b870b3d93f57d08d9eeb16b52cfc7f23c70676deeec39e054d2efdab54fc7230

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 23:39 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a38bb88e1347d5149b23008d3dc1342.html
Size

141KB
MD5

1a38bb88e1347d5149b23008d3dc1342
SHA1

ffac3deff4cccf3e6a9e20ead39d6a70c810156a
SHA256

b870b3d93f57d08d9eeb16b52cfc7f23c70676deeec39e054d2efdab54fc7230
SHA512

418897ca231d874ee5ece6ec012c27cd57e0b0861c86261a880abb7572f5165860d5f146c70795555dbe4c92bbdf2416ca56d8a18dae6cb179c14a7bbdf128e5
SSDEEP

3072:1BHsFiu7pcO8A2jvYikZI/nyGFdgBI9qeY+tq:1BHsFiu7mLEEFWSqp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31078145"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1568426559"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1579833566"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31078145"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000056c0f093da428f4099809f3dbcc1bfee00000000020000000000106600000001000020000000d05338299d444e78e9eecc541ca1952f1fdcd7fc9582cceeb8c65966a2d70228000000000e8000000002000020000000d1a1a5661c2754fb86939cd5dfb73b8057f0394f1c0e7630187104e0a27c3046200000000c9736fabf3ce688a55ec96b9cdfada2dc9030aab4c6127552a48f59f5667d5f40000000c7efee85163d7238bca0a6c0000d5cfb1b7aeefbda42823e929cbb426f044936566e7573829de2bcba95672f41367ab253da93ad968c2f1b4824d3b4909461d5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410253137"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{874D75E8-A2F4-11EE-9BE3-5A2E32B6DBC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000056c0f093da428f4099809f3dbcc1bfee00000000020000000000106600000001000020000000da889afc434b7337651fed444c32f96c3a04d281dcdd723096e23c57049fe2a9000000000e8000000002000020000000565400cbfe5965a40dcaf9642260a7fe28fbadf06199cd459131ef09fc3e7e9120000000e66bd6a8aa9a556044455752bb71450074cfcd54e6426d6f610b12766f4dc950400000000e6c09d001614d0ab306b30ac3c7d19e9bdc6ac6fdcfe8af0992928c63a7a5cb7bd9a85a2d01a3bf47b6cf4e41ee3bad0a273e3a4f11469dd3b49e89374ebc20	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0373e6d0137da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31078145"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1579833566"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e6106d0137da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1568426559"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31078145"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
700	iexplore.exe
700	iexplore.exe
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 2232	700	iexplore.exe	25
PID 700 wrote to memory of 2232	700	iexplore.exe	25
PID 700 wrote to memory of 2232	700	iexplore.exe	25

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1a38bb88e1347d5149b23008d3dc1342.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:700 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2232

Network

DNS

23.181.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

23.181.190.20.in-addr.arpa

IN PTR

Response
DNS

2.136.104.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.136.104.51.in-addr.arpa

IN PTR

Response
DNS

apis.google.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

apis.google.com

IN A

Response

apis.google.com

IN CNAME

plus.l.google.com

plus.l.google.com

IN A

142.250.179.238
DNS

www.blogger.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.blogger.com

IN A

Response

www.blogger.com

IN CNAME

blogger.l.google.com

blogger.l.google.com

IN A

216.58.212.201
DNS

3.bp.blogspot.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

3.bp.blogspot.com

IN A

Response

3.bp.blogspot.com

IN CNAME

photos-ugc.l.googleusercontent.com

photos-ugc.l.googleusercontent.com

IN A

142.250.200.33
DNS

i254.photobucket.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

i254.photobucket.com

IN A

Response

i254.photobucket.com

IN A

18.66.248.101

i254.photobucket.com

IN A

18.66.248.107

i254.photobucket.com

IN A

18.66.248.28

i254.photobucket.com

IN A

18.66.248.13
GET

http://pagead2.googlesyndication.com/pagead/show_ads.js

IEXPLORE.EXE

Remote address:

172.217.16.226:80

Request

GET /pagead/show_ads.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: pagead2.googlesyndication.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Vary: Accept-Encoding
Date: Mon, 25 Dec 2023 07:09:26 GMT
Expires: Mon, 25 Dec 2023 07:09:26 GMT
Cache-Control: private, max-age=3600
Content-Type: text/javascript; charset=UTF-8
ETag: 1054998246541375301
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 14117
X-XSS-Protection: 0
GET

https://apis.google.com/js/plusone.js

IEXPLORE.EXE

Remote address:

142.250.179.238:443

Request

GET /js/plusone.js HTTP/2.0
host: apis.google.com
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
access-control-allow-origin: *
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="gapi-team"
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
timing-allow-origin: *
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-length: 21930
date: Mon, 25 Dec 2023 07:09:27 GMT
expires: Mon, 25 Dec 2023 07:09:27 GMT
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "198f19c141a8a438"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
set-cookie: NID=511=C9kpGCBxi0_yE9LNUDX6voEtalYv26dW7BOOTP79zM0_F1rMKltC9qm2P2fgydpa2Pi3_XcmFvA6flVATJ1TX-CpOlq_7hLLp35PtzHyd9Jc4dFv38VRodmB2xgD8EtfrKD0skgLh3HVzSD5UB012n3ZuYAAZeD_Bh8Wp9ESMHY; expires=Tue, 25-Jun-2024 07:09:27 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.y0xCMa4KeeI.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg/cb=gapi.loaded_0?le=scs

IEXPLORE.EXE

Remote address:

142.250.179.238:443

Request

GET /_/scs/abc-static/_/js/k=gapi.lb.en.y0xCMa4KeeI.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg/cb=gapi.loaded_0?le=scs HTTP/2.0
host: apis.google.com
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate
cookie: NID=511=C9kpGCBxi0_yE9LNUDX6voEtalYv26dW7BOOTP79zM0_F1rMKltC9qm2P2fgydpa2Pi3_XcmFvA6flVATJ1TX-CpOlq_7hLLp35PtzHyd9Jc4dFv38VRodmB2xgD8EtfrKD0skgLh3HVzSD5UB012n3ZuYAAZeD_Bh8Wp9ESMHY

Response

HTTP/2.0 200

accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-length: 55872
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 19 Dec 2023 12:04:34 GMT
expires: Wed, 18 Dec 2024 12:04:34 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 06 Dec 2023 19:05:16 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 500695
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.y0xCMa4KeeI.O/m=gapi_iframes,gapi_iframes_style_bubble/exm=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg/cb=gapi.loaded_1?le=scs

IEXPLORE.EXE

Remote address:

142.250.179.238:443

Request

GET /_/scs/abc-static/_/js/k=gapi.lb.en.y0xCMa4KeeI.O/m=gapi_iframes,gapi_iframes_style_bubble/exm=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg/cb=gapi.loaded_1?le=scs HTTP/2.0
host: apis.google.com
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate
cookie: NID=511=C9kpGCBxi0_yE9LNUDX6voEtalYv26dW7BOOTP79zM0_F1rMKltC9qm2P2fgydpa2Pi3_XcmFvA6flVATJ1TX-CpOlq_7hLLp35PtzHyd9Jc4dFv38VRodmB2xgD8EtfrKD0skgLh3HVzSD5UB012n3ZuYAAZeD_Bh8Wp9ESMHY

Response

HTTP/2.0 200

accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-length: 15125
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 19 Dec 2023 20:26:48 GMT
expires: Wed, 18 Dec 2024 20:26:48 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 06 Dec 2023 19:05:16 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 470561
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://apis.google.com/js/platform:gapi.iframes.style.common.js

IEXPLORE.EXE

Remote address:

142.250.179.238:443

Request

GET /js/platform:gapi.iframes.style.common.js HTTP/2.0
host: apis.google.com
accept: application/javascript, */*;q=0.8
referer: https://www.blogger.com/navbar.g?targetBlogID=929093624394547178&blogName=kpss+2010+KPSS+SONU%C3%87LARI+KPSS+SINAV+S...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://2010-kpss.blogspot.com/search&blogLocale=tr&v=2&homepageUrl=http://2010-kpss.blogspot.com/&vt=8291138887576160719&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.y0xCMa4KeeI.O%2Fd%3D1%2Frs%3DAHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg%2Fm%3D__features__
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate
cookie: NID=511=C9kpGCBxi0_yE9LNUDX6voEtalYv26dW7BOOTP79zM0_F1rMKltC9qm2P2fgydpa2Pi3_XcmFvA6flVATJ1TX-CpOlq_7hLLp35PtzHyd9Jc4dFv38VRodmB2xgD8EtfrKD0skgLh3HVzSD5UB012n3ZuYAAZeD_Bh8Wp9ESMHY

Response

HTTP/2.0 200

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
access-control-allow-origin: *
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="gapi-team"
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
timing-allow-origin: *
content-length: 21939
date: Mon, 25 Dec 2023 07:09:52 GMT
expires: Mon, 25 Dec 2023 07:09:52 GMT
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "a663cbedcf0f6556"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.y0xCMa4KeeI.O/m=gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg/cb=gapi.loaded_0?le=scs

IEXPLORE.EXE

Remote address:

142.250.179.238:443

Request

GET /_/scs/abc-static/_/js/k=gapi.lb.en.y0xCMa4KeeI.O/m=gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg/cb=gapi.loaded_0?le=scs HTTP/2.0
host: apis.google.com
accept: application/javascript, */*;q=0.8
referer: https://www.blogger.com/navbar.g?targetBlogID=929093624394547178&blogName=kpss+2010+KPSS+SONU%C3%87LARI+KPSS+SINAV+S...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://2010-kpss.blogspot.com/search&blogLocale=tr&v=2&homepageUrl=http://2010-kpss.blogspot.com/&vt=8291138887576160719&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.y0xCMa4KeeI.O%2Fd%3D1%2Frs%3DAHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg%2Fm%3D__features__
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate
cookie: NID=511=C9kpGCBxi0_yE9LNUDX6voEtalYv26dW7BOOTP79zM0_F1rMKltC9qm2P2fgydpa2Pi3_XcmFvA6flVATJ1TX-CpOlq_7hLLp35PtzHyd9Jc4dFv38VRodmB2xgD8EtfrKD0skgLh3HVzSD5UB012n3ZuYAAZeD_Bh8Wp9ESMHY

Response

HTTP/2.0 200

accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-length: 45646
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 19 Dec 2023 16:05:55 GMT
expires: Wed, 18 Dec 2024 16:05:55 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 06 Dec 2023 19:05:16 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 486237
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

http://3.bp.blogspot.com/_V-IXTBBt1Bg/SV_M-3buH9I/AAAAAAAAAnA/RPg5dIPG8Ks/s1600/grabrss.gif

IEXPLORE.EXE

Remote address:

142.250.200.33:80

Request

GET /_V-IXTBBt1Bg/SV_M-3buH9I/AAAAAAAAAnA/RPg5dIPG8Ks/s1600/grabrss.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 3.bp.blogspot.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="grabrss.gif"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 5958
X-XSS-Protection: 0
Date: Mon, 25 Dec 2023 07:09:26 GMT
Expires: Tue, 26 Dec 2023 07:09:26 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v15ed"
Content-Type: image/gif
Vary: Origin
Age: 0
GET

http://3.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9RFQ1NI/AAAAAAAAAl4/CGutZDjYQGA/s1600/bgtabright.gif

IEXPLORE.EXE

Remote address:

142.250.200.33:80

Request

GET /_V-IXTBBt1Bg/SV_M9RFQ1NI/AAAAAAAAAl4/CGutZDjYQGA/s1600/bgtabright.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 3.bp.blogspot.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="bgtabright.gif"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 2146
X-XSS-Protection: 0
Date: Mon, 25 Dec 2023 07:09:51 GMT
Expires: Tue, 26 Dec 2023 07:09:51 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v15e4"
Content-Type: image/gif
Vary: Origin
Age: 0
GET

https://www.blogger.com/static/v1/widgets/1258645123-widgets.js

IEXPLORE.EXE

Remote address:

216.58.212.201:443

Request

GET /static/v1/widgets/1258645123-widgets.js HTTP/2.0
host: www.blogger.com
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

accept-ranges: bytes
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 55217
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 21 Dec 2023 21:45:51 GMT
expires: Fri, 20 Dec 2024 21:45:51 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 27 Jul 2021 02:53:35 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 293017
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.blogger.com/static/v1/widgets/204402360-widget_css_bundle.css

IEXPLORE.EXE

Remote address:

216.58.212.201:443

Request

GET /static/v1/widgets/204402360-widget_css_bundle.css HTTP/2.0
host: www.blogger.com
accept: text/css, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

accept-ranges: bytes
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 6824
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 19 Dec 2023 10:14:08 GMT
expires: Wed, 18 Dec 2024 10:14:08 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 09 Sep 2021 01:51:04 GMT
content-type: text/css
vary: Accept-Encoding
age: 507320
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.blogger.com/dyn-css/authorization.css?targetBlogID=929093624394547178&zx=cf23e931-bbc3-491f-88ae-ec12c2f8e753

IEXPLORE.EXE

Remote address:

216.58.212.201:443

Request

GET /dyn-css/authorization.css?targetBlogID=929093624394547178&zx=cf23e931-bbc3-491f-88ae-ec12c2f8e753 HTTP/2.0
host: www.blogger.com
accept: text/css, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-type: text/css; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 25 Dec 2023 07:09:28 GMT
last-modified: Mon, 25 Dec 2023 07:09:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
content-length: 21
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.blogger.com/navbar.g?targetBlogID=929093624394547178&blogName=kpss+2010+KPSS+SONU%C3%87LARI+KPSS+SINAV+S...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://2010-kpss.blogspot.com/search&blogLocale=tr&v=2&homepageUrl=http://2010-kpss.blogspot.com/&vt=8291138887576160719&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.y0xCMa4KeeI.O%2Fd%3D1%2Frs%3DAHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg%2Fm%3D__features__

IEXPLORE.EXE

Remote address:

216.58.212.201:443

Request

GET /navbar.g?targetBlogID=929093624394547178&blogName=kpss+2010+KPSS+SONU%C3%87LARI+KPSS+SINAV+S...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://2010-kpss.blogspot.com/search&blogLocale=tr&v=2&homepageUrl=http://2010-kpss.blogspot.com/&vt=8291138887576160719&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.y0xCMa4KeeI.O%2Fd%3D1%2Frs%3DAHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg%2Fm%3D__features__ HTTP/2.0
host: www.blogger.com
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 25 Dec 2023 07:09:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 2578
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

static.getclicky.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

static.getclicky.com

IN A

Response

static.getclicky.com

IN A

104.17.98.108

static.getclicky.com

IN A

104.17.97.108
DNS

static.getclicky.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

static.getclicky.com

IN A
GET

http://i254.photobucket.com/albums/hh92/eblogtemplates/wppremium/button-submit.gif

IEXPLORE.EXE

Remote address:

18.66.248.101:80

Request

GET /albums/hh92/eblogtemplates/wppremium/button-submit.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: i254.photobucket.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Server: CloudFront
Date: Mon, 25 Dec 2023 07:09:26 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Location: https://i254.photobucket.com/albums/hh92/eblogtemplates/wppremium/button-submit.gif
X-Cache: Redirect from cloudfront
Via: 1.1 5bbaa27b453dc834289b91c14bbb4934.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: DUS51-P1
X-Amz-Cf-Id: pOclI-yIH2jz8sR2HpTIOBkyAhZ6vKUzk99AWsYp57ubDV9d4A6Sug==
Vary: Origin
GET

https://i254.photobucket.com/albums/hh92/eblogtemplates/wppremium/button-submit.gif

IEXPLORE.EXE

Remote address:

18.66.248.101:443

Request

GET /albums/hh92/eblogtemplates/wppremium/button-submit.gif HTTP/2.0
host: i254.photobucket.com
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

content-type: image/gif
content-length: 746
date: Fri, 22 Dec 2023 12:29:38 GMT
cache-control: max-age=31536000, public
content-disposition: inline; filename="button-submit.gif"
content-security-policy: script-src 'none'
expires: Sat, 21 Dec 2024 12:29:38 GMT
server: photobucket
x-amzn-trace-id: Root=1-65858132-4e1b30a05ae8d8ad5e816f48
x-request-id: TkCWgxmeveWYIYrnBQ7fh
vary: Accept
x-cache: Hit from cloudfront
via: 1.1 809c299e67c4ffca3db95351c7287bd8.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P1
x-amz-cf-id: RuuYq3L-xUynkO7yp6PEPsQs76cey1K3U578LMd6YMwEsv1k2P7aRA==
age: 239998
vary: Origin
DNS

201.212.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

201.212.58.216.in-addr.arpa

IN PTR

Response

201.212.58.216.in-addr.arpa

IN PTR

lhr25s27-in-f91e100net

201.212.58.216.in-addr.arpa

IN PTR

ams16s21-in-f201�H

201.212.58.216.in-addr.arpa

IN PTR

ams16s21-in-f9�H
DNS

238.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

238.179.250.142.in-addr.arpa

IN PTR

Response

238.179.250.142.in-addr.arpa

IN PTR

lhr25s31-in-f141e100net
DNS

101.248.66.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

101.248.66.18.in-addr.arpa

IN PTR

Response

101.248.66.18.in-addr.arpa

IN PTR

server-18-66-248-101dus51r cloudfrontnet
DNS

226.16.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

226.16.217.172.in-addr.arpa

IN PTR

Response

226.16.217.172.in-addr.arpa

IN PTR

lhr48s28-in-f21e100net

226.16.217.172.in-addr.arpa

IN PTR

mad08s04-in-f2�H
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

35.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

35.200.250.142.in-addr.arpa

IN PTR

Response

35.200.250.142.in-addr.arpa

IN PTR

lhr48s30-in-f31e100net
DNS

33.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

33.200.250.142.in-addr.arpa

IN PTR

Response

33.200.250.142.in-addr.arpa

IN PTR

lhr48s30-in-f11e100net
GET

http://static.getclicky.com/39600.js

IEXPLORE.EXE

Remote address:

104.17.98.108:80

Request

GET /39600.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.getclicky.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Mon, 25 Dec 2023 07:09:27 GMT
Content-Type: text/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Cache-control: public, max-age=86400
X-Proxy-Cache: MISS
Content-Encoding: gzip
Last-Modified: Mon, 25 Dec 2023 06:51:11 GMT
CF-Cache-Status: HIT
Expires: Tue, 26 Dec 2023 07:09:27 GMT
Server: cloudflare
CF-RAY: 83af4236aebe3dac-LHR
alt-svc: h3=":443"; ma=86400
GET

http://static.getclicky.com/media/links/badge.gif

IEXPLORE.EXE

Remote address:

104.17.98.108:80

Request

GET /media/links/badge.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.getclicky.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Mon, 25 Dec 2023 07:09:27 GMT
Content-Type: image/gif
Content-Length: 241
Connection: keep-alive
Last-Modified: Wed, 13 Apr 2016 00:13:35 GMT
ETag: "570d8f2f-f1"
Expires: Mon, 01 Jan 2024 07:09:27 GMT
Cache-Control: public, max-age=604800
X-Proxy-Cache: MISS
CF-Cache-Status: HIT
Age: 298461
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 83af4236aea463a8-LHR
alt-svc: h3=":443"; ma=86400
DNS

108.98.17.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

108.98.17.104.in-addr.arpa

IN PTR

Response
DNS

241.154.82.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.154.82.20.in-addr.arpa

IN PTR

Response
DNS

55.36.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

55.36.223.20.in-addr.arpa

IN PTR

Response
DNS

www.adobetutorialz.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.adobetutorialz.com

IN A

Response

www.adobetutorialz.com

IN A

167.99.249.92
GET

http://www.adobetutorialz.com/content_images/AdobePhotoshop/ART-D/tutorial361/abstract-art-wallpaper.jpg

IEXPLORE.EXE

Remote address:

167.99.249.92:80

Request

GET /content_images/AdobePhotoshop/ART-D/tutorial361/abstract-art-wallpaper.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.adobetutorialz.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Mon, 25 Dec 2023 06:56:32 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.29
Location: http://designstacks.net/content_images/AdobePhotoshop/ART-D/tutorial361/abstract-art-wallpaper.jpg
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
DNS

designstacks.net

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

designstacks.net

IN A

Response

designstacks.net

IN A

167.99.249.92
GET

http://designstacks.net/content_images/AdobePhotoshop/ART-D/tutorial361/abstract-art-wallpaper.jpg

IEXPLORE.EXE

Remote address:

167.99.249.92:80

Request

GET /content_images/AdobePhotoshop/ART-D/tutorial361/abstract-art-wallpaper.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Host: designstacks.net

Response

HTTP/1.1 200 OK

Date: Mon, 25 Dec 2023 06:56:32 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Wed, 10 Sep 2014 21:09:24 GMT
ETag: "3eb0f-502bc77688900"
Accept-Ranges: bytes
Content-Length: 256783
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/jpeg
DNS

92.249.99.167.in-addr.arpa

Remote address:

8.8.8.8:53

Request

92.249.99.167.in-addr.arpa

IN PTR

Response
DNS

41.110.16.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

41.110.16.96.in-addr.arpa

IN PTR

Response

41.110.16.96.in-addr.arpa

IN PTR

a96-16-110-41deploystaticakamaitechnologiescom
DNS

143.226.173.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

143.226.173.18.in-addr.arpa

IN PTR

Response

143.226.173.18.in-addr.arpa

IN PTR

server-18-173-226-143dus51r cloudfrontnet
DNS

143.226.173.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

143.226.173.18.in-addr.arpa

IN PTR
DNS

86.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.23.85.13.in-addr.arpa

IN PTR

Response
DNS

27.62.154.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

27.62.154.18.in-addr.arpa

IN PTR

Response

27.62.154.18.in-addr.arpa

IN PTR

server-18-154-62-27dus51r cloudfrontnet
DNS

15.164.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

15.164.165.52.in-addr.arpa

IN PTR

Response
DNS

146.78.124.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

146.78.124.51.in-addr.arpa

IN PTR

Response
DNS

146.78.124.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

146.78.124.51.in-addr.arpa

IN PTR

Response
DNS

104.241.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

104.241.123.92.in-addr.arpa

IN PTR

Response

104.241.123.92.in-addr.arpa

IN PTR

a92-123-241-104deploystaticakamaitechnologiescom
DNS

119.110.54.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

119.110.54.20.in-addr.arpa

IN PTR

Response
DNS

www.facebook.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.facebook.com

IN A

Response

www.facebook.com

IN CNAME

star-mini.c10r.facebook.com

star-mini.c10r.facebook.com

IN A

163.70.147.35
DNS

www.facebook.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.facebook.com

IN A
DNS

2.bp.blogspot.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

2.bp.blogspot.com

IN A

Response

2.bp.blogspot.com

IN CNAME

photos-ugc.l.googleusercontent.com

photos-ugc.l.googleusercontent.com

IN A

142.250.200.33
GET

https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FErdem-%25C3%2587etinkaya%2F227636807249546&layout=standard&show_faces=true&width=53&action=like&colorscheme=light&height=80

IEXPLORE.EXE

Remote address:

163.70.147.35:443

Request

GET /plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FErdem-%25C3%2587etinkaya%2F227636807249546&layout=standard&show_faces=true&width=53&action=like&colorscheme=light&height=80 HTTP/2.0
host: www.facebook.com
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

content-type: text/html;charset=utf-8
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
cross-origin-opener-policy: same-origin-allow-popups
x-content-type-options: nosniff
x-xss-protection: 0
x-fb-debug: SuU1pfvXrtW+qwICKSVWdwhouitNlssBw4NVzs0m6H3qWr2bHG1kjiA5LG5S9lFi0wxTR2EACJWnb/OUV+r4EQ==
content-length: 0
date: Mon, 25 Dec 2023 07:09:52 GMT
alt-svc: h3=":443"; ma=86400
GET

http://2.bp.blogspot.com/_V-IXTBBt1Bg/SV_M_VCHipI/AAAAAAAAAnY/qmH8mq7CBL0/s1600/search.gif

IEXPLORE.EXE

Remote address:

142.250.200.33:80

Request

GET /_V-IXTBBt1Bg/SV_M_VCHipI/AAAAAAAAAnY/qmH8mq7CBL0/s1600/search.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 2.bp.blogspot.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="search.gif"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 1664
X-XSS-Protection: 0
Date: Mon, 25 Dec 2023 07:09:51 GMT
Expires: Tue, 26 Dec 2023 07:09:51 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v1621"
Content-Type: image/gif
Vary: Origin
Age: 0
GET

http://2.bp.blogspot.com/_V-IXTBBt1Bg/SV_M-Fyw7bI/AAAAAAAAAmQ/l7LqIMqEFHI/s1600/bullet.gif

IEXPLORE.EXE

Remote address:

142.250.200.33:80

Request

GET /_V-IXTBBt1Bg/SV_M-Fyw7bI/AAAAAAAAAmQ/l7LqIMqEFHI/s1600/bullet.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 2.bp.blogspot.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="bullet.gif"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 295
X-XSS-Protection: 0
Date: Mon, 25 Dec 2023 07:09:52 GMT
Expires: Tue, 26 Dec 2023 07:09:52 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v147f"
Content-Type: image/gif
Vary: Origin
Age: 0
DNS

1.bp.blogspot.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

1.bp.blogspot.com

IN A

Response

1.bp.blogspot.com

IN CNAME

photos-ugc.l.googleusercontent.com

photos-ugc.l.googleusercontent.com

IN A

142.250.200.33
DNS

4.bp.blogspot.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

4.bp.blogspot.com

IN A

Response

4.bp.blogspot.com

IN CNAME

photos-ugc.l.googleusercontent.com

photos-ugc.l.googleusercontent.com

IN A

142.250.200.33
GET

http://3.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9cZEfLI/AAAAAAAAAlo/OjLZBsmO58k/s1600/bgsidebartop.gif

IEXPLORE.EXE

Remote address:

142.250.200.33:80

Request

GET /_V-IXTBBt1Bg/SV_M9cZEfLI/AAAAAAAAAlo/OjLZBsmO58k/s1600/bgsidebartop.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 3.bp.blogspot.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="bgsidebartop.gif"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 300
X-XSS-Protection: 0
Date: Mon, 25 Dec 2023 07:09:52 GMT
Expires: Tue, 26 Dec 2023 07:09:52 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v1486"
Content-Type: image/gif
Vary: Origin
Age: 0
GET

http://3.bp.blogspot.com/_V-IXTBBt1Bg/SV_M_n7PTiI/AAAAAAAAAno/uT3hiA5CFqg/s1600/welcome.gif

IEXPLORE.EXE

Remote address:

142.250.200.33:80

Request

GET /_V-IXTBBt1Bg/SV_M_n7PTiI/AAAAAAAAAno/uT3hiA5CFqg/s1600/welcome.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 3.bp.blogspot.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="welcome.gif"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 2267
X-XSS-Protection: 0
Date: Mon, 25 Dec 2023 07:09:51 GMT
Expires: Tue, 26 Dec 2023 07:09:51 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v154b"
Content-Type: image/gif
Vary: Origin
Age: 0
GET

http://1.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9TQCNNI/AAAAAAAAAlw/6es62Wp0AMw/s1600/bgtableft.gif

IEXPLORE.EXE

Remote address:

142.250.200.33:80

Request

GET /_V-IXTBBt1Bg/SV_M9TQCNNI/AAAAAAAAAlw/6es62Wp0AMw/s1600/bgtableft.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 1.bp.blogspot.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: image/png
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
ETag: "v25c"
Expires: Tue, 26 Dec 2023 07:09:53 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="bgtableft.png"
X-Content-Type-Options: nosniff
Date: Mon, 25 Dec 2023 07:09:53 GMT
Server: fife
Content-Length: 611
X-XSS-Protection: 0
GET

http://1.bp.blogspot.com/_V-IXTBBt1Bg/SV_M8WaWScI/AAAAAAAAAlQ/Kje282DfIV8/s1600/bgbottom.gif

IEXPLORE.EXE

Remote address:

142.250.200.33:80

Request

GET /_V-IXTBBt1Bg/SV_M8WaWScI/AAAAAAAAAlQ/Kje282DfIV8/s1600/bgbottom.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 1.bp.blogspot.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="bgbottom.gif"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 416
X-XSS-Protection: 0
Date: Mon, 25 Dec 2023 07:09:54 GMT
Expires: Tue, 26 Dec 2023 07:09:54 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v1625"
Content-Type: image/gif
Vary: Origin
Age: 0
GET

http://4.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9NiqR8I/AAAAAAAAAlg/QJjPriINkoM/s1600/bgsidebarbottom.gif

IEXPLORE.EXE

Remote address:

142.250.200.33:80

Request

GET /_V-IXTBBt1Bg/SV_M9NiqR8I/AAAAAAAAAlg/QJjPriINkoM/s1600/bgsidebarbottom.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 4.bp.blogspot.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="bgsidebarbottom.gif"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 297
X-XSS-Protection: 0
Date: Mon, 25 Dec 2023 07:09:52 GMT
Expires: Tue, 26 Dec 2023 07:09:52 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v14a4"
Content-Type: image/gif
Vary: Origin
Age: 0
GET

http://4.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9zXzfQI/AAAAAAAAAmI/NHt3d7rOVQk/s1600/bgtopwhite.gif

IEXPLORE.EXE

Remote address:

142.250.200.33:80

Request

GET /_V-IXTBBt1Bg/SV_M9zXzfQI/AAAAAAAAAmI/NHt3d7rOVQk/s1600/bgtopwhite.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 4.bp.blogspot.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="bgtopwhite.gif"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 393
X-XSS-Protection: 0
Date: Mon, 25 Dec 2023 07:09:52 GMT
Expires: Tue, 26 Dec 2023 07:09:52 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v15a4"
Content-Type: image/gif
Vary: Origin
Age: 0
GET

http://4.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9qRErpI/AAAAAAAAAmA/1SbWs0APbHY/s1600/bgtop.gif

IEXPLORE.EXE

Remote address:

142.250.200.33:80

Request

GET /_V-IXTBBt1Bg/SV_M9qRErpI/AAAAAAAAAmA/1SbWs0APbHY/s1600/bgtop.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 4.bp.blogspot.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="bgtop.gif"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 419
X-XSS-Protection: 0
Date: Mon, 25 Dec 2023 07:09:54 GMT
Expires: Tue, 26 Dec 2023 07:09:54 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v1528"
Content-Type: image/gif
Vary: Origin
Age: 0
GET

http://4.bp.blogspot.com/_V-IXTBBt1Bg/SV_M_iAENqI/AAAAAAAAAng/EgFs037bOAI/s1600/sidebar_h2.gif

IEXPLORE.EXE

Remote address:

142.250.200.33:80

Request

GET /_V-IXTBBt1Bg/SV_M_iAENqI/AAAAAAAAAng/EgFs037bOAI/s1600/sidebar_h2.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 4.bp.blogspot.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="sidebar_h2.gif"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 1629
X-XSS-Protection: 0
Date: Mon, 25 Dec 2023 07:09:52 GMT
Expires: Tue, 26 Dec 2023 07:09:52 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v14cf"
Content-Type: image/gif
Vary: Origin
Age: 0
GET

http://4.bp.blogspot.com/_V-IXTBBt1Bg/SV_M8pUsZdI/AAAAAAAAAlY/9cYigXl6uiw/s1600/bgbottomwhite.gif

IEXPLORE.EXE

Remote address:

142.250.200.33:80

Request

GET /_V-IXTBBt1Bg/SV_M8pUsZdI/AAAAAAAAAlY/9cYigXl6uiw/s1600/bgbottomwhite.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 4.bp.blogspot.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="bgbottomwhite.gif"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 416
X-XSS-Protection: 0
Date: Mon, 25 Dec 2023 07:09:54 GMT
Expires: Tue, 26 Dec 2023 07:09:54 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v14d5"
Content-Type: image/gif
Vary: Origin
Age: 0
DNS

srv.sayyac.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

srv.sayyac.com

IN A

Response
DNS

srv.sayyac.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

srv.sayyac.com

IN A

Response
DNS

srv.sayyac.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

srv.sayyac.com

IN A

Response
DNS

35.147.70.163.in-addr.arpa

Remote address:

8.8.8.8:53

Request

35.147.70.163.in-addr.arpa

IN PTR

Response

35.147.70.163.in-addr.arpa

IN PTR

edge-star-mini-shv-01-lhr6facebookcom
DNS

14.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.200.250.142.in-addr.arpa

IN PTR

Response

14.200.250.142.in-addr.arpa

IN PTR

lhr48s29-in-f141e100net
DNS

googleads.g.doubleclick.net

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

googleads.g.doubleclick.net

IN A

Response

googleads.g.doubleclick.net

IN A

142.250.180.2
DNS

googleads.g.doubleclick.net

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

googleads.g.doubleclick.net

IN A
GET

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20190131/zrt_lookup.html

IEXPLORE.EXE

Remote address:

142.250.180.2:443

Request

GET /pagead/html/r20231207/r20190131/zrt_lookup.html HTTP/2.0
host: googleads.g.doubleclick.net
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4646
x-xss-protection: 0
date: Sun, 24 Dec 2023 15:13:22 GMT
expires: Sun, 07 Jan 2024 15:13:22 GMT
cache-control: public, max-age=1209600
age: 57390
etag: 14902866265712643852
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5833429426495247&output=html&h=250&adk=2274729966&adf=2522063753&w=300&lmt=1702644185&ad_type=text&format=300x250_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&h_ch=00000&wgl=1&dt=1703488189913&bpp=643&bdt=25237&idt=931&shv=r20231207&mjsv=m202312070101&ptt=5&saldr=sd&abxe=1&correlator=2754853013066&frm=20&pv=2&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=167&ady=345&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=640&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=1&ifi=1&uci=a!1&dtd=1065

IEXPLORE.EXE

Remote address:

142.250.180.2:443

Request

GET /pagead/ads?client=ca-pub-5833429426495247&output=html&h=250&adk=2274729966&adf=2522063753&w=300&lmt=1702644185&ad_type=text&format=300x250_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&h_ch=00000&wgl=1&dt=1703488189913&bpp=643&bdt=25237&idt=931&shv=r20231207&mjsv=m202312070101&ptt=5&saldr=sd&abxe=1&correlator=2754853013066&frm=20&pv=2&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=167&ady=345&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=640&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=1&ifi=1&uci=a!1&dtd=1065 HTTP/2.0
host: googleads.g.doubleclick.net
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 25 Dec 2023 07:09:52 GMT
server: cafe
cache-control: private
content-length: 82
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 25-Dec-2023 07:24:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 25 Dec 2023 07:09:52 GMT
GET

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5833429426495247&output=html&h=280&slotname=0467005366&adk=2072393558&adf=3701054250&pi=t.ma~as.0467005366&w=336&lmt=1702644185&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&wgl=1&dt=1703488189948&bpp=611&bdt=25272&idt=1049&shv=r20231207&mjsv=m202312070101&ptt=5&saldr=sd&abxe=1&prev_fmts=300x250_as&correlator=2754853013066&frm=20&pv=1&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=746&ady=447&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=640&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=1&ifi=2&uci=a!2&dtd=1130

IEXPLORE.EXE

Remote address:

142.250.180.2:443

Request

GET /pagead/ads?client=ca-pub-5833429426495247&output=html&h=280&slotname=0467005366&adk=2072393558&adf=3701054250&pi=t.ma~as.0467005366&w=336&lmt=1702644185&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&wgl=1&dt=1703488189948&bpp=611&bdt=25272&idt=1049&shv=r20231207&mjsv=m202312070101&ptt=5&saldr=sd&abxe=1&prev_fmts=300x250_as&correlator=2754853013066&frm=20&pv=1&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=746&ady=447&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=640&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=1&ifi=2&uci=a!2&dtd=1130 HTTP/2.0
host: googleads.g.doubleclick.net
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 25 Dec 2023 07:09:52 GMT
server: cafe
cache-control: private
content-length: 82
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 25-Dec-2023 07:24:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 25 Dec 2023 07:09:52 GMT
GET

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5833429426495247&output=html&h=150&adk=1813603639&adf=494490898&w=180&lmt=1702644185&ad_type=text&format=180x150_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&h_ch=00000&wgl=1&dt=1703488189975&bpp=585&bdt=25299&idt=1109&shv=r20231207&mjsv=m202312070101&ptt=5&saldr=sd&abxe=1&prev_fmts=300x250_as&prev_slotnames=0467005366&correlator=2754853013066&pv_h_ch=00000&frm=20&pv=1&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=737&ady=1752&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=640&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=1&ifi=3&uci=a!3&btvi=1&dtd=1147

