name="author".. found
Source: https://blog.meticulousbeaver.com	HTTP Parser: No <meta name="author".. found
Source: https://blog.meticulousbeaver.com	HTTP Parser: No <meta name="author".. found
Source: https://www.meticulousbeaver.com	HTTP Parser: No <meta name="author".. found
Source: https://www.meticulousbeaver.com	HTTP Parser: No <meta name="author".. found
Source: https://www.meticulousbeaver.com	HTTP Parser: No <meta name="author".. found
Source: https://www.instagram.com	HTTP Parser: No <meta name="author".. found
Source: https://www.instagram.com	HTTP Parser: No <meta name="author".. found

Source: https://blog.meticulousbeaver.com	HTTP Parser: No <meta name="copyright".. found
Source: https://blog.meticulousbeaver.com	HTTP Parser: No <meta name="copyright".. found
Source: https://blog.meticulousbeaver.com	HTTP Parser: No <meta name="copyright".. found
Source: https://blog.meticulousbeaver.com	HTTP Parser: No <meta name="copyright".. found
Source: https://blog.meticulousbeaver.com	HTTP Parser: No <meta name="copyright".. found
Source: https://blog.meticulousbeaver.com	HTTP Parser: No <meta name="copyright".. found
Source: https://www.meticulousbeaver.com	HTTP Parser: No <meta name="copyright".. found
Source: https://www.meticulousbeaver.com	HTTP Parser: No <meta name="copyright".. found
Source: https://www.meticulousbeaver.com	HTTP Parser: No <meta name="copyright".. found
Source: https://www.instagram.com	HTTP Parser: No <meta name="copyright".. found
Source: https://www.instagram.com	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50088 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50519 version: TLS 1.2

Source:	Binary string: g.vt.call(this,g.pdb[a],Object.assign({},{name:"PESEncoderError",type:a},b));this.type=a;this.level="WARNING";Object.setPrototypeOf(this,S5.prototype)},ynb=function(a){return new S5("WRONG_DATA_TYPE",{P8:a})},znb=function(a){return a instanceof Error?new S5("UNKNOWN_ENCODE_ERROR",{eT:a.message}):new S5("UNKNOWN_ENCODE_ERROR")},Anb=function(a){return a instanceof Error?new S5("UNKNOWN_DECODE_ERROR",{eT:a.message}):new S5("UNKNOWN_DECODE_ERROR")},Bnb=function(a,b){a=a instanceof S5?a:b(a); source: chromecache_749.2.dr, chromecache_755.2.dr
Source:	Binary string: version:1});var X1;X1={};g.pdb=(X1.INVALID_ENCODER_VERSION="Invalid encoder version",X1.KEY_CREATION_FAILED="Failed to create encoder key",X1.UNKNOWN_DECODE_ERROR="Failed to decode PES data",X1.UNKNOWN_ENCODE_ERROR="Failed to encode PES data",X1.WRONG_DATA_TYPE="Encoder cannot process the data type",X1);g.OB("","downloadsPageViewConfigurationEntity");g.OB("DOWNLOADS_LIST_ENTITY_ID_MANUAL_DOWNLOADS","mainDownloadsListEntity");g.Y1=g.OB("DOWNLOADS_LIST_ENTITY_ID_SMART_DOWNLOADS","mainDownloadsListEntity");g.OB("DOWNLOADS_LIST_ENTITY_ID_SMART_DOWNLOADS","refresh");g.OB("SMART_DOWNLOADS_ENABLED","settingEntity");g.OB("SMART_DOWNLOADS_OPT_IN_BANNER_DISMISSED","settingEntity");g.k=fC.prototype;g.k.initialize=function(a,b,c){if(a.program){var d,e=(d=a.interpreterUrl)!=null?d:null;if(a.interpreterSafeScript)d=Wma(a.interpreterSafeScript);else{var f;d=(f=a.interpreterScript)!=null?f:null}a.interpreterSafeUrl&&(e=$q(a.interpreterSafeUrl).toString());pva(this,d,e,a.program,b,c)}else g.mx(Error("Cannot initialize botguard without program"))}; source: chromecache_756.2.dr

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic	DNS traffic detected: DNS query: blog.meticulousbeaver.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.wp.com
Source: global traffic	DNS traffic detected: DNS query: www.meticulousbeaver.com
Source: global traffic	DNS traffic detected: DNS query: pixel.wp.com
Source: global traffic	DNS traffic detected: DNS query: cdn-in.pagesense.io
Source: global traffic	DNS traffic detected: DNS query: www.instagram.com
Source: global traffic	DNS traffic detected: DNS query: static.cdninstagram.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: scontent-msp1-1.cdninstagram.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: graph.instagram.com
Source: global traffic	DNS traffic detected: DNS query: i.ytimg.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: yt3.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: static.doubleclick.net

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: application/xmlTransfer-Encoding: chunkedConnection: closeDate: Fri, 04 Oct 2024 11:38:41 GMTServer: AmazonS3X-Cache: Error from cloudfrontVia: 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA2-C1X-Amz-Cf-Id: XtlO-YPcd0bCGJyTZR9jqXzsOXf_75zKP9zsSnpOtU0mDG5bdasImA==
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingSet-Cookie: mid=Zv_T0QALAAHLiaITJbUKMyXX51t6; expires=Sat, 08-Nov-2025 11:38:57 GMT; Max-Age=34560000; path=/; domain=.instagram.com; secure; httponly; SameSite=Noneaccept-ch-lifetime: 4838400accept-ch: viewport-width,dpr,Sec-CH-Prefers-Color-Scheme,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-ModelPragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTcontent-security-policy-report-only: default-src .facebook.com .fbcdn.net .instagram.com data: blob:;script-src .teststagram.com .instagram.com static.cdninstagram.com .facebook.com .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com https://translate.google.com https://apis.google.com https://accounts.google.com;style-src .teststagram.com .instagram.com static.cdninstagram.com data: blob: 'unsafe-inline' .fbcdn.net .facebook.com;connect-src .teststagram.com .instagram.com wss://edge-chat.instagram.com connect.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: ws://localhost:* blob: .cdninstagram.com wss://.instagram.com:* 'self';font-src .teststagram.com .instagram.com static.cdninstagram.com data: .fbcdn.net .intern.facebook.com .facebook.com https://fonts.gstatic.com;img-src .teststagram.com .instagram.com .facebook.com .fbcdn.net data: .igsonar.com .cdninstagram.com .whatsapp.net blob: .fbsbx.com android-webview-video-poster: .oculuscdn.com .giphy.com https://.google-analytics.com;media-src .facebook.com .fbcdn.net .instagram.com .cdninstagram.com cdn.fbsbx.com data: blob: https://.giphy.com;frame-src .instagram.com .facebook.com .fbsbx.com fbsbx.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-Encodingaccept-ch-lifetime: 4838400accept-ch: viewport-width,dpr,Sec-CH-Prefers-Color-Scheme,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-ModelPragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTcontent-security-policy-report-only: default-src .facebook.com .fbcdn.net .instagram.com data: blob:;script-src .teststagram.com .instagram.com static.cdninstagram.com .facebook.com .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com https://translate.google.com https://apis.google.com https://accounts.google.com;style-src .teststagram.com .instagram.com static.cdninstagram.com data: blob: 'unsafe-inline' .fbcdn.net .facebook.com;connect-src .teststagram.com .instagram.com wss://edge-chat.instagram.com connect.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: ws://localhost:* blob: .cdninstagram.com wss://.instagram.com:* 'self';font-src .teststagram.com .instagram.com static.cdninstagram.com data: .fbcdn.net .intern.facebook.com .facebook.com https://fonts.gstatic.com;img-src .teststagram.com .instagram.com .facebook.com .fbcdn.net data: .igsonar.com .cdninstagram.com .whatsapp.net blob: .fbsbx.com android-webview-video-poster: .oculuscdn.com .giphy.com https://.google-analytics.com;media-src .facebook.com .fbcdn.net .instagram.com .cdninstagram.com cdn.fbsbx.com data: blob: https://.giphy.com;frame-src .instagram.com .facebook.com .fbsbx.com fbsbx.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-Encodingaccept-ch-lifetime: 4838400accept-ch: viewport-width,dpr,Sec-CH-Prefers-Color-Scheme,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-ModelPragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTcontent-security-policy-report-only: default-src .facebook.com .fbcdn.net .instagram.com data: blob:;script-src .teststagram.com .instagram.com static.cdninstagram.com .facebook.com .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com https://translate.google.com https://apis.google.com https://accounts.google.com;style-src .teststagram.com .instagram.com static.cdninstagram.com data: blob: 'unsafe-inline' .fbcdn.net .facebook.com;connect-src .teststagram.com .instagram.com wss://edge-chat.instagram.com connect.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: ws://localhost:* blob: .cdninstagram.com wss://.instagram.com:* 'self';font-src .teststagram.com .instagram.com static.cdninstagram.com data: .fbcdn.net .intern.facebook.com .facebook.com https://fonts.gstatic.com;img-src .teststagram.com .instagram.com .facebook.com .fbcdn.net data: .igsonar.com .cdninstagram.com .whatsapp.net blob: .fbsbx.com android-webview-video-poster: .oculuscdn.com .giphy.com https://.google-analytics.com;media-src .facebook.com .fbcdn.net .instagram.com .cdninstagram.com cdn.fbsbx.com data: blob: https://.giphy.com;frame-src .instagram.com .facebook.com .fbsbx.com fbsbx.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-Encodingaccept-ch-lifetime: 4838400accept-ch: viewport-width,dpr,Sec-CH-Prefers-Color-Scheme,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-ModelPragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTcontent-security-policy-report-only: default-src .facebook.com .fbcdn.net .instagram.com data: blob:;script-src .teststagram.com .instagram.com static.cdninstagram.com .facebook.com .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com https://translate.google.com https://apis.google.com https://accounts.google.com;style-src .teststagram.com .instagram.com static.cdninstagram.com data: blob: 'unsafe-inline' .fbcdn.net .facebook.com;connect-src .teststagram.com .instagram.com wss://edge-chat.instagram.com connect.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: ws://localhost:* blob: .cdninstagram.com wss://.instagram.com:* 'self';font-src .teststagram.com .instagram.com static.cdninstagram.com data: .fbcdn.net .intern.facebook.com .facebook.com https://fonts.gstatic.com;img-src .teststagram.com .instagram.com .facebook.com .fbcdn.net data: .igsonar.com .cdninstagram.com .whatsapp.net blob: .fbsbx.com android-webview-video-poster: .oculuscdn.com .giphy.com https://.google-analytics.com;media-src .facebook.com .fbcdn.net .instagram.com .cdninstagram.com cdn.fbsbx.com data: blob: https://.giphy.com;frame-src .instagram.com .facebook.com .fbsbx.com fbsbx.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 04 Oct 2024 11:39:17 GMTContent-Type: text/html; charset=UTF-8Server: ESFContent-Length: 1582X-XSS-Protection: 0X-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1820,i,1892089484145676426,12606242082446039908,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://blog.meticulousbeaver.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6448 --field-trial-handle=1820,i,1892089484145676426,12606242082446039908,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7048 --field-trial-handle=1820,i,1892089484145676426,12606242082446039908,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1820,i,1892089484145676426,12606242082446039908,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6448 --field-trial-handle=1820,i,1892089484145676426,12606242082446039908,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7048 --field-trial-handle=1820,i,1892089484145676426,12606242082446039908,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://tailwindcss.com	0%	URL Reputation	safe
https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers	0%	URL Reputation	safe
https://support.google.com	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://www.internalfb.com/intern/invariant/	0%	URL Reputation	safe
https://admin.youtube.com	0%	URL Reputation	safe
https://youradchoices.ca/	0%	URL Reputation	safe
https://redux.js.org/tutorials/fundamentals/part-4-store#middleware	0%	URL Reputation	safe
https://yurt.corp.google.com	0%	URL Reputation	safe
https://apis.google.com/js/api.js	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://schema.org	0%	URL Reputation	safe
http://mathiasbynens.be/	0%	URL Reputation	safe
http://tools.ietf.org/html/rfc1950	0%	URL Reputation	safe
https://fburl.com/wiki/xrzohrqb	0%	URL Reputation	safe

Source: chromecache_703.2.dr, chromecache_798.2.dr, chromecache_667.2.dr	String found in binary or memory: href='https://www.linkedin.com/company/meticulousbeaver/' equals www.linkedin.com (Linkedin)
Source: chromecache_703.2.dr, chromecache_798.2.dr, chromecache_667.2.dr	String found in binary or memory: href='https://www.youtube.com/@MeticulousBeaverPlanners' equals www.youtube.com (Youtube)
Source: chromecache_452.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/5RZXhVZje9T/ equals www.facebook.com (Facebook)
Source: chromecache_452.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/9cisb7Fe7ih/ equals www.facebook.com (Facebook)
Source: chromecache_694.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/A4tfXiHOGrs/ equals www.facebook.com (Facebook)
Source: chromecache_452.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/CCT5pM3qiNk/ equals www.facebook.com (Facebook)
Source: chromecache_694.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/Ga6vBwdwgUx/ equals www.facebook.com (Facebook)
Source: chromecache_452.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/KRXTwBoPvVj/ equals www.facebook.com (Facebook)
Source: chromecache_409.2.dr, chromecache_452.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/MDzNl_j9yvg/ equals www.facebook.com (Facebook)
Source: chromecache_409.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/OKBVmODmb-W/ equals www.facebook.com (Facebook)
Source: chromecache_709.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/V8_l6oUwABQ/ equals www.facebook.com (Facebook)
Source: chromecache_664.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/Vkd8AdLnKqZ/ equals www.facebook.com (Facebook)
Source: chromecache_452.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/aJoeSHn7XcN/ equals www.facebook.com (Facebook)
Source: chromecache_452.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/cr2jmG-CdKo/ equals www.facebook.com (Facebook)
Source: chromecache_409.2.dr, chromecache_452.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/t3hOLs8wlXy/ equals www.facebook.com (Facebook)
Source: chromecache_641.2.dr	String found in binary or memory: "&label=videoskipped&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+ca+";dc_exteid="+Zb+";met="+ca+";ecn"+ca+"="+ca+";etm1="+ca+";eid1="+Gb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],closePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+D+"AxAA&sigh="+y+"&cid="+da+"&label=adclose&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}],progressPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+ equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: "&sig="+Lc+"&ad_cpn=[AD_CPN]&id="+Ti+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]&avm="+ca},{baseUrl:"https://pagead2.googlesyndication.com/activeview_ext?id="+Ti+"&avm="+ca+"&dc_pubid="+ca+"&dc_exteid="+Zb+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]?"}],abandonPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+D+"AxAA&sigh="+Fd+"&cid="+da+"&label=video_abandon&ad_mt=[AD_MT]&ad_tos=[AD_TOS]&ad_wat=[AD_WAT]&final=[FINAL]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}, equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: "&uga="+yb+"&vm="+uf},videostatsDelayplayUrl:{baseUrl:"https://s.youtube.com/api/stats/delayplay?cl="+Ab+"&docid="+y+"&ei="+V+"&feature="+m+"&fexp="+lf+"&ns="+Ga+"&plid="+N+"&referrer=https%3A%2F%2Fwww.youtube.com%2F&sdetail=p%3A%2F&sourceid="+Wd+"&el="+Ug+"&len="+rc+"&of="+cc+"&uga="+yb+"&vm="+uf},videostatsWatchtimeUrl:{baseUrl:"https://s.youtube.com/api/stats/watchtime?cl="+Ab+"&docid="+y+"&ei="+V+"&feature="+m+"&fexp="+lf+"&ns="+Ga+"&plid="+N+"&referrer=https%3A%2F%2Fwww.youtube.com%2F&sdetail=p%3A%2F&sourceid="+ equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: "=",adInfoRenderer:{adHoverTextButtonRenderer:{button:{buttonRenderer:{style:"STYLE_UNKNOWN",size:"SIZE_DEFAULT",isDisabled:!1,icon:{iconType:"INFO_OUTLINE"},navigationEndpoint:{clickTrackingParams:Vc,openPopupAction:{popup:{aboutThisAdRenderer:{url:(MI.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue="https://www.youtube.com/aboutthisad?pf=web&source=youtube&reasons=A"+O+"&hl="+Ga+"&origin=www.youtube.com&ata_theme="+fg,MI),trackingParams:Va+"="}},popupType:"DIALOG"}},trackingParams:Va+"="}}, equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: "="},trackingParams:Va+"="}},adLayoutLoggingData:{serializedAdServingDataEntry:Mo},skipPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+D+"AxAA&sigh="+y+"&cid="+da+"&label=videoskipped&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+ca+";dc_exteid="+Zb+";met="+ca+";ecn"+ca+"="+ca+";etm1="+ca+";eid1="+Gb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],layoutId:"1ID7Gdwk2vV7OZ1A"}}, equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: "="}},hoverText:{runs:[{text:na}]},trackingParams:Va+"="}},adVideoId:Fd,impressionPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+D+"AxAA&sigh="+y+"&cid="+da+"&label=video_companion_reshow_tracking"}],adLayoutLoggingData:{serializedAdServingDataEntry:Mo},isContentVideoCompanion:!0,associatedCompositePlayerBytesLayoutId:ye}},adSlotLoggingData:{serializedSlotAdServingDataEntry:Ti}}}],adBreakHeartbeatParams:"Q0FBJTNE",frameworkUpdates:{entityBatchUpdate:{mutations:[{entityKey:Fc, equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: "https://www.youtube.com/aboutthisad?pf=web&source=youtube&reasons=A"+O+"&hl="+Ga+"&origin=www.youtube.com&ata_theme="+fg,gga),trackingParams:Va+"="}},popupType:"DIALOG"}},trackingParams:Va+"="}},hoverText:{runs:[{text:Hn}]},trackingParams:Va+"="}},adVideoId:Fd,impressionPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+D+"AxAA&sigh="+y+"&cid="+da+"&label=video_companion_impression_tracking"}],adLayoutLoggingData:{serializedAdServingDataEntry:Ti},associatedCompositePlayerBytesLayoutId:ye}}, equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: "https://www.youtube.com/aboutthisad?pf=web&source=youtube&reasons=A"+O+"&hl="+Ga+"&origin=www.youtube.com&ata_theme="+fg,p0),trackingParams:Va+"="}},popupType:"DIALOG"}},icon:{iconType:"INFO_OUTLINE"},trackingParams:Va+"="}},hoverText:{runs:[{text:fg}]},trackingParams:Va+"="}},flyoutCtaRenderer:{flyoutCtaRenderer:{image:{thumbnail:{thumbnails:[{url:"https://yt3.ggpht.com/ytc/"+Si+"=s176-c-k-c0x00ffffff-no-rj"}]},trackingParams:Va+"="},headline:{text:fg,isTemplated:!1,trackingParams:Va+"="},description:{text:Bs, equals www.youtube.com (Youtube)
Source: chromecache_756.2.dr	String found in binary or memory: (g.Ak(c,"redirector.googlevideo.com"),d=c.toString()):c.j.match("rr?[1-9].*\\.c\\.youtube\\.com$")?(g.Ak(c,"www.youtube.com"),d=c.toString()):(c=lwa(d),DE(c)&&(d=c));c=new g.vM(d);c.set("cmo=pf","1");e&&c.set("cmo=td","a1.googlevideo.com");return c}; equals www.youtube.com (Youtube)
Source: chromecache_756.2.dr	String found in binary or memory: 0?"http":"https";this.Ca=CE((b?b.customBaseYoutubeUrl:a.BASE_YT_URL)\|\|"")\|\|CE(this.nf)\|\|this.protocol+"://www.youtube.com/";h=b?b.eventLabel:a.el;d="detailpage";h==="adunit"?d=this.D?"embedded":"detailpage":h==="embedded"\|\|this.N?d=Fs(d,h,MJa):h&&(d="embedded");this.Ja=d;Sqa();h=null;d=b?b.playerStyle:a.ps;f=g.Wb(NJa,d);!d\|\|f&&!this.N\|\|(h=d);this.playerStyle=h;this.K=g.Wb(NJa,this.playerStyle);this.houseBrandUserStatus=b==null?void 0:b.houseBrandUserStatus;this.qa=this.K&&this.playerStyle!=="play"&& equals www.youtube.com (Youtube)
Source: chromecache_605.2.dr	String found in binary or memory: ;var Q=A.window,R,S,T=(Q==null?void 0:(R=Q.yt)==null?void 0:R.config_)\|\|(Q==null?void 0:(S=Q.ytcfg)==null?void 0:S.data_)\|\|{};B("yt.config_",T);var U=Object.freeze("document.appendChild document.body.appendChild document.querySelector document.querySelectorAll history.back history.go".split(" ")),V=Object.freeze("fonts.googleapis.com s0.2mdn.net securepubads.g.doubleclick.net ssl.google-analytics.com static.doubleclick.net www.google-analytics.com www.googletagservices.com www.youtube.com youtube.com".split(" ")),W=Object.freeze(["pkedcjkdefgpdelpbcmbmeomcjbeemfm","fjhoaacokmgbjemoflkofnenfaiekifl","enhhojjnijigcajfphajepfemndkmdlo"]),X= equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: Ab+";dc_dbm_token="+w+";dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;ltd=;dc_tdv="+ca+";ord="+Ab+";dc_rui="+ca+";dc_exteid="+Zb+";dc_av="+ca+";dc_sk="+ca+";dc_ctype="+yb+";dc_pubid="+ca+";dc_btype=3?gclid="+ib+"&ase=2"},{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+D+"AxAA&sigh="+y+"&cid="+da+"&label=video_card_endcap_action_headline_click"}],commandMetadata:{webCommandMetadata:{url:"https://www.googleadservices.com/pagead/aclk?sa=L&ai=C"+C+"____________"+ equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: Ab+";dc_trk_cid="+Ab+";dc_dbm_token="+w+";dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;ltd=;dc_tdv="+ca+";ord="+Ab+";dc_rui="+ca+";dc_exteid="+be+";dc_av="+ca+";dc_sk="+ca+";dc_ctype="+yb+";dc_pubid="+ca+";dc_btype=3?gclid="+ib+"&ase=2",attributionSrcMode:"ATTRIBUTION_SRC_MODE_LABEL_CHROME"}],fullscreenPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+D+"AxAA&sigh="+y+"&cid="+da+"&label=adfullscreen&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}, equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: C+"____________"+D+"AxAA&sigh="+Fd+"&cid="+da+"&ad_cpn=[AD_CPN]&lact=[LACT]"},{baseUrl:"https://www.youtube.com/api/stats/ads?ver="+ca+"&ns="+ca+"&event="+ca+"&device="+ca+"&content_v="+y+"&el="+Ug+"&ei="+V+"&devicever="+c+"&bti="+Gb+"&format="+Rd+"&break_type="+ca+"&conn=[CONN]&cpn=[CPN]&lact=[LACT]&m_pos="+ca+"&mt=[MT]&p_h=[P_H]&p_w=[P_W]&rwt=[RWT]&sdkv="+Xb+"&slot_pos="+ca+"&slot_len="+ca+"&vis=[VIS]&vol=[VOL]&wt=[WT]&ad_cpn=[AD_CPN]&ad_id="+sc+"&ad_len="+Uc+"&ad_mt=[AD_MT]&ad_sys=YT%3AAdSense-Viral%2CAdSense-Viral&ad_v="+ equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: C+"____________"+D+"AxAA&sigh="+Fd+"&cid="+da+"&label=videoskipped&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+ca+";dc_exteid="+Zb+";met="+ca+";ecn"+ca+"="+ca+";etm1="+ca+";eid1="+Gb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],closePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+D+"AxAA&sigh="+Fd+"&cid="+da+"&label=adclose&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}], equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: C+"____________"+D+"AxAA&sigh="+y+"&cid="+da+"&label=adpause&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+ca+";dc_exteid="+Zb+";met="+ca+";ecn"+ca+"="+ca+";etm1="+ca+";eid1="+yb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],rewindPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+D+"AxAA&sigh="+y+"&cid="+da+"&label=adrewind&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}], equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: Dr(Ysb);Dr(Zsb);function atb(a){var b=a.animatedIconType;var c=a.active;var d=a.themeOverride;var e=a.animationRef===void 0?{}:a.animationRef;var g=a.staticIconFn;var k=function(){a:{var N=b();var O=d==null?void 0:d(),V;O=(O==null?void 0:O.useDarkTheme)\|\|((V=Tl().resolve(Sl(rB)))==null?void 0:V());V=z("enable_cairo_refresh_signature_moments_web");switch(N){case"LIKE":N="animated_like_icon_";N=V?N+(O?"dark_v4":"light_v4"):N+(O?"v2_dark":"v2_light");N={lottiePlayerProps:{animationConfig:{name:N,path:"https://www.gstatic.com/youtube/img/lottie/animated_like_icon/"+ equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: Fd+"&aqi="+V+"&ad_rmp="+ca+"&sli="+ca}],errorPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+D+"AxAA&sigh="+y+"&cid="+da+"&label=videoplayfailed[ERRORCODE]"}],mutePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+D+"AxAA&sigh="+y+"&cid="+da+"&label=admute&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+ca+";dc_exteid="+Zb+";met="+ca+";ecn"+ca+"="+ equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: IE.prototype.getUrl=function(a,b){return"https://www.gstatic.com/youtube/img/icons/web/"+b.style+"/"+a+"/v"+b.version+"/"+b.size+"px.svg"}; equals www.youtube.com (Youtube)
Source: chromecache_507.2.dr	String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},bk:function(){e=zb()},nd:function(){d()}}};var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: N+".json",loop:!1,autoplay:!1,rendererSettings:{viewBoxOnly:!0,className:"animated-like-icon"}}},totalFrames:V?60:119,lazyLoad:!0};break a;case"NOTIFICATION_BELL":N={lottiePlayerProps:{animationConfig:{name:O?"notification_bell_dark":"notification_bell_light",path:"https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_bell_icon_"+(O?"dark":"light")+".json",loop:!1,autoplay:!1,rendererSettings:{className:"animated-subscribe-icon"}}},totalFrames:79,lazyLoad:!1};break a;}N=void 0}return N}, equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: Object.assign({},{name:"INCORRECT",path:"https://www.gstatic.com/youtube/img/creator/posts/Lottie_QuizIncorrect_LightTheme_01a.json",renderer:"svg"},w5b,{rendererSettings:{viewBoxOnly:!0,viewBoxSize:"26 26 80 80"}});a.correctnessAnimationProps=[];a.correctnessAnimationRefs=[];return a}; equals www.youtube.com (Youtube)
Source: chromecache_756.2.dr	String found in binary or memory: RIa=function(a,b){if(!a.j["0"]){var c=new oG("0","fakesb",{video:new kG(0,0,0,void 0,void 0,"auto")});a.j["0"]=b?new NN(new g.vM("http://www.youtube.com/videoplayback"),c,"fake"):new dO(new g.vM("http://www.youtube.com/videoplayback"),c,new yN(0,0),new yN(0,0))}}; equals www.youtube.com (Youtube)
Source: chromecache_756.2.dr	String found in binary or memory: Ro.prototype.Ia=function(){return this.C};var mna=(new Date).getTime();var rla="://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav".split(" "),sla=/\bocr\b/;var ula=/(?:\[\|%5B)([a-zA-Z0-9_]+)(?:\]\|%5D)/g;var lbb=0,mbb=0,nbb=0;var $o;g.To=null;g.Vo=!1;g.ap=1;$o=Symbol("SIGNAL");g.bp={version:0,y_:0,Rm:!1,fg:void 0,Uy:void 0,En:void 0,QL:0,hj:void 0,Tu:void 0,aF:!1,uP:!1,V1:function(){return!1}, equals www.youtube.com (Youtube)
Source: chromecache_641.2.dr	String found in binary or memory: Ti+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://pagead2.googlesyndication.com/activeview_ext?id="+Ti+"&dc_pubid="+ca+"&dc_exteid="+Zb+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]?"}],endFullscreenPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+D+"AxAA&sigh="+Fd+"&cid="+da+"&label=vast_exit_fullscreen&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}],activeViewMeasurablePings:[{baseUrl:"https://www.youtube.com/pcs/activeview?xai="+q+ equals www.youtube.com (Youtube)