IEXPLORE.EXE

Remote address:

142.250.180.2:443

Request

GET /pagead/ads?client=ca-pub-5833429426495247&output=html&h=150&adk=1813603639&adf=494490898&w=180&lmt=1702644185&ad_type=text&format=180x150_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&h_ch=00000&wgl=1&dt=1703488189975&bpp=585&bdt=25299&idt=1109&shv=r20231207&mjsv=m202312070101&ptt=5&saldr=sd&abxe=1&prev_fmts=300x250_as&prev_slotnames=0467005366&correlator=2754853013066&pv_h_ch=00000&frm=20&pv=1&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=737&ady=1752&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=640&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=1&ifi=3&uci=a!3&btvi=1&dtd=1147 HTTP/2.0
host: googleads.g.doubleclick.net
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 400

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 25 Dec 2023 07:09:52 GMT
server: cafe
cache-control: private
content-length: 82
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 25-Dec-2023 07:24:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5833429426495247&output=html&h=280&adk=2498616092&adf=4132086549&w=336&lmt=1702644185&ad_type=text&format=336x280_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&h_ch=00000&wgl=1&dt=1703488190001&bpp=561&bdt=25325&idt=1131&shv=r20231207&mjsv=m202312070101&ptt=5&saldr=sd&abxe=1&prev_fmts=300x250_as%2C180x150_as&prev_slotnames=0467005366&correlator=2754853013066&pv_h_ch=00000&frm=20&pv=1&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=737&ady=21585&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=640&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=1&ifi=4&uci=a!4&btvi=2&dtd=1169

IEXPLORE.EXE

Remote address:

142.250.180.2:443

Request

GET /pagead/ads?client=ca-pub-5833429426495247&output=html&h=280&adk=2498616092&adf=4132086549&w=336&lmt=1702644185&ad_type=text&format=336x280_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&h_ch=00000&wgl=1&dt=1703488190001&bpp=561&bdt=25325&idt=1131&shv=r20231207&mjsv=m202312070101&ptt=5&saldr=sd&abxe=1&prev_fmts=300x250_as%2C180x150_as&prev_slotnames=0467005366&correlator=2754853013066&pv_h_ch=00000&frm=20&pv=1&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=737&ady=21585&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=640&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=1&ifi=4&uci=a!4&btvi=2&dtd=1169 HTTP/2.0
host: googleads.g.doubleclick.net
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 25 Dec 2023 07:09:52 GMT
server: cafe
cache-control: private
content-length: 82
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 25-Dec-2023 07:24:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 25 Dec 2023 07:09:52 GMT
GET

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5833429426495247&output=html&adk=1812271804&adf=3025194257&lmt=1702644185&plat=1%3A1049600%2C2%3A1049600%2C3%3A3145728%2C4%3A3145728%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&h_ch=00000&pra=7&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&dt=1703488192433&bpp=5&bdt=27769&idt=5&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250_as%2C180x150_as%2C336x280_as&prev_slotnames=0467005366&nras=1&correlator=2754853013066&pv_h_ch=00000&frm=20&pv=1&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&fsapi=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=896&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=1&ifi=5&uci=a!5&dtd=92

IEXPLORE.EXE

Remote address:

142.250.180.2:443

Request

GET /pagead/ads?client=ca-pub-5833429426495247&output=html&adk=1812271804&adf=3025194257&lmt=1702644185&plat=1%3A1049600%2C2%3A1049600%2C3%3A3145728%2C4%3A3145728%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&h_ch=00000&pra=7&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&dt=1703488192433&bpp=5&bdt=27769&idt=5&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250_as%2C180x150_as%2C336x280_as&prev_slotnames=0467005366&nras=1&correlator=2754853013066&pv_h_ch=00000&frm=20&pv=1&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&fsapi=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=896&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=1&ifi=5&uci=a!5&dtd=92 HTTP/2.0
host: googleads.g.doubleclick.net
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate
cookie: test_cookie=CheckForPermission

Response

HTTP/2.0 200

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 25 Dec 2023 07:09:54 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
set-cookie: IDE=AHWqTUm561LeSdvUL1Y-LX375sp70S2ZGhGBOMrVR3wddcqeXB50bt9mGRqG9uS0; expires=Sat, 18-Jan-2025 07:09:54 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 25 Dec 2023 07:09:54 GMT
cache-control: private
DNS

2.180.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.180.250.142.in-addr.arpa

IN PTR

Response

2.180.250.142.in-addr.arpa

IN PTR

lhr25s32-in-f21e100net
DNS

tpc.googlesyndication.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

tpc.googlesyndication.com

IN A

Response

tpc.googlesyndication.com

IN A

142.250.180.1
DNS

tpc.googlesyndication.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

tpc.googlesyndication.com

IN A
GET

https://tpc.googlesyndication.com/sodar/sodar2.js

IEXPLORE.EXE

Remote address:

142.250.180.1:443

Request

GET /sodar/sodar2.js HTTP/2.0
host: tpc.googlesyndication.com
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 6386
date: Mon, 25 Dec 2023 07:09:54 GMT
expires: Mon, 25 Dec 2023 07:09:54 GMT
cache-control: private, max-age=3000
etag: "1637097310169751"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

IEXPLORE.EXE

Remote address:

142.250.180.1:443

Request

GET /sodar/sodar2/225/runner.html HTTP/2.0
host: tpc.googlesyndication.com
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

accept-ranges: bytes
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 19 Dec 2023 00:06:12 GMT
expires: Wed, 18 Dec 2024 00:06:12 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
vary: Accept-Encoding
age: 543822
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://tpc.googlesyndication.com/generate_204?aJjMGw

IEXPLORE.EXE

Remote address:

142.250.180.1:443

Request

GET /generate_204?aJjMGw HTTP/2.0
host: tpc.googlesyndication.com
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 204

content-length: 0
cross-origin-resource-policy: cross-origin
date: Mon, 25 Dec 2023 07:09:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

www.google.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.200.4
GET

https://www.google.com/recaptcha/api2/aframe

IEXPLORE.EXE

Remote address:

142.250.200.4:443

Request

GET /recaptcha/api2/aframe HTTP/2.0
host: www.google.com
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate
cookie: NID=511=C9kpGCBxi0_yE9LNUDX6voEtalYv26dW7BOOTP79zM0_F1rMKltC9qm2P2fgydpa2Pi3_XcmFvA6flVATJ1TX-CpOlq_7hLLp35PtzHyd9Jc4dFv38VRodmB2xgD8EtfrKD0skgLh3HVzSD5UB012n3ZuYAAZeD_Bh8Wp9ESMHY

Response

HTTP/2.0 200

content-type: text/html; charset=utf-8
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 25 Dec 2023 07:09:54 GMT
date: Mon, 25 Dec 2023 07:09:54 GMT
cache-control: private, max-age=300
content-security-policy: script-src 'nonce-ryoIN5s1-JZBSAsQAX-2tg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

1.180.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.180.250.142.in-addr.arpa

IN PTR

Response

1.180.250.142.in-addr.arpa

IN PTR

lhr25s32-in-f11e100net
DNS

1.180.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.180.250.142.in-addr.arpa

IN PTR

Response

1.180.250.142.in-addr.arpa

IN PTR

lhr25s32-in-f11e100net
DNS

4.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

4.200.250.142.in-addr.arpa

IN PTR

Response

4.200.250.142.in-addr.arpa

IN PTR

lhr48s29-in-f41e100net
DNS

4.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

4.200.250.142.in-addr.arpa

IN PTR

Response

4.200.250.142.in-addr.arpa

IN PTR

lhr48s29-in-f41e100net
DNS

161.19.199.152.in-addr.arpa

Remote address:

8.8.8.8:53

Request

161.19.199.152.in-addr.arpa

IN PTR

Response
DNS

88.156.103.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.156.103.20.in-addr.arpa

IN PTR

Response
DNS

88.156.103.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.156.103.20.in-addr.arpa

IN PTR
DNS

88.156.103.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.156.103.20.in-addr.arpa

IN PTR
DNS

88.156.103.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.156.103.20.in-addr.arpa

IN PTR
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301208_1A8N3XLBQPT0ST5XU&pid=21.2&w=1920&h=1080&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301208_1A8N3XLBQPT0ST5XU&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 398619
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7950883403E546EA8E48CEA4C212ECE6 Ref B: LON04EDGE1208 Ref C: 2023-12-25T07:10:04Z
date: Mon, 25 Dec 2023 07:10:03 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301686_1KALYYHQJEHUB35MQ&pid=21.2&w=1080&h=1920&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301686_1KALYYHQJEHUB35MQ&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 134896
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 625676E9E41347CF8C07172D8BC37966 Ref B: LON04EDGE1208 Ref C: 2023-12-25T07:10:04Z
date: Mon, 25 Dec 2023 07:10:03 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301574_1UWGOWGCVXBKTWPY6&pid=21.2&w=1080&h=1920&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301574_1UWGOWGCVXBKTWPY6&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 324860
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 829AA6D2FE464DE3A81CE848E6C7C774 Ref B: LON04EDGE1208 Ref C: 2023-12-25T07:10:04Z
date: Mon, 25 Dec 2023 07:10:03 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301165_1KUW5FNYPDRFASY0O&pid=21.2&w=1920&h=1080&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301165_1KUW5FNYPDRFASY0O&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 431156
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8977BE682FB44B66ADC754D9110C2CCF Ref B: LON04EDGE1208 Ref C: 2023-12-25T07:10:05Z
date: Mon, 25 Dec 2023 07:10:04 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301277_1JYIIJ2WQ4YZYJI0A&pid=21.2&w=1920&h=1080&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301277_1JYIIJ2WQ4YZYJI0A&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 457679
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 77E8121AC3C34DF284EA94859B0FC3D6 Ref B: LON04EDGE1208 Ref C: 2023-12-25T07:10:05Z
date: Mon, 25 Dec 2023 07:10:04 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301617_1V543CFQPAISNVZHR&pid=21.2&w=1080&h=1920&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301617_1V543CFQPAISNVZHR&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
DNS