Source: chromecache_703.2.dr, chromecache_798.2.dr, chromecache_667.2.dr	String found in binary or memory: http://blog.meticulousbeaver.com/wp-content/uploads/2024/03/user.png
Source: chromecache_703.2.dr, chromecache_667.2.dr	String found in binary or memory: http://blog.meticulousbeaver.com/wp-content/uploads/2024/05/1.1-Upscaled_Indian_Bride_Letter_Jpeg-sc
Source: chromecache_798.2.dr, chromecache_667.2.dr	String found in binary or memory: http://blog.meticulousbeaver.com/wp-content/uploads/2024/05/2.1-Practical-Tips-to-Create-the-Perfect
Source: chromecache_667.2.dr	String found in binary or memory: http://blog.meticulousbeaver.com/wp-content/uploads/2024/05/3.-Effective-Stress-Management-technique
Source: chromecache_476.2.dr	String found in binary or memory: http://css-tricks.com
Source: chromecache_703.2.dr, chromecache_798.2.dr, chromecache_667.2.dr	String found in binary or memory: http://daneden.me/animate
Source: chromecache_476.2.dr	String found in binary or memory: http://daverupert.com
Source: chromecache_452.2.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_696.2.dr	String found in binary or memory: http://feross.org
Source: chromecache_671.2.dr	String found in binary or memory: http://gsgd.co.uk/sandbox/jquery/easing/
Source: chromecache_641.2.dr	String found in binary or memory: http://hammerjs.github.io/
Source: chromecache_641.2.dr	String found in binary or memory: http://i1.ytimg.com/vi/
Source: chromecache_607.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_641.2.dr	String found in binary or memory: http://mathiasbynens.be/
Source: chromecache_641.2.dr	String found in binary or memory: http://mths.be/fromcodepoint
Source: chromecache_703.2.dr, chromecache_798.2.dr, chromecache_667.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: chromecache_641.2.dr, chromecache_412.2.dr, chromecache_713.2.dr, chromecache_513.2.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_641.2.dr, chromecache_412.2.dr, chromecache_713.2.dr, chromecache_513.2.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_641.2.dr, chromecache_412.2.dr, chromecache_713.2.dr, chromecache_513.2.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_641.2.dr, chromecache_412.2.dr, chromecache_713.2.dr, chromecache_513.2.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_671.2.dr	String found in binary or memory: http://robert-fleischmann.de)
Source: chromecache_476.2.dr	String found in binary or memory: http://sam.zoy.org/wtfpl/
Source: chromecache_641.2.dr, chromecache_756.2.dr, chromecache_570.2.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: chromecache_476.2.dr	String found in binary or memory: http://www.alistapart.com/articles/creating-intrinsic-ratios-for-video/
Source: chromecache_641.2.dr, chromecache_514.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_641.2.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_703.2.dr, chromecache_798.2.dr, chromecache_667.2.dr	String found in binary or memory: http://www.elegantthemes.com
Source: chromecache_703.2.dr, chromecache_798.2.dr, chromecache_667.2.dr	String found in binary or memory: http://www.elegantthemes.com/gallery/divi/
Source: chromecache_703.2.dr, chromecache_798.2.dr, chromecache_667.2.dr	String found in binary or memory: http://www.gnu.org/licenses/gpl-2.0.html
Source: chromecache_570.2.dr	String found in binary or memory: http://www.google.com/support/websearch/bin/answer.py?hl=
Source: chromecache_641.2.dr	String found in binary or memory: http://www.youtube.com/
Source: chromecache_641.2.dr	String found in binary or memory: http://www.youtube.com/video/
Source: chromecache_756.2.dr	String found in binary or memory: http://www.youtube.com/videoplayback
Source: chromecache_756.2.dr	String found in binary or memory: http://youtube.com/drm/2012/10/10
Source: chromecache_756.2.dr	String found in binary or memory: http://youtube.com/streaming/metadata/segment/102015
Source: chromecache_756.2.dr	String found in binary or memory: http://youtube.com/streaming/otf/durations/112015
Source: chromecache_756.2.dr	String found in binary or memory: http://youtube.com/yt/2012/10/10
Source: chromecache_641.2.dr	String found in binary or memory: https://accounts.google.com/AddSession
Source: chromecache_641.2.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin
Source: chromecache_641.2.dr	String found in binary or memory: https://accounts.youtube.com/RotateCookiesPage?origin=https://www.youtube.com&yt_pid=

IP	Domain	Country	ASN	ASN Name	Malicious
157.240.26.63	scontent-msp1-1.cdninstagram.com	United States	32934	FACEBOOKUS	false
142.250.185.129	unknown	United States	15169	GOOGLEUS	false
15.206.29.67	blog.meticulousbeaver.com	United States	16509	AMAZON-02US	false
157.240.0.63	instagram.c10r.instagram.com	United States	32934	FACEBOOKUS	false
172.217.18.14	unknown	United States	15169	GOOGLEUS	false
216.58.206.34	unknown	United States	15169	GOOGLEUS	false
13.224.189.63	dsirz9wgt70et.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.181.238	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
157.240.253.63	unknown	United States	32934	FACEBOOKUS	false
157.240.251.63	scontent.cdninstagram.com	United States	32934	FACEBOOKUS	false
157.240.0.174	z-p42-instagram.c10r.instagram.com	United States	32934	FACEBOOKUS	false
142.250.186.134	static.doubleclick.net	United States	15169	GOOGLEUS	false
157.240.252.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
18.245.86.26	unknown	United States	16509	AMAZON-02US	false
142.250.185.86	i.ytimg.com	United States	15169	GOOGLEUS	false
18.245.86.75	d36zsmpys4v430.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.185.68	unknown	United States	15169	GOOGLEUS	false
172.217.23.118	unknown	United States	15169	GOOGLEUS	false
192.0.76.3	stats.wp.com	United States	2635	AUTOMATTICUS	false
142.250.185.198	unknown	United States	15169	GOOGLEUS	false
216.58.206.46	youtube.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
172.217.16.193	yt3.googleusercontent.com	United States	15169	GOOGLEUS	false
172.217.16.130	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
157.240.251.35	unknown	United States	32934	FACEBOOKUS	false