200.197.79.204.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.197.79.204.in-addr.arpa

IN PTR

Response

200.197.79.204.in-addr.arpa

IN PTR

a-0001a-msedgenet
DNS

32.134.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

32.134.221.88.in-addr.arpa

IN PTR

Response

32.134.221.88.in-addr.arpa

IN PTR

a88-221-134-32deploystaticakamaitechnologiescom
DNS

32.134.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

32.134.221.88.in-addr.arpa

IN PTR
DNS

173.178.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

173.178.17.96.in-addr.arpa

IN PTR

Response

173.178.17.96.in-addr.arpa

IN PTR

a96-17-178-173deploystaticakamaitechnologiescom
DNS

194.178.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

194.178.17.96.in-addr.arpa

IN PTR

Response

194.178.17.96.in-addr.arpa

IN PTR

a96-17-178-194deploystaticakamaitechnologiescom
DNS

79.121.231.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

79.121.231.20.in-addr.arpa

IN PTR

Response
DNS

8.173.189.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.173.189.20.in-addr.arpa

IN PTR

Response

138.91.171.81:80

104 B
2
172.217.16.226:80

http://pagead2.googlesyndication.com/pagead/show_ads.js

http

IEXPLORE.EXE

1.4kB
15.3kB
19
15

HTTP Request

GET http://pagead2.googlesyndication.com/pagead/show_ads.js

HTTP Response

200
172.217.16.226:80

pagead2.googlesyndication.com

IEXPLORE.EXE

242 B
144 B
5
3
216.58.212.201:443

www.blogger.com

tls, http2

IEXPLORE.EXE

1.1kB
5.1kB
16
11
216.58.212.201:443

www.blogger.com

tls, http2

IEXPLORE.EXE

1.6kB
5.1kB
18
11
142.250.179.238:443

apis.google.com

tls, http2

IEXPLORE.EXE

1.2kB
5.1kB
17
11
142.250.179.238:443

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.y0xCMa4KeeI.O/m=gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg/cb=gapi.loaded_0?le=scs

tls, http2

IEXPLORE.EXE

9.4kB
177.3kB
154
145

HTTP Request

GET https://apis.google.com/js/plusone.js

HTTP Response

200

HTTP Request

GET https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.y0xCMa4KeeI.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg/cb=gapi.loaded_0?le=scs

HTTP Request

GET https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.y0xCMa4KeeI.O/m=gapi_iframes,gapi_iframes_style_bubble/exm=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg/cb=gapi.loaded_1?le=scs

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://apis.google.com/js/platform:gapi.iframes.style.common.js

HTTP Response

200

HTTP Request

GET https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.y0xCMa4KeeI.O/m=gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg/cb=gapi.loaded_0?le=scs

HTTP Response

200
142.250.200.33:80

http://3.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9RFQ1NI/AAAAAAAAAl4/CGutZDjYQGA/s1600/bgtabright.gif

http

IEXPLORE.EXE

1.8kB
9.5kB
16
12

HTTP Request

GET http://3.bp.blogspot.com/_V-IXTBBt1Bg/SV_M-3buH9I/AAAAAAAAAnA/RPg5dIPG8Ks/s1600/grabrss.gif

HTTP Response

200

HTTP Request

GET http://3.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9RFQ1NI/AAAAAAAAAl4/CGutZDjYQGA/s1600/bgtabright.gif

HTTP Response

200
142.250.200.33:80

3.bp.blogspot.com

IEXPLORE.EXE

334 B
224 B
7
5
216.58.212.201:443

https://www.blogger.com/navbar.g?targetBlogID=929093624394547178&blogName=kpss+2010+KPSS+SONU%C3%87LARI+KPSS+SINAV+S...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://2010-kpss.blogspot.com/search&blogLocale=tr&v=2&homepageUrl=http://2010-kpss.blogspot.com/&vt=8291138887576160719&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.y0xCMa4KeeI.O%2Fd%3D1%2Frs%3DAHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg%2Fm%3D__features__

tls, http2

IEXPLORE.EXE

6.2kB
76.0kB
83
72

HTTP Request

GET https://www.blogger.com/static/v1/widgets/1258645123-widgets.js

HTTP Request

GET https://www.blogger.com/static/v1/widgets/204402360-widget_css_bundle.css

HTTP Request

GET https://www.blogger.com/dyn-css/authorization.css?targetBlogID=929093624394547178&zx=cf23e931-bbc3-491f-88ae-ec12c2f8e753

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://www.blogger.com/navbar.g?targetBlogID=929093624394547178&blogName=kpss+2010+KPSS+SONU%C3%87LARI+KPSS+SINAV+S...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://2010-kpss.blogspot.com/search&blogLocale=tr&v=2&homepageUrl=http://2010-kpss.blogspot.com/&vt=8291138887576160719&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.y0xCMa4KeeI.O%2Fd%3D1%2Frs%3DAHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg%2Fm%3D__features__

HTTP Response

200
18.66.248.101:80

http://i254.photobucket.com/albums/hh92/eblogtemplates/wppremium/button-submit.gif

http

IEXPLORE.EXE

708 B
1.5kB
8
5

HTTP Request

GET http://i254.photobucket.com/albums/hh92/eblogtemplates/wppremium/button-submit.gif

HTTP Response

301
18.66.248.101:80

i254.photobucket.com

IEXPLORE.EXE

466 B
92 B
10
2
18.66.248.101:443

https://i254.photobucket.com/albums/hh92/eblogtemplates/wppremium/button-submit.gif

tls, http2

IEXPLORE.EXE

1.4kB
7.9kB
18
12

HTTP Request

GET https://i254.photobucket.com/albums/hh92/eblogtemplates/wppremium/button-submit.gif

HTTP Response

200
104.17.98.108:80

http://static.getclicky.com/39600.js

http

IEXPLORE.EXE

628 B
798 B
8
5

HTTP Request

GET http://static.getclicky.com/39600.js

HTTP Response

200
104.17.98.108:80

http://static.getclicky.com/media/links/badge.gif

http

IEXPLORE.EXE

623 B
866 B
7
4

HTTP Request

GET http://static.getclicky.com/media/links/badge.gif

HTTP Response

200
167.99.249.92:80

http://www.adobetutorialz.com/content_images/AdobePhotoshop/ART-D/tutorial361/abstract-art-wallpaper.jpg

http

IEXPLORE.EXE

776 B
990 B
9
7

HTTP Request

GET http://www.adobetutorialz.com/content_images/AdobePhotoshop/ART-D/tutorial361/abstract-art-wallpaper.jpg

HTTP Response

301
167.99.249.92:80

www.adobetutorialz.com

IEXPLORE.EXE

288 B
144 B
6
3
172.217.16.226:445

pagead2.googlesyndication.com

260 B
5
167.99.249.92:80

http://designstacks.net/content_images/AdobePhotoshop/ART-D/tutorial361/abstract-art-wallpaper.jpg

http

IEXPLORE.EXE

10.2kB
264.8kB
202
193

HTTP Request

GET http://designstacks.net/content_images/AdobePhotoshop/ART-D/tutorial361/abstract-art-wallpaper.jpg

HTTP Response

200
167.99.249.92:80

designstacks.net

IEXPLORE.EXE

392 B
248 B
8
5
142.250.178.2:139

pagead2.googlesyndication.com

260 B
5
163.70.147.35:443

www.facebook.com

tls, http2

IEXPLORE.EXE

1.2kB
4.0kB
16
13
163.70.147.35:443

https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FErdem-%25C3%2587etinkaya%2F227636807249546&layout=standard&show_faces=true&width=53&action=like&colorscheme=light&height=80

tls, http2

IEXPLORE.EXE

1.7kB
5.8kB
20
16

HTTP Request

GET https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FErdem-%25C3%2587etinkaya%2F227636807249546&layout=standard&show_faces=true&width=53&action=like&colorscheme=light&height=80

HTTP Response

200
142.250.200.33:80

2.bp.blogspot.com

IEXPLORE.EXE

236 B
92 B
5
2
142.250.200.33:80

http://2.bp.blogspot.com/_V-IXTBBt1Bg/SV_M-Fyw7bI/AAAAAAAAAmQ/l7LqIMqEFHI/s1600/bullet.gif

http

IEXPLORE.EXE

1.5kB
3.2kB
11
7

HTTP Request

GET http://2.bp.blogspot.com/_V-IXTBBt1Bg/SV_M_VCHipI/AAAAAAAAAnY/qmH8mq7CBL0/s1600/search.gif

HTTP Response

200

HTTP Request

GET http://2.bp.blogspot.com/_V-IXTBBt1Bg/SV_M-Fyw7bI/AAAAAAAAAmQ/l7LqIMqEFHI/s1600/bullet.gif

HTTP Response

200
142.250.200.33:80

http://3.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9cZEfLI/AAAAAAAAAlo/OjLZBsmO58k/s1600/bgsidebartop.gif

http

IEXPLORE.EXE

1.2kB
2.5kB
10
6

HTTP Request

GET http://3.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9cZEfLI/AAAAAAAAAlo/OjLZBsmO58k/s1600/bgsidebartop.gif

HTTP Response

200
142.250.200.33:80

http://3.bp.blogspot.com/_V-IXTBBt1Bg/SV_M_n7PTiI/AAAAAAAAAno/uT3hiA5CFqg/s1600/welcome.gif

http

IEXPLORE.EXE

809 B
3.0kB
10
7

HTTP Request

GET http://3.bp.blogspot.com/_V-IXTBBt1Bg/SV_M_n7PTiI/AAAAAAAAAno/uT3hiA5CFqg/s1600/welcome.gif

HTTP Response

200
142.250.200.33:80

http://1.bp.blogspot.com/_V-IXTBBt1Bg/SV_M8WaWScI/AAAAAAAAAlQ/Kje282DfIV8/s1600/bgbottom.gif

http

IEXPLORE.EXE

1.5kB
2.2kB
11
6

HTTP Request

GET http://1.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9TQCNNI/AAAAAAAAAlw/6es62Wp0AMw/s1600/bgtableft.gif

HTTP Response

200

HTTP Request

GET http://1.bp.blogspot.com/_V-IXTBBt1Bg/SV_M8WaWScI/AAAAAAAAAlQ/Kje282DfIV8/s1600/bgbottom.gif

HTTP Response

200
142.250.200.33:80

4.bp.blogspot.com

IEXPLORE.EXE

288 B
92 B
6
2
142.250.200.33:80

http://4.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9NiqR8I/AAAAAAAAAlg/QJjPriINkoM/s1600/bgsidebarbottom.gif

http

IEXPLORE.EXE

725 B
931 B
8
4

HTTP Request

GET http://4.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9NiqR8I/AAAAAAAAAlg/QJjPriINkoM/s1600/bgsidebarbottom.gif

HTTP Response

200
142.250.200.33:80

http://4.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9qRErpI/AAAAAAAAAmA/1SbWs0APbHY/s1600/bgtop.gif

http

IEXPLORE.EXE

1.1kB
2.0kB
10
6

HTTP Request

GET http://4.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9zXzfQI/AAAAAAAAAmI/NHt3d7rOVQk/s1600/bgtopwhite.gif

HTTP Response

200

HTTP Request

GET http://4.bp.blogspot.com/_V-IXTBBt1Bg/SV_M9qRErpI/AAAAAAAAAmA/1SbWs0APbHY/s1600/bgtop.gif

HTTP Response

200
142.250.200.33:80

http://4.bp.blogspot.com/_V-IXTBBt1Bg/SV_M8pUsZdI/AAAAAAAAAlY/9cYigXl6uiw/s1600/bgbottomwhite.gif

http

IEXPLORE.EXE

1.2kB
3.3kB
11
7

HTTP Request

GET http://4.bp.blogspot.com/_V-IXTBBt1Bg/SV_M_iAENqI/AAAAAAAAAng/EgFs037bOAI/s1600/sidebar_h2.gif

HTTP Response

200

HTTP Request

GET http://4.bp.blogspot.com/_V-IXTBBt1Bg/SV_M8pUsZdI/AAAAAAAAAlY/9cYigXl6uiw/s1600/bgbottomwhite.gif

HTTP Response

200
142.250.180.2:443

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5833429426495247&output=html&adk=1812271804&adf=3025194257&lmt=1702644185&plat=1%3A1049600%2C2%3A1049600%2C3%3A3145728%2C4%3A3145728%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&h_ch=00000&pra=7&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&dt=1703488192433&bpp=5&bdt=27769&idt=5&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250_as%2C180x150_as%2C336x280_as&prev_slotnames=0467005366&nras=1&correlator=2754853013066&pv_h_ch=00000&frm=20&pv=1&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&fsapi=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=896&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=1&ifi=5&uci=a!5&dtd=92

tls, http2

IEXPLORE.EXE

10.5kB
15.1kB
50
40

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/html/r20231207/r20190131/zrt_lookup.html

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5833429426495247&output=html&h=250&adk=2274729966&adf=2522063753&w=300&lmt=1702644185&ad_type=text&format=300x250_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&h_ch=00000&wgl=1&dt=1703488189913&bpp=643&bdt=25237&idt=931&shv=r20231207&mjsv=m202312070101&ptt=5&saldr=sd&abxe=1&correlator=2754853013066&frm=20&pv=2&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=167&ady=345&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=640&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=1&ifi=1&uci=a!1&dtd=1065

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5833429426495247&output=html&h=280&slotname=0467005366&adk=2072393558&adf=3701054250&pi=t.ma~as.0467005366&w=336&lmt=1702644185&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&wgl=1&dt=1703488189948&bpp=611&bdt=25272&idt=1049&shv=r20231207&mjsv=m202312070101&ptt=5&saldr=sd&abxe=1&prev_fmts=300x250_as&correlator=2754853013066&frm=20&pv=1&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=746&ady=447&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=640&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=1&ifi=2&uci=a!2&dtd=1130

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5833429426495247&output=html&h=150&adk=1813603639&adf=494490898&w=180&lmt=1702644185&ad_type=text&format=180x150_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&h_ch=00000&wgl=1&dt=1703488189975&bpp=585&bdt=25299&idt=1109&shv=r20231207&mjsv=m202312070101&ptt=5&saldr=sd&abxe=1&prev_fmts=300x250_as&prev_slotnames=0467005366&correlator=2754853013066&pv_h_ch=00000&frm=20&pv=1&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=737&ady=1752&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=640&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=1&ifi=3&uci=a!3&btvi=1&dtd=1147

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5833429426495247&output=html&h=280&adk=2498616092&adf=4132086549&w=336&lmt=1702644185&ad_type=text&format=336x280_as&color_bg=FFFFFF&color_border=FFFFFF&color_link=0000FF&color_text=000000&color_url=008000&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&h_ch=00000&wgl=1&dt=1703488190001&bpp=561&bdt=25325&idt=1131&shv=r20231207&mjsv=m202312070101&ptt=5&saldr=sd&abxe=1&prev_fmts=300x250_as%2C180x150_as&prev_slotnames=0467005366&correlator=2754853013066&pv_h_ch=00000&frm=20&pv=1&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=737&ady=21585&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=640&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=1&ifi=4&uci=a!4&btvi=2&dtd=1169

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

400

HTTP Response

200

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5833429426495247&output=html&adk=1812271804&adf=3025194257&lmt=1702644185&plat=1%3A1049600%2C2%3A1049600%2C3%3A3145728%2C4%3A3145728%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=file%3A%2F%2FC%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C1a38bb88e1347d5149b23008d3dc1342.html&ea=0&host=pub-1556223355139109&h_ch=00000&pra=7&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&dt=1703488192433&bpp=5&bdt=27769&idt=5&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250_as%2C180x150_as%2C336x280_as&prev_slotnames=0467005366&nras=1&correlator=2754853013066&pv_h_ch=00000&frm=20&pv=1&ga_vid=1946688251.1703488190&ga_sid=1703488190&ga_hid=349195725&ga_fc=1&u_tz=0&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1263&bih=602&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42532524%2C95320885&oid=2&pvsid=1797752566062448&tmod=1265379620&nvt=1&fsapi=1&top=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F1a38bb88e1347d5149b23008d3dc1342.html&fc=896&docm=11&brdim=0%2C78%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C1280%2C602&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=1&ifi=5&uci=a!5&dtd=92

HTTP Response

200
142.250.180.2:443

googleads.g.doubleclick.net

tls, http2

IEXPLORE.EXE

1.8kB
5.8kB
21
13
142.250.180.1:443

https://tpc.googlesyndication.com/generate_204?aJjMGw

tls, http2

IEXPLORE.EXE

2.8kB
18.7kB
37
30

HTTP Request

GET https://tpc.googlesyndication.com/sodar/sodar2.js

HTTP Response

200

HTTP Request

GET https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

HTTP Response

200

HTTP Request

GET https://tpc.googlesyndication.com/generate_204?aJjMGw

HTTP Response

204
142.250.180.1:443

tpc.googlesyndication.com

tls, http2

IEXPLORE.EXE

1.4kB
5.1kB
17
11
142.250.200.4:443

www.google.com

tls, http2

IEXPLORE.EXE

1.4kB
5.1kB
17
11
142.250.200.4:443

https://www.google.com/recaptcha/api2/aframe

tls, http2

IEXPLORE.EXE

2.0kB
6.9kB
24
17

HTTP Request

GET https://www.google.com/recaptcha/api2/aframe

HTTP Response

200
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.8kB
8.2kB
17
11
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.4kB
8.3kB
16
14
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.1kB
8.2kB
13
12
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.5kB
573 B
12
7
204.79.197.200:443

https://tse1.mm.bing.net/th?id=OADD2.10239317301617_1V543CFQPAISNVZHR&pid=21.2&w=1080&h=1920&c=4

tls, http2

51.8kB
1.5MB
1065
1057

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301208_1A8N3XLBQPT0ST5XU&pid=21.2&w=1920&h=1080&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301686_1KALYYHQJEHUB35MQ&pid=21.2&w=1080&h=1920&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301574_1UWGOWGCVXBKTWPY6&pid=21.2&w=1080&h=1920&c=4

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301165_1KUW5FNYPDRFASY0O&pid=21.2&w=1920&h=1080&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301277_1JYIIJ2WQ4YZYJI0A&pid=21.2&w=1920&h=1080&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301617_1V543CFQPAISNVZHR&pid=21.2&w=1080&h=1920&c=4

HTTP Response

200

HTTP Response

200
204.79.197.200:443

ieonline.microsoft.com

tls, http2

iexplore.exe

1.2kB
9.7kB
16
15

8.8.8.8:53

23.181.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

23.181.190.20.in-addr.arpa
8.8.8.8:53

2.136.104.51.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

2.136.104.51.in-addr.arpa
8.8.8.8:53

apis.google.com

dns

IEXPLORE.EXE

61 B
98 B
1
1

DNS Request

apis.google.com

DNS Response

142.250.179.238
8.8.8.8:53

www.blogger.com

dns

IEXPLORE.EXE

61 B
108 B
1
1

DNS Request

www.blogger.com

DNS Response

216.58.212.201
8.8.8.8:53

3.bp.blogspot.com

dns

IEXPLORE.EXE

63 B
124 B
1
1

DNS Request

3.bp.blogspot.com

DNS Response

142.250.200.33
8.8.8.8:53

i254.photobucket.com

dns

IEXPLORE.EXE

66 B
130 B
1
1

DNS Request

i254.photobucket.com

DNS Response

18.66.248.101

18.66.248.107

18.66.248.28

18.66.248.13
8.8.8.8:53

static.getclicky.com

dns

IEXPLORE.EXE

132 B
98 B
2
1

DNS Request

static.getclicky.com

DNS Request

static.getclicky.com

DNS Response

104.17.98.108

104.17.97.108
8.8.8.8:53

201.212.58.216.in-addr.arpa

dns

73 B
171 B
1
1

DNS Request

201.212.58.216.in-addr.arpa
8.8.8.8:53

238.179.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

238.179.250.142.in-addr.arpa
8.8.8.8:53

101.248.66.18.in-addr.arpa

dns

72 B
129 B
1
1

DNS Request

101.248.66.18.in-addr.arpa
8.8.8.8:53

226.16.217.172.in-addr.arpa

dns

73 B
140 B
1
1

DNS Request

226.16.217.172.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

35.200.250.142.in-addr.arpa

dns

73 B
111 B
1
1

DNS Request

35.200.250.142.in-addr.arpa
8.8.8.8:53

33.200.250.142.in-addr.arpa

dns

73 B
111 B
1
1

DNS Request

33.200.250.142.in-addr.arpa
8.8.8.8:53

108.98.17.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

108.98.17.104.in-addr.arpa
8.8.8.8:53

241.154.82.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.154.82.20.in-addr.arpa
8.8.8.8:53

55.36.223.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

55.36.223.20.in-addr.arpa
8.8.8.8:53

www.adobetutorialz.com

dns

IEXPLORE.EXE

68 B
84 B
1
1

DNS Request

www.adobetutorialz.com

DNS Response

167.99.249.92
8.8.8.8:53

designstacks.net

dns

IEXPLORE.EXE

62 B
78 B
1
1

DNS Request

designstacks.net

DNS Response

167.99.249.92
8.8.8.8:53

92.249.99.167.in-addr.arpa

dns

72 B
139 B
1
1

DNS Request

92.249.99.167.in-addr.arpa
8.8.8.8:53

41.110.16.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

41.110.16.96.in-addr.arpa
8.8.8.8:53

143.226.173.18.in-addr.arpa

dns

146 B
131 B
2
1

DNS Request

143.226.173.18.in-addr.arpa

DNS Request

143.226.173.18.in-addr.arpa
8.8.8.8:53

86.23.85.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

86.23.85.13.in-addr.arpa
8.8.8.8:53

27.62.154.18.in-addr.arpa

dns

71 B
127 B
1
1

DNS Request

27.62.154.18.in-addr.arpa
8.8.8.8:53

15.164.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

15.164.165.52.in-addr.arpa
8.8.8.8:53

146.78.124.51.in-addr.arpa

dns

144 B
316 B
2
2

DNS Request

146.78.124.51.in-addr.arpa

DNS Request

146.78.124.51.in-addr.arpa
8.8.8.8:53

104.241.123.92.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

104.241.123.92.in-addr.arpa
8.8.8.8:53

119.110.54.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

119.110.54.20.in-addr.arpa
8.8.8.8:53

www.facebook.com

dns

IEXPLORE.EXE

124 B
107 B
2
1

DNS Request

www.facebook.com

DNS Request

www.facebook.com

DNS Response

163.70.147.35
8.8.8.8:53

2.bp.blogspot.com

dns

IEXPLORE.EXE

63 B
124 B
1
1

DNS Request

2.bp.blogspot.com

DNS Response

142.250.200.33
8.8.8.8:53

1.bp.blogspot.com

dns

IEXPLORE.EXE

63 B
124 B
1
1

DNS Request

1.bp.blogspot.com

DNS Response

142.250.200.33
8.8.8.8:53

4.bp.blogspot.com

dns

IEXPLORE.EXE

63 B
124 B
1
1

DNS Request

4.bp.blogspot.com

DNS Response

142.250.200.33
8.8.8.8:53

srv.sayyac.com

dns

IEXPLORE.EXE

180 B
180 B
3
3

DNS Request

srv.sayyac.com

DNS Request

srv.sayyac.com

DNS Request

srv.sayyac.com
8.8.8.8:53

35.147.70.163.in-addr.arpa

dns

72 B
125 B
1
1

DNS Request

35.147.70.163.in-addr.arpa
8.8.8.8:53

14.200.250.142.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

14.200.250.142.in-addr.arpa
8.8.8.8:53

googleads.g.doubleclick.net

dns

IEXPLORE.EXE

146 B
89 B
2
1

DNS Request

googleads.g.doubleclick.net

DNS Request

googleads.g.doubleclick.net

DNS Response

142.250.180.2
8.8.8.8:53

2.180.250.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

2.180.250.142.in-addr.arpa
8.8.8.8:53

tpc.googlesyndication.com

dns

IEXPLORE.EXE

142 B
87 B
2
1

DNS Request

tpc.googlesyndication.com

DNS Request

tpc.googlesyndication.com

DNS Response

142.250.180.1
8.8.8.8:53

www.google.com

dns

IEXPLORE.EXE

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

142.250.200.4
8.8.8.8:53

1.180.250.142.in-addr.arpa

dns

144 B
220 B
2
2

DNS Request

1.180.250.142.in-addr.arpa

DNS Request

1.180.250.142.in-addr.arpa
8.8.8.8:53

4.200.250.142.in-addr.arpa

dns

144 B
220 B
2
2

DNS Request

4.200.250.142.in-addr.arpa

DNS Request

4.200.250.142.in-addr.arpa
8.8.8.8:53

161.19.199.152.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

161.19.199.152.in-addr.arpa
8.8.8.8:53

88.156.103.20.in-addr.arpa

dns

288 B
158 B
4
1

DNS Request

88.156.103.20.in-addr.arpa

DNS Request

88.156.103.20.in-addr.arpa

DNS Request

88.156.103.20.in-addr.arpa

DNS Request

88.156.103.20.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

62 B
173 B
1
1

DNS Request

tse1.mm.bing.net

DNS Response

204.79.197.200

13.107.21.200
8.8.8.8:53

200.197.79.204.in-addr.arpa

dns

73 B
106 B
1
1

DNS Request

200.197.79.204.in-addr.arpa
8.8.8.8:53

32.134.221.88.in-addr.arpa

dns

144 B
137 B
2
1

DNS Request

32.134.221.88.in-addr.arpa

DNS Request

32.134.221.88.in-addr.arpa
8.8.8.8:53

173.178.17.96.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

173.178.17.96.in-addr.arpa
8.8.8.8:53

194.178.17.96.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

194.178.17.96.in-addr.arpa
8.8.8.8:53

79.121.231.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

79.121.231.20.in-addr.arpa
8.8.8.8:53

8.173.189.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

8.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verF879.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BUOTXRX9\f[1].txt

Filesize
34KB

MD5
3e47ef57df160664693a84aa6943a9c3

SHA1
2770e2c7f0b1f5d1b7210ec273d88f49ed5a416e

SHA256
a490f649cd5ef6c02a82668a15d665adc34ffc7a94979bc2edb89505df28da26

SHA512
904687d537bc0c935b6b98c2ff77d48a0f7b59d1f4380cd9f1113214b698b8e91842ed89272745779a92896c2a2866b67734f6eb1255e9c9fe54ccd0e7d0909f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FRK3R5YS\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J6M39GIU\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J6M39GIU\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request