IP
192.168.2.7
192.168.2.6
192.168.2.5

Name	IP	Active	Malicious	Reputation
stats.wp.com	192.0.76.3	true	false	unknown
star-mini.c10r.facebook.com	157.240.252.35	true	false	unknown
dsirz9wgt70et.cloudfront.net	13.224.189.63	true	false	unknown
d36zsmpys4v430.cloudfront.net	18.245.86.75	true	false	unknown
i.ytimg.com	142.250.185.86	true	false	unknown
z-p42-instagram.c10r.instagram.com	157.240.0.174	true	false	unknown
static.doubleclick.net	142.250.186.134	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
scontent.cdninstagram.com	157.240.251.63	true	false	unknown
youtube.com	216.58.206.46	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
youtube-ui.l.google.com	142.250.181.238	true	false	unknown
googleads.g.doubleclick.net	172.217.16.130	true	false	unknown
play.google.com	142.250.185.142	true	false	unknown
pixel.wp.com	192.0.76.3	true	false	unknown
yt3.googleusercontent.com	172.217.16.193	true	false	unknown
www.google.com	142.250.185.164	true	false	unknown
instagram.c10r.instagram.com	157.240.0.63	true	false	unknown
scontent-msp1-1.cdninstagram.com	157.240.26.63	true	false	unknown
blog.meticulousbeaver.com	15.206.29.67	true	false	unknown
www.facebook.com	unknown	unknown	false	unknown
cdn-in.pagesense.io	unknown	unknown	false	unknown
graph.instagram.com	unknown	unknown	false	unknown
static.cdninstagram.com	unknown	unknown	false	unknown
www.instagram.com	unknown	unknown	false	unknown
www.meticulousbeaver.com	unknown	unknown	false	unknown
www.youtube.com	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://www.youtube.com/sw.js	false	unknown
https://www.meticulousbeaver.com/favicon.ico	false	unknown
https://blog.meticulousbeaver.com/wp-content/et-cache/1951/et-core-unified-deferred-1951.min.css?ver=1725961687	false	unknown
https://blog.meticulousbeaver.com/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/salvattore.js?ver=4.24.2	false	unknown
https://blog.meticulousbeaver.com/wp-content/et-cache/1960/et-divi-dynamic-1960.css?ver=1725961684	false	unknown
https://www.meticulousbeaver.com/_next/static/media/4de1fea1a954a5b6-s.p.woff2	false	unknown
https://pixel.wp.com/g.gif?v=ext&blog=230542405&post=1958&tz=0&srv=blog.meticulousbeaver.com&j=1%3A12.9.3&host=blog.meticulousbeaver.com&ref=&fcp=4341&rand=0.06467085651131121	false	unknown
https://www.meticulousbeaver.com/products	false	unknown
https://www.youtube.com/s/desktop/72b8c307/jsbin/spf.vflset/spf.js	false	unknown
https://www.meticulousbeaver.com/_next/static/css/8b8a3a20de6b6cc2.css	false	unknown
https://www.youtube.com	false	unknown
https://blog.meticulousbeaver.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.9	false	unknown
https://www.instagram.com	false	unknown
https://blog.meticulousbeaver.com/wp-content/uploads/2024/05/1.1-Upscaled_Indian_Bride_Letter_Jpeg-400x250.jpeg	false	unknown
https://www.youtube.com/s/player/34059770/player_ias.vflset/en_US/remote.js	false	unknown
https://static.cdninstagram.com/rsrc.php/v3/yE/r/t98ZFitznKQ.js	false	unknown
https://scontent-msp1-1.cdninstagram.com/v/t51.29350-15/461309478_2309183792749670_1721043347938775820_n.jpg?stp=dst-jpg_e35_s640x640_sh0.08&_nc_ht=scontent-msp1-1.cdninstagram.com&_nc_cat=102&_nc_ohc=8GlDCGsgWPYQ7kNvgGFodMC&_nc_gid=5f08a7f8d9b54a1a8087aad7f8cabd3d&edm=AOQ1c0wBAAAA&ccb=7-5&oh=00_AYAlk6dBXSdcdccyf_ocunjLM74Qmi769GeM3FLlZhSIVA&oe=67059F0C&_nc_sid=8b3546	false	unknown
https://i.ytimg.com/vi/KgHmLYkBRsk/hqdefault.jpg?sqp=-oaymwEpCPYBEIoBSFryq4qpAxsIARUAAIhCGAHYAQHiAQwIHBACGAYgATgBQAE=&rs=AOn4CLDe7rzgY6adkB5H6rfZnz7gh2PosQ	false	unknown
https://blog.meticulousbeaver.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1	false	unknown
https://www.instagram.com/graphql/query/?query_id=9957820854288654&user_id=56699317369&include_chaining=false&include_reel=true&include_suggested_users=false&include_logged_out_extras=true&include_live_status=false&include_highlight_reels=true	false	unknown
https://www.instagram.com/ajax/bz?__a=1&__ccg=UNKNOWN&__comet_req=7&__d=www&__hs=20000.HYP%3Ainstagram_web_pkg.2.1..0.0&__hsi=7421883572467586792&__req=g&__rev=1017060621&__s=zo2l3g%3Ahz83t5%3A9fe9ta&__spin_b=trunk&__spin_r=1017060621&__spin_t=1728041929&__user=0&dpr=1&jazoest=2896&lsd=AVp1eDOq2Fg&ph=C3	false	unknown
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1	false	unknown
https://cdn-in.pagesense.io/js/60030195525/5f303b7d67664b10ac32b09cab6d68e9.js	false	unknown
https://blog.meticulousbeaver.com/wp-content/uploads/2024/05/2.1-Practical-Tips-to-Create-the-Perfect-Wedding-Guest-List-980x560.jpeg	false	unknown
https://youtube.com/	false	unknown
https://blog.meticulousbeaver.com/wp-content/uploads/2024/05/1.1-Upscaled_Indian_Bride_Letter_Jpeg-1280x732.jpeg	false	unknown
https://blog.meticulousbeaver.com/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/easypiechart.js?ver=4.24.2	false	unknown
https://blog.meticulousbeaver.com/wp-content/et-cache/global/et-divi-customizer-global.min.css?ver=1725411774	false	unknown
https://yt3.googleusercontent.com/sjhLNmoTlHOeS3Z5OUIwMJMr_pzGsSFV5DJkxrYRFzTDRPnsYXd-j1w1AzAIldcGKnrgSmUe=w1707-fcrop64=1,00005a57ffffa5a8-k-c0xffffffff-no-nd-rj	false	unknown
https://blog.meticulousbeaver.com/wp-content/themes/Divi/js/scripts.min.js?ver=4.24.2	false	unknown
https://blog.meticulousbeaver.com/blog/author/nikhil/	false	unknown
https://www.youtube.com/@MeticulousBeaverPlanners	false	unknown
https://www.instagram.com/data/manifest.json	false	unknown
https://www.meticulousbeaver.com/_next/static/css/e77c30429a2013d6.css	false	unknown
https://www.meticulousbeaver.com/_next/static/chunks/26-f894726fadf95c04.js	false	unknown
https://www.meticulousbeaver.com/_next/static/media/userIcon.2fe58c8a.svg	false	unknown
https://scontent-msp1-1.cdninstagram.com/v/t51.2885-19/451251990_361590573412599_6466735160804451872_n.jpg?stp=dst-jpg_s150x150&_nc_ht=scontent-msp1-1.cdninstagram.com&_nc_cat=103&_nc_ohc=8e3o2chz0MQQ7kNvgGfO4Rw&_nc_gid=5f08a7f8d9b54a1a8087aad7f8cabd3d&edm=AOQ1c0wBAAAA&ccb=7-5&oh=00_AYC8auRLrVE-t-9VCkNy5myXdeTK3s4UFjFdxdpXOOBVZw&oe=6705C079&_nc_sid=8b3546	false	unknown
https://www.youtube.com/api/jnn/v1/GenerateIT	false	unknown
https://www.instagram.com/ajax/bz?__a=1&__ccg=UNKNOWN&__comet_req=7&__d=www&__hs=20000.HYP%3Ainstagram_web_pkg.2.1..0.0&__hsi=7421883572467586792&__req=c&__rev=1017060621&__s=zo2l3g%3Ahz83t5%3A9fe9ta&__spin_b=trunk&__spin_r=1017060621&__spin_t=1728041929&__user=0&dpr=1&jazoest=2896&lsd=AVp1eDOq2Fg&ph=C3	false	unknown
https://www.instagram.com/graphql/query	false	unknown
https://static.cdninstagram.com/rsrc.php/v3/yp/r/7sm6EIbtFjH.js	false	unknown
https://blog.meticulousbeaver.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.4.5	false	unknown
https://www.youtube.com/youtubei/v1/notification_registration/set_registration?prettyPrint=false	false	unknown
https://static.cdninstagram.com/rsrc.php/v3iVg64/yU/l/en_US/mUoI6B5AHuQ.js	false	unknown
https://www.meticulousbeaver.com/_next/static/css/f4fa120b13d8666d.css	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://robert-fleischmann.de)	chromecache_671.2.dr	false		unknown
https://help.instagram.com/370452623149242	chromecache_452.2.dr	false		unknown
https://stats.g.doubleclick.net/g/collect	chromecache_507.2.dr	false	URL Reputation: safe	unknown
https://tailwindcss.com	chromecache_634.2.dr	false	URL Reputation: safe	unknown
https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers	chromecache_641.2.dr, chromecache_756.2.dr	false	URL Reputation: safe	unknown
https://s.youtube.com/api/stats/delayplay?cl=	chromecache_641.2.dr	false		unknown
https://blog.meticulousbeaver.com/wp-includes/js/mediaelement/mediaelement-and-player.min.js?ver=4.2	chromecache_703.2.dr, chromecache_798.2.dr, chromecache_667.2.dr	false		unknown
https://support.google.com	chromecache_641.2.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/embed/	chromecache_641.2.dr	false		unknown
http://daverupert.com	chromecache_476.2.dr	false		unknown
https://blog.meticulousbeaver.com/wp-content/et-cache/1958/et-core-unified-deferred-1958.min.css?ver	chromecache_798.2.dr	false		unknown
http://polymer.github.io/AUTHORS.txt	chromecache_641.2.dr, chromecache_412.2.dr, chromecache_713.2.dr, chromecache_513.2.dr	false	URL Reputation: safe	unknown
https://www.internalfb.com/intern/invariant/	chromecache_694.2.dr	false	URL Reputation: safe	unknown
https://help.instagram.com/cookie_settings	chromecache_550.2.dr	false		unknown
https://www.google.com/get/videoqualityreport/?v=	chromecache_641.2.dr	false		unknown
http://blog.meticulousbeaver.com/wp-content/uploads/2024/05/1.1-Upscaled_Indian_Bride_Letter_Jpeg-sc	chromecache_703.2.dr, chromecache_667.2.dr	false		unknown
https://admin.youtube.com	chromecache_756.2.dr	false	URL Reputation: safe	unknown
https://youradchoices.ca/	chromecache_452.2.dr	false	URL Reputation: safe	unknown
https://redux.js.org/tutorials/fundamentals/part-4-store#middleware	chromecache_641.2.dr, chromecache_756.2.dr	false	URL Reputation: safe	unknown
https://s.youtube.com	chromecache_641.2.dr	false		unknown
https://i.ytimg.com/an/	chromecache_641.2.dr	false		unknown
https://www.youtube.com/api/stats/ads?ver=	chromecache_641.2.dr	false		unknown
https://blog.meticulousbeaver.com/blog/category/emotional-well/	chromecache_667.2.dr	false		unknown
http://blog.meticulousbeaver.com/wp-content/uploads/2024/05/3.-Effective-Stress-Management-technique	chromecache_667.2.dr	false		unknown
https://yurt.corp.google.com	chromecache_756.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/tools/feedback	chromecache_641.2.dr	false		unknown
https://www.youtube.com/youtubei/v1/player?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8&prettyPrint=f	chromecache_641.2.dr	false		unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	chromecache_641.2.dr	false		unknown
https://www.youtube.com/pagead/interaction/?ai=C	chromecache_641.2.dr	false		unknown
https://blog.meticulousbeaver.com/wp-content/uploads/2024/05/1.1-Upscaled_Indian_Bride_Letter_Jpeg-9	chromecache_667.2.dr	false		unknown
https://www.youtube.com/generate_204?cpn=	chromecache_756.2.dr	false		unknown
https://blog.meticulousbeaver.com/wp-content/uploads/2024/05/1.1-Upscaled_Indian_Bride_Letter_Jpeg-4	chromecache_667.2.dr	false		unknown
https://www.google.com/recaptcha/api.js?trustedtypes=true	chromecache_641.2.dr	false		unknown
https://apis.google.com/js/api.js	chromecache_641.2.dr	false	URL Reputation: safe	unknown
https://blog.meticulousbeaver.com/blog/category/wedding-planning/	chromecache_667.2.dr	false		unknown
http://polymer.github.io/PATENTS.txt	chromecache_641.2.dr, chromecache_412.2.dr, chromecache_713.2.dr, chromecache_513.2.dr	false	URL Reputation: safe	unknown
https://blog.meticulousbeaver.com/wp-content/uploads/2024/05/1.1-Upscaled_Indian_Bride_Letter_Jpeg-1	chromecache_667.2.dr	false		unknown
https://s.youtube.com/api/stats/qoe?cl=	chromecache_641.2.dr	false		unknown
https://blog.meticulousbeaver.com/blog/category/mindfulness/	chromecache_667.2.dr	false		unknown
https://docs.google.com/picker	chromecache_641.2.dr	false		unknown
https://www.meticulousbeaver.com/api/newsletter	chromecache_703.2.dr, chromecache_798.2.dr, chromecache_667.2.dr	false		unknown
http://blog.meticulousbeaver.com/wp-content/uploads/2024/03/user.png	chromecache_703.2.dr, chromecache_798.2.dr, chromecache_667.2.dr	false		unknown
https://help.instagram.com/626057554667531	chromecache_452.2.dr	false		unknown
https://schema.org	chromecache_641.2.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/	chromecache_641.2.dr, chromecache_703.2.dr, chromecache_798.2.dr, chromecache_667.2.dr	false		unknown
http://mathiasbynens.be/	chromecache_641.2.dr	false	URL Reputation: safe	unknown
https://blog.meticulousbeaver.com/blog/author/nikhil/feed/	chromecache_667.2.dr	false		unknown
https://youtube.com/watch?v=	chromecache_641.2.dr	false		unknown
https://blog.meticulousbeaver.com/?p=1951	chromecache_703.2.dr	false		unknown
https://www.youtube.com/ptracking?ei=	chromecache_641.2.dr	false		unknown
http://tools.ietf.org/html/rfc1950	chromecache_641.2.dr, chromecache_756.2.dr, chromecache_570.2.dr	false	URL Reputation: safe	unknown
https://fburl.com/wiki/xrzohrqb	chromecache_452.2.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/pcs/activeview?xai=	chromecache_641.2.dr	false		unknown
https://blog.meticulousbeaver.com/?p=1958	chromecache_798.2.dr	false		unknown
http://blog.meticulousbeaver.com/wp-content/uploads/2024/05/2.1-Practical-Tips-to-Create-the-Perfect	chromecache_798.2.dr, chromecache_667.2.dr	false		unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525650
Start date and time:	2024-10-04 13:36:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://blog.meticulousbeaver.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@29/702@68/30
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://blog.meticulousbeaver.com/blog/10-practical-tips-to-create-the-perfect-wedding-guest-list-2/ Browse: https://blog.meticulousbeaver.com/blog/effective-stress-management-techniques-for-wedding-planning-2/ Browse: https://blog.meticulousbeaver.com/blog/write-a-letter-to-self-preparing-for-busy-wedding-planning-phase-2/ Browse: https://blog.meticulousbeaver.com/blog/author/nikhil/ Browse: https://www.meticulousbeaver.com/products Browse: https://www.instagram.com/meticulousbeaver/ Browse: https://www.youtube.com/@MeticulousBeaverPlanners

Input	Output
URL: https://blog.meticulousbeaver.com Model: jbxai	{ "brand":["Meticulous"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://blog.meticulousbeaver.com Model: jbxai	{ "brand":["Meticulous"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://blog.meticulousbeaver.com Model: jbxai	{ "brand":["Meticulous"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://blog.meticulousbeaver.com Model: jbxai	{ "brand":["Meticulous"], "contains_trigger_text":true, "trigger_text":"Write a Letter to Self: Preparing for Busy Wedding Planning Phase", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://blog.meticulousbeaver.com Model: jbxai	{ "brand":["Meticulous"], "contains_trigger_text":true, "trigger_text":"Write a Letter to Self: Preparing for Busy Wedding Planning Phase", "prominent_button_name":"Search", "text_input_field_labels":["Guest Planning", "intuition", "Return Gifts"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":true, "has_visible_qrcode":false}

URL: https://www.meticulousbeaver.com Model: jbxai	{ "brand":["Meticulous Beaver"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"JOIN", "text_input_field_labels":["Enter your email here"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.meticulousbeaver.com Model: jbxai	{ "phishing_score":2, "brands":"Meticulous Beaver", "legit_domain":"meticulousbeaver.com", "classification":"unknown", "reasons":["The brand 'Meticulous Beaver' is not widely recognized, making it difficult to classify as 'known' or 'wellknown'.", "The URL 'www.meticulousbeaver.com' matches the brand name exactly, which is a positive indicator of legitimacy.", "There are no suspicious elements in the URL such as misspellings, extra characters, or unusual domain extensions.", "The input field 'Enter your email here' is generic and does not inherently indicate phishing."], "brand_matches":[true], "url_match":true, "brand_input":"Meticulous Beaver", "input_fields":"Enter your email here"}

URL: https://www.youtube.com Model: jbxai	{ "brand":["YouTube"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Subscribe", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.youtube.com Model: jbxai	{ "brand":["YouTube"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Subscribe", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	562
Entropy (8bit):	4.9915066079377075
Encrypted:	false
SSDEEP:	12:trwdU/gKuCZ7Ui+ZfUCpHUkjExQqjhllt4llB+oARyqP/w3xQqjhllR:tYU/duQ7z+R3pI+qjhllt0z+oOyo/w39
MD5:	F36390EC068BE03F1BB0D25CB69F525A
SHA1:	1BD1A8A91F87EBBD79CAA293ECD97E67F3124B96
SHA-256:	61E2D278B66C20B8506B6696A5B45BD9D8A3D9EFC6CB380F3E382D79851868A4
SHA-512:	5111BE09F8EE2DB82C768DD042BD0BB692FF6CE84ED4859D00A4262A9140B0D742927BB74F82AC58908609908A673D93C81AE9A37E33779E67BE96226B0AC943
Malicious:	false
Reputation:	low
Preview:	<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M20 21V19C20 17.9391 19.5786 16.9217 18.8284 16.1716C18.0783 15.4214 17.0609 15 16 15H8C6.93913 15 5.92172 15.4214 5.17157 16.1716C4.42143 16.9217 4 17.9391 4 19V21" stroke="black" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>.<path d="M12 11C14.2091 11 16 9.20914 16 7C16 4.79086 14.2091 3 12 3C9.79086 3 8 4.79086 8 7C8 9.20914 9.79086 11 12 11Z" stroke="black" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>.</svg>.

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 13:37:46.250520945 CEST	192.168.2.6	1.1.1.1	0x2930	Standard query (0)	blog.meticulousbeaver.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:37:46.250787020 CEST	192.168.2.6	1.1.1.1	0x4455	Standard query (0)	blog.meticulousbeaver.com	65	IN (0x0001)	false
Oct 4, 2024 13:37:47.703706980 CEST	192.168.2.6	1.1.1.1	0x432a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:37:47.704037905 CEST	192.168.2.6	1.1.1.1	0x35ca	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 4, 2024 13:37:48.745721102 CEST	192.168.2.6	1.1.1.1	0x8907	Standard query (0)	stats.wp.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:37:48.752535105 CEST	192.168.2.6	1.1.1.1	0xd18d	Standard query (0)	stats.wp.com	65	IN (0x0001)	false
Oct 4, 2024 13:37:51.137518883 CEST	192.168.2.6	1.1.1.1	0x6958	Standard query (0)	www.meticulousbeaver.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:37:51.138323069 CEST	192.168.2.6	1.1.1.1	0x5695	Standard query (0)	www.meticulousbeaver.com	65	IN (0x0001)	false
Oct 4, 2024 13:37:51.184811115 CEST	192.168.2.6	1.1.1.1	0xdc57	Standard query (0)	blog.meticulousbeaver.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:37:51.189032078 CEST	192.168.2.6	1.1.1.1	0xc416	Standard query (0)	blog.meticulousbeaver.com	65	IN (0x0001)	false
Oct 4, 2024 13:37:53.194144011 CEST	192.168.2.6	1.1.1.1	0xabfb	Standard query (0)	www.meticulousbeaver.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:37:53.194608927 CEST	192.168.2.6	1.1.1.1	0x9674	Standard query (0)	www.meticulousbeaver.com	65	IN (0x0001)	false
Oct 4, 2024 13:37:54.244858980 CEST	192.168.2.6	1.1.1.1	0x96e9	Standard query (0)	stats.wp.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:37:54.245244026 CEST	192.168.2.6	1.1.1.1	0x44e6	Standard query (0)	stats.wp.com	65	IN (0x0001)	false
Oct 4, 2024 13:37:56.535286903 CEST	192.168.2.6	1.1.1.1	0x5cc8	Standard query (0)	pixel.wp.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:37:56.535665035 CEST	192.168.2.6	1.1.1.1	0x2447	Standard query (0)	pixel.wp.com	65	IN (0x0001)	false
Oct 4, 2024 13:37:58.151631117 CEST	192.168.2.6	1.1.1.1	0xf341	Standard query (0)	pixel.wp.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:37:58.152014017 CEST	192.168.2.6	1.1.1.1	0xbd14	Standard query (0)	pixel.wp.com	65	IN (0x0001)	false
Oct 4, 2024 13:38:40.264967918 CEST	192.168.2.6	1.1.1.1	0xfc83	Standard query (0)	cdn-in.pagesense.io	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:38:40.265109062 CEST	192.168.2.6	1.1.1.1	0x7cd8	Standard query (0)	cdn-in.pagesense.io	65	IN (0x0001)	false
Oct 4, 2024 13:38:48.701059103 CEST	192.168.2.6	1.1.1.1	0x9084	Standard query (0)	www.instagram.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:38:48.701606989 CEST	192.168.2.6	1.1.1.1	0x638b	Standard query (0)	www.instagram.com	65	IN (0x0001)	false
Oct 4, 2024 13:38:49.917130947 CEST	192.168.2.6	1.1.1.1	0x8d47	Standard query (0)	static.cdninstagram.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:38:49.917406082 CEST	192.168.2.6	1.1.1.1	0x5da3	Standard query (0)	static.cdninstagram.com	65	IN (0x0001)	false
Oct 4, 2024 13:38:51.963732004 CEST	192.168.2.6	1.1.1.1	0xa6f	Standard query (0)	static.cdninstagram.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:38:51.963927984 CEST	192.168.2.6	1.1.1.1	0x118d	Standard query (0)	static.cdninstagram.com	65	IN (0x0001)	false
Oct 4, 2024 13:38:55.809943914 CEST	192.168.2.6	1.1.1.1	0xfc73	Standard query (0)	www.instagram.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:38:55.810125113 CEST	192.168.2.6	1.1.1.1	0xfc4b	Standard query (0)	www.instagram.com	65	IN (0x0001)	false
Oct 4, 2024 13:38:56.361107111 CEST	192.168.2.6	1.1.1.1	0xcd	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:38:56.361582041 CEST	192.168.2.6	1.1.1.1	0x3557	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Oct 4, 2024 13:38:57.762841940 CEST	192.168.2.6	1.1.1.1	0x2bd9	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:38:57.763175964 CEST	192.168.2.6	1.1.1.1	0x84d9	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Oct 4, 2024 13:38:58.755362034 CEST	192.168.2.6	1.1.1.1	0xd2b5	Standard query (0)	scontent-msp1-1.cdninstagram.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:38:58.755531073 CEST	192.168.2.6	1.1.1.1	0x44f3	Standard query (0)	scontent-msp1-1.cdninstagram.com	65	IN (0x0001)	false
Oct 4, 2024 13:38:59.941152096 CEST	192.168.2.6	1.1.1.1	0xbbed	Standard query (0)	scontent-msp1-1.cdninstagram.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:38:59.941570044 CEST	192.168.2.6	1.1.1.1	0x9be4	Standard query (0)	scontent-msp1-1.cdninstagram.com	65	IN (0x0001)	false
Oct 4, 2024 13:38:59.990863085 CEST	192.168.2.6	1.1.1.1	0xfac4	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:00.010593891 CEST	192.168.2.6	1.1.1.1	0x79d6	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Oct 4, 2024 13:39:00.301278114 CEST	192.168.2.6	1.1.1.1	0xb030	Standard query (0)	graph.instagram.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:00.301558018 CEST	192.168.2.6	1.1.1.1	0x137d	Standard query (0)	graph.instagram.com	65	IN (0x0001)	false
Oct 4, 2024 13:39:01.472706079 CEST	192.168.2.6	1.1.1.1	0x6d61	Standard query (0)	i.ytimg.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:01.473877907 CEST	192.168.2.6	1.1.1.1	0x362d	Standard query (0)	i.ytimg.com	65	IN (0x0001)	false
Oct 4, 2024 13:39:02.989167929 CEST	192.168.2.6	1.1.1.1	0x9a95	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:02.991291046 CEST	192.168.2.6	1.1.1.1	0xc65c	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Oct 4, 2024 13:39:09.425931931 CEST	192.168.2.6	1.1.1.1	0x573	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:09.426582098 CEST	192.168.2.6	1.1.1.1	0xa9a7	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Oct 4, 2024 13:39:10.162561893 CEST	192.168.2.6	1.1.1.1	0x942d	Standard query (0)	yt3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:10.162719965 CEST	192.168.2.6	1.1.1.1	0x1b2c	Standard query (0)	yt3.googleusercontent.com	65	IN (0x0001)	false
Oct 4, 2024 13:39:10.905527115 CEST	192.168.2.6	1.1.1.1	0x324b	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:10.906061888 CEST	192.168.2.6	1.1.1.1	0xa7d7	Standard query (0)	youtube.com	65	IN (0x0001)	false
Oct 4, 2024 13:39:12.774061918 CEST	192.168.2.6	1.1.1.1	0xa73a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:12.774343967 CEST	192.168.2.6	1.1.1.1	0x7f81	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 4, 2024 13:39:14.777580976 CEST	192.168.2.6	1.1.1.1	0xec4b	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:14.777968884 CEST	192.168.2.6	1.1.1.1	0x7805	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 4, 2024 13:39:15.846632004 CEST	192.168.2.6	1.1.1.1	0x85c5	Standard query (0)	i.ytimg.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:15.846882105 CEST	192.168.2.6	1.1.1.1	0x2b32	Standard query (0)	i.ytimg.com	65	IN (0x0001)	false
Oct 4, 2024 13:39:15.847539902 CEST	192.168.2.6	1.1.1.1	0x1f7b	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:15.847743988 CEST	192.168.2.6	1.1.1.1	0x30d9	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Oct 4, 2024 13:39:15.848066092 CEST	192.168.2.6	1.1.1.1	0x8e76	Standard query (0)	yt3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:15.848227024 CEST	192.168.2.6	1.1.1.1	0x368f	Standard query (0)	yt3.googleusercontent.com	65	IN (0x0001)	false
Oct 4, 2024 13:39:15.957652092 CEST	192.168.2.6	1.1.1.1	0xe284	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:15.957896948 CEST	192.168.2.6	1.1.1.1	0x58c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 4, 2024 13:39:20.491421938 CEST	192.168.2.6	1.1.1.1	0x3cb1	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:20.491605997 CEST	192.168.2.6	1.1.1.1	0x90d8	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 4, 2024 13:39:25.245950937 CEST	192.168.2.6	1.1.1.1	0x75f7	Standard query (0)	static.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:25.246004105 CEST	192.168.2.6	1.1.1.1	0x7b4	Standard query (0)	static.doubleclick.net	65	IN (0x0001)	false
Oct 4, 2024 13:39:26.652739048 CEST	192.168.2.6	1.1.1.1	0x38f4	Standard query (0)	static.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 4, 2024 13:39:26.653121948 CEST	192.168.2.6	1.1.1.1	0xd1a5	Standard query (0)	static.doubleclick.net	65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-04 11:37:45 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 53 63 41 70 36 54 49 64 2b 45 43 6c 53 34 6c 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 38 31 31 31 31 33 63 66 39 31 64 36 38 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ScAp6TId+EClS4lm.1Context: 1b811113cf91d689
2024-10-04 11:37:45 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-04 11:37:45 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 53 63 41 70 36 54 49 64 2b 45 43 6c 53 34 6c 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 38 31 31 31 31 33 63 66 39 31 64 36 38 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 46 75 30 73 35 63 37 32 43 31 2f 73 42 61 2b 39 69 55 71 4c 72 51 4c 6a 76 53 79 4d 78 75 6c 53 54 62 4f 70 6d 78 41 51 76 52 35 32 47 6a 69 4c 70 4c 70 44 47 34 32 4f 63 4c 54 2f 34 6e 6f 30 5a 39 33 41 57 4e 61 78 43 4b 56 44 79 70 32 6e 35 6e 30 55 2f 39 53 54 57 45 71 2b 56 65 74 43 51 6c 4e 30 73 4e 63 67 51 41 4c 4b Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ScAp6TId+EClS4lm.2Context: 1b811113cf91d689<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfFu0s5c72C1/sBa+9iUqLrQLjvSyMxulSTbOpmxAQvR52GjiLpLpDG42OcLT/4no0Z93AWNaxCKVDyp2n5n0U/9STWEq+VetCQlN0sNcgQALK
2024-10-04 11:37:45 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 53 63 41 70 36 54 49 64 2b 45 43 6c 53 34 6c 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 38 31 31 31 31 33 63 66 39 31 64 36 38 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ScAp6TId+EClS4lm.3Context: 1b811113cf91d689<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-04 11:37:45 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-04 11:37:45 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 65 55 35 63 56 55 70 4c 62 55 6d 35 71 68 32 50 55 64 31 6c 30 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: eU5cVUpLbUm5qh2PUd1l0A.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-10-04 11:37:46 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 11:37:46 UTC	540	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 11:37:46 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 30 Sep 2024 13:16:38 GMT ETag: "0x8DCE1521DF74B57" x-ms-request-id: 90766f9b-701e-006f-578c-15afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T113746Z-15767c5fc554l9xf959gp9cb1s00000006p0000000006cyy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 11:37:46 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-04 11:37:46 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-04 11:37:46 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-04 11:37:47 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-04 11:37:47 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-04 11:37:47 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-04 11:37:47 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-04 11:37:47 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-04 11:37:47 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-04 11:37:47 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Timestamp	Bytes transferred	Direction	Data
2024-10-04 11:37:47 UTC	668	OUT	GET / HTTP/1.1 Host: blog.meticulousbeaver.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-04 11:37:48 UTC	416	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 11:37:47 GMT Server: Apache Link: <https://blog.meticulousbeaver.com/wp-json/>; rel="https://api.w.org/", <https://blog.meticulousbeaver.com/wp-json/wp/v2/pages/170>; rel="alternate"; type="application/json", <https://blog.meticulousbeaver.com/>; rel=shortlink Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-10-04 11:37:48 UTC	7776	IN	Data Raw: 31 65 64 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 6c 6f 67 2e 6d 65 74 69 63 75 6c 6f 75 73 62 65 Data Ascii: 1ed8<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8" /><meta name="description" content="" /><meta name="keywords" content="" /><meta http-equiv="X-UA-Compatible" content="IE=edge"><link rel="pingback" href="https://blog.meticulousbe
2024-10-04 11:37:48 UTC	126	IN	Data Raw: 73 20 3e 20 2e 61 6c 69 67 6e 72 69 67 68 74 20 7b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 32 65 6d 3b 20 7d 2e 77 70 2d 73 69 74 65 2d 62 6c 6f 63 6b 73 20 3e 20 2e 61 6c 69 67 6e 63 65 6e 74 65 72 20 7b 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f Data Ascii: s > .alignright { float: right; margin-left: 2em; }.wp-site-blocks > .aligncenter { justify-content: center; margin-left: auto
2024-10-04 11:37:48 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-04 11:37:48 UTC	8192	IN	Data Raw: 31 63 33 33 0d 0a 3b 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 20 7d 3a 77 68 65 72 65 28 2e 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 29 7b 67 61 70 3a 20 30 2e 35 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 30 2e 35 65 6d 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 6f 77 20 3e 20 2e 61 6c 69 67 6e 6c 65 66 74 7b 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 30 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 32 65 6d 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 6f 77 20 3e 20 2e 61 6c 69 67 6e 72 69 67 68 74 7b 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 Data Ascii: 1c33; margin-right: auto; }:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flow > .alignleft{float: left;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-flow > .alignright{float: right;margin-inline
2024-10-04 11:37:48 UTC	7233	IN	Data Raw: 6e 2c 73 74 72 69 6b 65 2c 73 74 72 6f 6e 67 2c 73 75 62 2c 73 75 70 2c 74 74 2c 75 2c 75 6c 2c 76 61 72 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 6f 75 74 6c 69 6e 65 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 62 6f 64 79 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 7d 6f 6c 2c 75 6c 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 62 6c 6f 63 6b 71 75 6f 74 65 2c 71 7b 71 75 6f 74 65 73 3a 6e 6f Data Ascii: n,strike,strong,sub,sup,tt,u,ul,var{margin:0;padding:0;border:0;outline:0;font-size:100%;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;vertical-align:baseline;background:transparent}body{line-height:1}ol,ul{list-style:none}blockquote,q{quotes:no
2024-10-04 11:37:48 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-04 11:37:48 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 72 5f 69 6e 6e 65 72 5f 63 6f 6e 74 65 6e 74 3e 68 35 2c 62 6f 64 79 20 23 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 20 2e 65 74 5f 62 75 69 6c 64 65 72 5f 69 6e 6e 65 72 5f 63 6f 6e 74 65 6e 74 3e 68 36 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 7d 62 6f 64 79 20 23 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 20 2e 65 74 5f 62 75 69 6c 64 65 72 5f 69 6e 6e 65 72 5f 63 6f 6e 74 65 6e 74 3e 70 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 37 65 6d 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 70 75 6c 6c 71 75 6f 74 65 7b 6d 61 72 67 69 6e 3a 32 30 70 78 20 30 20 33 30 70 78 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 70 75 6c 6c 71 75 6f 74 65 2e 68 61 73 2d 62 61 63 6b 67 72 6f 75 6e 64 20 62 6c 6f 63 6b 71 75 6f 74 65 7b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 6e 6f Data Ascii: 2000r_inner_content>h5,body #main-content .et_builder_inner_content>h6{line-height:1.4em}body #main-content .et_builder_inner_content>p{line-height:1.7em}.wp-block-pullquote{margin:20px 0 30px}.wp-block-pullquote.has-background blockquote{border-left:no
2024-10-04 11:37:48 UTC	6	IN	Data Raw: 29 3b 62 61 63 6b Data Ascii: );back
2024-10-04 11:37:48 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-04 11:37:48 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 35 30 25 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 65 74 5f 70 62 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 70 61 74 74 65 72 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 72 65 70 65 61 74 7d 2e 65 74 5f 70 62 5f 77 69 74 68 5f 62 6f 72 64 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 6f 72 64 65 72 3a 30 20 73 6f 6c 69 64 20 23 33 33 33 7d 2e 70 6f 73 74 2d 70 61 73 73 77 6f 72 64 2d 72 65 71 75 69 72 65 64 20 2e 65 74 5f 70 62 5f 72 6f 77 7b 70 61 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 31 30 Data Ascii: 2000ground-repeat:no-repeat;background-position:50%;overflow:hidden}.et_pb_background_pattern{background-position:0 0;background-repeat:repeat}.et_pb_with_border{position:relative;border:0 solid #333}.post-password-required .et_pb_row{padding:0;width:10

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://blog.meticulousbeaver.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 357

Chrome Cache Entry: 358

Chrome Cache Entry: 359

Chrome Cache Entry: 360

Chrome Cache Entry: 361

Chrome Cache Entry: 362

Chrome Cache Entry: 363

Chrome Cache Entry: 364

Chrome Cache Entry: 365

Chrome Cache Entry: 366

Chrome Cache Entry: 367

Chrome Cache Entry: 368

Chrome Cache Entry: 369

Chrome Cache Entry: 370

Chrome Cache Entry: 371

Chrome Cache Entry: 372

Chrome Cache Entry: 373

Chrome Cache Entry: 374

Chrome Cache Entry: 375

Chrome Cache Entry: 376

Chrome Cache Entry: 377

Chrome Cache Entry: 378

Chrome Cache Entry: 379

Chrome Cache Entry: 380

Chrome Cache Entry: 381

Chrome Cache Entry: 382

Chrome Cache Entry: 383

Chrome Cache Entry: 384

Windows Analysis Report
https://blog.meticulousbeaver.com/

Timestamp	Bytes transferred	Direction	Data
2024-10-04 11:37:48 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 11:37:48 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 11:37:48 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 39d43082-801e-00ac-658c-15fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T113748Z-15767c5fc55w69c2zvnrz0gmgw0000000cs0000000004hpq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 11:37:48 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 11:37:48 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 11:37:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 11:37:48 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: b9d87bc4-001e-008d-138c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T113748Z-15767c5fc55qdcd62bsn50hd6s0000000c6g00000000abqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 11:37:48 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-10-04 11:37:48 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 11:37:48 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 11:37:48 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b9d87bc3-001e-008d-128c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T113748Z-15767c5fc55lghvzbxktxfqntw0000000c3g00000000asg7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 11:37:48 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2024-10-04 11:37:48 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 11:37:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 11:37:48 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4b0a31e7-c01e-00ad-448c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T113748Z-15767c5fc552g4w83buhsr3htc0000000cm00000000004pt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 11:37:48 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-04 11:37:48 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 11:37:48 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 11:37:48 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1cc2ff82-e01e-0071-478c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T113748Z-15767c5fc55qdcd62bsn50hd6s0000000c5000000000cxq9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 11:37:48 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-10-04 11:37:48 UTC	621	OUT	GET /wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17 HTTP/1.1 Host: blog.meticulousbeaver.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://blog.meticulousbeaver.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-04 11:37:49 UTC	257	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 11:37:48 GMT Server: Apache Last-Modified: Fri, 26 Jan 2024 19:31:17 GMT ETag: "2bf8-60fde56ff6b40" Accept-Ranges: bytes Content-Length: 11256 Vary: Accept-Encoding Connection: close Content-Type: text/css
2024-10-04 11:37:49 UTC	7935	IN	Data Raw: 2e 6d 65 6a 73 2d 6f 66 66 73 63 72 65 65 6e 7b 62 6f 72 64 65 72 3a 30 3b 63 6c 69 70 3a 72 65 63 74 28 31 70 78 2c 31 70 78 2c 31 70 78 2c 31 70 78 29 3b 2d 77 65 62 6b 69 74 2d 63 6c 69 70 2d 70 61 74 68 3a 69 6e 73 65 74 28 35 30 25 29 3b 63 6c 69 70 2d 70 61 74 68 3a 69 6e 73 65 74 28 35 30 25 29 3b 68 65 69 67 68 74 3a 31 70 78 3b 6d 61 72 67 69 6e 3a 2d 31 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 61 64 64 69 6e 67 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 31 70 78 3b 77 6f 72 64 2d 77 72 61 70 3a 6e 6f 72 6d 61 6c 7d 2e 6d 65 6a 73 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 30 30 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c Data Ascii: .mejs-offscreen{border:0;clip:rect(1px,1px,1px,1px);-webkit-clip-path:inset(50%);clip-path:inset(50%);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px;word-wrap:normal}.mejs-container{background:#000;font-family:Helvetica,Arial
2024-10-04 11:37:49 UTC	3321	IN	Data Raw: 72 2d 72 61 64 69 75 73 3a 30 20 30 20 34 70 78 20 34 70 78 7d 2e 6d 65 6a 73 2d 76 6f 6c 75 6d 65 2d 74 6f 74 61 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 68 73 6c 61 28 30 2c 30 25 2c 31 30 30 25 2c 2e 35 29 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6c 65 66 74 3a 35 30 25 3b 6d 61 72 67 69 6e 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 38 70 78 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 2d 35 30 25 29 3b 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 2d 35 30 25 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 2d 35 30 25 29 3b 77 69 64 74 68 3a 32 70 78 7d 2e 6d 65 6a 73 2d 76 6f 6c 75 6d 65 2d 63 75 72 72 65 6e 74 7b 6c 65 66 74 Data Ascii: r-radius:0 0 4px 4px}.mejs-volume-total{background:hsla(0,0%,100%,.5);height:100px;left:50%;margin:0;position:absolute;top:8px;-webkit-transform:translateX(-50%);-ms-transform:translateX(-50%);transform:translateX(-50%);width:2px}.mejs-volume-current{left

Timestamp	Bytes transferred	Direction	Data
2024-10-04 11:37:48 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 11:37:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 11:37:48 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 757ce4f4-401e-000a-128c-154a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T113748Z-15767c5fc55tsfp92w7yna557w0000000cd000000000b7sb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 11:37:48 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2024-10-04 11:37:48 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 11:37:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 11:37:48 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: aa8826a4-b01e-0053-608c-15cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T113748Z-15767c5fc55w69c2zvnrz0gmgw0000000csg000000003tae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 11:37:48 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 11:37:48 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 11:37:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 11:37:48 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 3a0dc1eb-601e-0032-608c-15eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T113748Z-15767c5fc55n4msds84xh4z67w00000006800000000023e4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 11:37:48 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Timestamp	Bytes transferred	Direction	Data
2024-10-04 11:37:48 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 11:37:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 11:37:48 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 24b39cfc-301e-0096-2a8c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T113748Z-15767c5fc55dtdv4d4saq7t47n0000000c6g000000009ey2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 11:37:48 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />