c2373a700b569e301e66a226690c5cbfaf3bfcb0b853977162bfcd1aeed0e1a3

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 10:50 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e49ff6acb54132a68343a8854bc819b_JaffaCakes118.html
Size

33KB
MD5

0e49ff6acb54132a68343a8854bc819b
SHA1

861d649a463e097eccd551034f386a5ae462b00f
SHA256

c2373a700b569e301e66a226690c5cbfaf3bfcb0b853977162bfcd1aeed0e1a3
SHA512

71d8eb6281ecb6331b33300871c778f11a0dc67b1db44c992a447fef8bb9b88a96b381b9610eee2b7568a2d8a15bf3ca88767bd36385708cef7d231a4ed72f2c
SSDEEP

768:1Hp8YRfy3c18ETWgoFrylpDgEgMKO0OkO4ZWGVGJKaCNGUK6lgFXtvUCNUtpzL:n9Rfqc18ETWgoFrylpDgEgMKO0OkO4ZB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
3684	msedge.exe
3684	msedge.exe
3540	identity_helper.exe
3540	identity_helper.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 2312	3684	msedge.exe	85
PID 3684 wrote to memory of 2312	3684	msedge.exe	85
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 3468	3684	msedge.exe	86
PID 3684 wrote to memory of 4408	3684	msedge.exe	87
PID 3684 wrote to memory of 4408	3684	msedge.exe	87
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88
PID 3684 wrote to memory of 1432	3684	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0e49ff6acb54132a68343a8854bc819b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff873f446f8,0x7ff873f44708,0x7ff873f44718
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,16637488484512905,13521448008257851219,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,16637488484512905,13521448008257851219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,16637488484512905,13521448008257851219,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16637488484512905,13521448008257851219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16637488484512905,13521448008257851219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16637488484512905,13521448008257851219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,16637488484512905,13521448008257851219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,16637488484512905,13521448008257851219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16637488484512905,13521448008257851219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16637488484512905,13521448008257851219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16637488484512905,13521448008257851219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16637488484512905,13521448008257851219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,16637488484512905,13521448008257851219,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

Network

DNS

www.youtube.com

msedge.exe

Remote address:

8.8.8.8:53

Request

www.youtube.com

IN A

Response

www.youtube.com

IN CNAME

youtube-ui.l.google.com

youtube-ui.l.google.com

IN A

172.217.169.46

youtube-ui.l.google.com

IN A

142.250.179.238

youtube-ui.l.google.com

IN A

142.250.180.14

youtube-ui.l.google.com

IN A

142.250.187.206

youtube-ui.l.google.com

IN A

142.250.187.238

youtube-ui.l.google.com

IN A

142.250.178.14

youtube-ui.l.google.com

IN A

172.217.16.238

youtube-ui.l.google.com

IN A

142.250.200.14

youtube-ui.l.google.com

IN A

142.250.200.46

youtube-ui.l.google.com

IN A

216.58.201.110

youtube-ui.l.google.com

IN A

216.58.204.78

youtube-ui.l.google.com

IN A

216.58.213.14

youtube-ui.l.google.com

IN A

172.217.169.14

youtube-ui.l.google.com

IN A

216.58.212.238
GET

https://www.youtube.com/embed/HhAcHB1S2K0

msedge.exe

Remote address:

172.217.169.46:443

Request

GET /embed/HhAcHB1S2K0 HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.youtube.com/embed/ZpbIpFoR6rw

msedge.exe

Remote address:

172.217.169.46:443

Request

GET /embed/ZpbIpFoR6rw HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.youtube.com/embed/eWtmKMq16WE

msedge.exe

Remote address:

172.217.169.46:443

Request

GET /embed/eWtmKMq16WE HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.youtube.com/s/player/8fc6998a/www-player.css

msedge.exe

Remote address:

172.217.169.46:443

Request

GET /s/player/8fc6998a/www-player.css HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://www.youtube.com/embed/eWtmKMq16WE
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.youtube.com/s/player/8fc6998a/player_ias.vflset/en_US/embed.js

msedge.exe

Remote address:

172.217.169.46:443

Request

GET /s/player/8fc6998a/player_ias.vflset/en_US/embed.js HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.youtube.com/embed/eWtmKMq16WE
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.youtube.com/s/player/8fc6998a/www-embed-player.vflset/www-embed-player.js

msedge.exe

Remote address:

172.217.169.46:443

Request

GET /s/player/8fc6998a/www-embed-player.vflset/www-embed-player.js HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.youtube.com/embed/eWtmKMq16WE
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.youtube.com/s/player/8fc6998a/player_ias.vflset/en_US/base.js

msedge.exe

Remote address:

172.217.169.46:443

Request

GET /s/player/8fc6998a/player_ias.vflset/en_US/base.js HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.youtube.com/embed/eWtmKMq16WE
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

netdna.bootstrapcdn.com

msedge.exe

Remote address:

8.8.8.8:53

Request

netdna.bootstrapcdn.com

IN A

Response

netdna.bootstrapcdn.com

IN A

104.18.11.207

netdna.bootstrapcdn.com

IN A

104.18.10.207
DNS

code.jquery.com

msedge.exe

Remote address:

8.8.8.8:53

Request

code.jquery.com

IN A

Response

code.jquery.com

IN A

151.101.130.137

code.jquery.com

IN A

151.101.194.137

code.jquery.com

IN A

151.101.66.137

code.jquery.com

IN A

151.101.2.137
GET

http://code.jquery.com/jquery-latest.js

msedge.exe

Remote address:

151.101.130.137:80

Request

GET /jquery-latest.js HTTP/1.1
Host: code.jquery.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 83875
Server: nginx
Content-Type: application/javascript; charset=utf-8
Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT
ETag: W/"28feccc0-4508e"
Cache-Control: public, max-age=31536000, stale-while-revalidate=604800
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Thu, 02 May 2024 10:50:12 GMT
Age: 19844805
X-Served-By: cache-lga21958-LGA, cache-lcy-eglc8600060-LCY
X-Cache: HIT, HIT
X-Cache-Hits: 742, 378
X-Timer: S1714647012.497642,VS0,VE0
Vary: Accept-Encoding
GET

http://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css

msedge.exe

Remote address:

104.18.11.207:80

Request

GET /font-awesome/3.1.1/css/font-awesome.css HTTP/1.1
Host: netdna.bootstrapcdn.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Date: Thu, 02 May 2024 10:50:12 GMT
Content-Type: text/css; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
CDN-PullZone: 252412
CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74
CDN-RequestCountryCode: FR
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31919000
Content-Encoding: gzip
ETag: W/"bbd098fc6d8263878a58191b4b45e7a6"
Last-Modified: Mon, 25 Jan 2021 22:04:50 GMT
CDN-CachedAt: 10/31/2023 20:35:35
CDN-ProxyVer: 1.04
CDN-RequestPullCode: 200
CDN-RequestPullSuccess: True
CDN-EdgeStorageId: 947
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
X-Content-Type-Options: nosniff
CDN-Status: 200
CDN-RequestId: 86169579c8b79330329d3f4676b13baf
CDN-Cache: HIT
CF-Cache-Status: HIT
Age: 3868826
Server: cloudflare
CF-RAY: 87d772f41c556337-LHR
alt-svc: h3=":443"; ma=86400
DNS

i.ytimg.com

msedge.exe

Remote address:

8.8.8.8:53

Request

i.ytimg.com

IN A

Response

i.ytimg.com

IN A

216.58.201.118

i.ytimg.com

IN A

216.58.204.86

i.ytimg.com

IN A

216.58.213.22

i.ytimg.com

IN A

216.58.212.246

i.ytimg.com

IN A

172.217.169.86

i.ytimg.com

IN A

172.217.169.54

i.ytimg.com

IN A

142.250.179.246

i.ytimg.com

IN A

142.250.180.22

i.ytimg.com

IN A

142.250.187.214

i.ytimg.com

IN A

142.250.187.246

i.ytimg.com

IN A

142.250.178.22

i.ytimg.com

IN A

172.217.16.246

i.ytimg.com

IN A

142.250.200.22

i.ytimg.com

IN A

142.250.200.54
GET

https://i.ytimg.com/vi_webp/eWtmKMq16WE/sddefault.webp

msedge.exe

Remote address:

216.58.201.118:443

Request

GET /vi_webp/eWtmKMq16WE/sddefault.webp HTTP/2.0
host: i.ytimg.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://i.ytimg.com/vi/ZpbIpFoR6rw/sddefault.jpg

msedge.exe

Remote address:

216.58.201.118:443

Request

GET /vi/ZpbIpFoR6rw/sddefault.jpg HTTP/2.0
host: i.ytimg.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://i.ytimg.com/vi_webp/HhAcHB1S2K0/sddefault.webp

msedge.exe

Remote address:

216.58.201.118:443

Request

GET /vi_webp/HhAcHB1S2K0/sddefault.webp HTTP/2.0
host: i.ytimg.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

http://netdna.bootstrapcdn.com/font-awesome/3.1.1/font/fontawesome-webfont.woff?v=3.1.0

msedge.exe

Remote address:

104.18.11.207:80

Request

GET /font-awesome/3.1.1/font/fontawesome-webfont.woff?v=3.1.0 HTTP/1.1
Host: netdna.bootstrapcdn.com
Connection: keep-alive
Origin: null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: */*
Referer: http://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Date: Thu, 02 May 2024 10:50:13 GMT
Content-Type: font/woff
Content-Length: 34420
Connection: keep-alive
CDN-PullZone: 252412
CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74
CDN-RequestCountryCode: FR
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31919000
ETag: "9434b081ed2d237abfe96e832592ef15"
Last-Modified: Mon, 25 Jan 2021 22:04:51 GMT
CDN-CachedAt: 02/05/2024 16:20:42
CDN-ProxyVer: 1.04
CDN-RequestPullCode: 200
CDN-RequestPullSuccess: True
CDN-EdgeStorageId: 1187
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
X-Content-Type-Options: nosniff
CDN-Status: 200
CDN-RequestId: e97b812131efe6abe68b71167b2bf192
CDN-Cache: HIT
CF-Cache-Status: HIT
Age: 3533351
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87d772f7ccb963cb-LHR
alt-svc: h3=":443"; ma=86400
DNS

counter.yadro.ru

Remote address:

8.8.8.8:53

Request

counter.yadro.ru

IN A

Response

counter.yadro.ru

IN A

88.212.201.198

counter.yadro.ru

IN A

88.212.201.204

counter.yadro.ru

IN A

88.212.202.52
DNS

149.220.183.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

149.220.183.52.in-addr.arpa

IN PTR

Response
DNS

79.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

79.190.18.2.in-addr.arpa

IN PTR

Response

79.190.18.2.in-addr.arpa

IN PTR

a2-18-190-79deploystaticakamaitechnologiescom
DNS

20.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

20.160.190.20.in-addr.arpa

IN PTR

Response
DNS

46.169.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

46.169.217.172.in-addr.arpa

IN PTR

Response

46.169.217.172.in-addr.arpa

IN PTR

lhr48s08-in-f141e100net
DNS

137.130.101.151.in-addr.arpa

Remote address:

8.8.8.8:53

Request

137.130.101.151.in-addr.arpa

IN PTR

Response
DNS

207.11.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

207.11.18.104.in-addr.arpa

IN PTR

Response
DNS

118.201.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

118.201.58.216.in-addr.arpa

IN PTR

Response

118.201.58.216.in-addr.arpa

IN PTR

prg03s02-in-f1181e100net

118.201.58.216.in-addr.arpa

IN PTR

prg03s02-in-f22�J

118.201.58.216.in-addr.arpa

IN PTR

lhr48s48-in-f22�J
DNS

googleads.g.doubleclick.net

msedge.exe

Remote address:

8.8.8.8:53

Request

googleads.g.doubleclick.net

IN A

Response

googleads.g.doubleclick.net

IN A

216.58.213.2
GET

https://googleads.g.doubleclick.net/pagead/id

msedge.exe

Remote address:

216.58.213.2:443

Request

GET /pagead/id HTTP/2.0
host: googleads.g.doubleclick.net
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
origin: https://www.youtube.com
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

static.doubleclick.net

msedge.exe

Remote address:

8.8.8.8:53

Request

static.doubleclick.net

IN A

Response

static.doubleclick.net

IN A

142.250.180.6
GET

https://static.doubleclick.net/instream/ad_status.js

msedge.exe

Remote address:

142.250.180.6:443

Request

GET /instream/ad_status.js HTTP/2.0
host: static.doubleclick.net
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

jnn-pa.googleapis.com

msedge.exe

Remote address:

8.8.8.8:53

Request

jnn-pa.googleapis.com

IN A

Response

jnn-pa.googleapis.com

IN A

172.217.169.74

jnn-pa.googleapis.com

IN A

142.250.179.234

jnn-pa.googleapis.com

IN A

142.250.180.10

jnn-pa.googleapis.com

IN A

142.250.187.202

jnn-pa.googleapis.com

IN A

142.250.187.234

jnn-pa.googleapis.com

IN A

142.250.178.10

jnn-pa.googleapis.com

IN A

172.217.16.234

jnn-pa.googleapis.com

IN A

142.250.200.10

jnn-pa.googleapis.com

IN A

142.250.200.42

jnn-pa.googleapis.com

IN A

216.58.201.106

jnn-pa.googleapis.com

IN A

216.58.204.74
OPTIONS

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

msedge.exe

Remote address:

172.217.169.74:443

Request

OPTIONS /$rpc/google.internal.waa.v1.Waa/Create HTTP/2.0
host: jnn-pa.googleapis.com
accept: */*
access-control-request-method: POST
access-control-request-headers: content-type,x-goog-api-key,x-user-agent
origin: https://www.youtube.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
OPTIONS

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

msedge.exe

Remote address:

172.217.169.74:443

Request

OPTIONS /$rpc/google.internal.waa.v1.Waa/Create HTTP/2.0
host: jnn-pa.googleapis.com
accept: */*
access-control-request-method: POST
access-control-request-headers: content-type,x-goog-api-key,x-user-agent
origin: https://www.youtube.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
OPTIONS

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

msedge.exe

Remote address:

172.217.169.74:443

Request

OPTIONS /$rpc/google.internal.waa.v1.Waa/Create HTTP/2.0
host: jnn-pa.googleapis.com
accept: */*
access-control-request-method: POST
access-control-request-headers: content-type,x-goog-api-key,x-user-agent
origin: https://www.youtube.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

www.google.com

msedge.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.178.4
DNS

yt3.ggpht.com

msedge.exe

Remote address:

8.8.8.8:53

Request

yt3.ggpht.com

IN A

Response

yt3.ggpht.com

IN CNAME

photos-ugc.l.googleusercontent.com

photos-ugc.l.googleusercontent.com

IN A

142.250.178.1
GET

https://www.google.com/js/th/-aHqd6-BO3_mjJT7ECguOU3P98pnfei3uuRpfk-xhaw.js

msedge.exe

Remote address:

142.250.178.4:443

Request

GET /js/th/-aHqd6-BO3_mjJT7ECguOU3P98pnfei3uuRpfk-xhaw.js HTTP/2.0
host: www.google.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://yt3.ggpht.com/ytc/AIdro_lSBcr-bLYIJ4JZ2XX3ocIByYfsnThctyssRxftZBhfkcA=s68-c-k-c0x00ffffff-no-rj

msedge.exe

Remote address:

142.250.178.1:443

Request

GET /ytc/AIdro_lSBcr-bLYIJ4JZ2XX3ocIByYfsnThctyssRxftZBhfkcA=s68-c-k-c0x00ffffff-no-rj HTTP/2.0
host: yt3.ggpht.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://yt3.ggpht.com/ytc/AIdro_nWfSolFsP4s7-I90-6OnLnV-wvidIvsY_mf1J7bgwE-YQ=s68-c-k-c0x00ffffff-no-rj

msedge.exe

Remote address:

142.250.178.1:443

Request

GET /ytc/AIdro_nWfSolFsP4s7-I90-6OnLnV-wvidIvsY_mf1J7bgwE-YQ=s68-c-k-c0x00ffffff-no-rj HTTP/2.0
host: yt3.ggpht.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://yt3.ggpht.com/ytc/AIdro_m9OeTN7Ni8svx0B7yiqMBWoibcYrErY9YlJE_0tDtkJXU=s68-c-k-c0x00ffffff-no-rj

msedge.exe

Remote address:

142.250.178.1:443

Request

GET /ytc/AIdro_m9OeTN7Ni8svx0B7yiqMBWoibcYrErY9YlJE_0tDtkJXU=s68-c-k-c0x00ffffff-no-rj HTTP/2.0
host: yt3.ggpht.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

227.212.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

227.212.58.216.in-addr.arpa

IN PTR

Response

227.212.58.216.in-addr.arpa

IN PTR

lhr25s28-in-f31e100net

227.212.58.216.in-addr.arpa

IN PTR

ams16s22-in-f227�H

227.212.58.216.in-addr.arpa

IN PTR

ams16s22-in-f3�H
DNS

2.213.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.213.58.216.in-addr.arpa

IN PTR

Response

2.213.58.216.in-addr.arpa

IN PTR

lhr25s25-in-f21e100net

2.213.58.216.in-addr.arpa

IN PTR

ber01s14-in-f2�F
DNS

6.180.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

6.180.250.142.in-addr.arpa

IN PTR

Response

6.180.250.142.in-addr.arpa

IN PTR

lhr25s32-in-f61e100net
DNS

74.169.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

74.169.217.172.in-addr.arpa

IN PTR

Response

74.169.217.172.in-addr.arpa

IN PTR

lhr48s09-in-f101e100net
DNS

1.178.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.178.250.142.in-addr.arpa

IN PTR

Response

1.178.250.142.in-addr.arpa

IN PTR

lhr48s27-in-f11e100net
DNS

3.180.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.180.250.142.in-addr.arpa

IN PTR

Response

3.180.250.142.in-addr.arpa

IN PTR

lhr25s32-in-f31e100net
DNS

play.google.com

msedge.exe

Remote address:

8.8.8.8:53

Request

play.google.com

IN A

Response

play.google.com

IN A

142.250.187.206
OPTIONS

https://play.google.com/log?format=json&hasfast=true&authuser=0

msedge.exe

Remote address:

142.250.187.206:443

Request

OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/2.0
host: play.google.com
accept: */*
access-control-request-method: POST
access-control-request-headers: x-goog-authuser
origin: https://www.youtube.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
OPTIONS

https://play.google.com/log?format=json&hasfast=true&authuser=0

msedge.exe

Remote address:

142.250.187.206:443

Request

OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/2.0
host: play.google.com
accept: */*
access-control-request-method: POST
access-control-request-headers: x-goog-authuser
origin: https://www.youtube.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

206.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.187.250.142.in-addr.arpa

IN PTR

Response

206.187.250.142.in-addr.arpa

IN PTR

lhr25s33-in-f141e100net
DNS

counter.yadro.ru

Remote address:

8.8.8.8:53

Request

counter.yadro.ru

IN A

Response

counter.yadro.ru

IN A

88.212.201.204

counter.yadro.ru

IN A

88.212.202.52

counter.yadro.ru

IN A

88.212.201.198
GET

https://www.bing.com/th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90

Remote address:

23.62.61.137:443

Request

GET /th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
host: www.bing.com
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-type: image/png
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 1299
date: Thu, 02 May 2024 10:50:16 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.853d3e17.1714647016.10613cc3
DNS

137.61.62.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

137.61.62.23.in-addr.arpa

IN PTR

Response

137.61.62.23.in-addr.arpa

IN PTR

a23-62-61-137deploystaticakamaitechnologiescom
DNS

28.118.140.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

28.118.140.52.in-addr.arpa

IN PTR

Response
DNS

157.123.68.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.123.68.40.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

171.39.242.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

171.39.242.20.in-addr.arpa

IN PTR

Response
DNS

77.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

77.190.18.2.in-addr.arpa

IN PTR

Response

77.190.18.2.in-addr.arpa

IN PTR

a2-18-190-77deploystaticakamaitechnologiescom
DNS

14.251.17.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.251.17.2.in-addr.arpa

IN PTR

Response

14.251.17.2.in-addr.arpa

IN PTR

a2-17-251-14deploystaticakamaitechnologiescom
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
GET

https://tse1.mm.bing.net/th?id=OADD2.10239370255173_1DU5CK10FBZ5UERKJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239370255173_1DU5CK10FBZ5UERKJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 565422
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CE5F3352088E4D45A6AF1087823CFED2 Ref B: LON04EDGE0818 Ref C: 2024-05-02T10:51:55Z
date: Thu, 02 May 2024 10:51:55 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239360313429_1X5GXWWD8KTODKAD6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239360313429_1X5GXWWD8KTODKAD6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 583094
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F9C9FC6B7B524A58B7898CB7B5F12260 Ref B: LON04EDGE0818 Ref C: 2024-05-02T10:51:55Z
date: Thu, 02 May 2024 10:51:55 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239370255172_1LGH0N1M3BEVIZPTE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239370255172_1LGH0N1M3BEVIZPTE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 442324
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 12CDEA96B4594F73980A96A8FCF79E40 Ref B: LON04EDGE0818 Ref C: 2024-05-02T10:51:55Z
date: Thu, 02 May 2024 10:51:55 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239360313430_12K7UVO7ZVIINTRIE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239360313430_12K7UVO7ZVIINTRIE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 394521
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: EA409AA743364AE6B661668C7751131A Ref B: LON04EDGE0818 Ref C: 2024-05-02T10:51:55Z
date: Thu, 02 May 2024 10:51:55 GMT
DNS

55.36.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

55.36.223.20.in-addr.arpa

IN PTR

Response

172.217.169.46:443

www.youtube.com

tls, http2

msedge.exe

1.0kB
8.4kB
10
10
172.217.169.46:443

www.youtube.com

tls, http2

msedge.exe

1.0kB
8.4kB
10
10
172.217.169.46:443

https://www.youtube.com/s/player/8fc6998a/player_ias.vflset/en_US/base.js

tls, http2

msedge.exe

26.3kB
1.2MB
533
843

HTTP Request

GET https://www.youtube.com/embed/HhAcHB1S2K0

HTTP Request

GET https://www.youtube.com/embed/ZpbIpFoR6rw

HTTP Request

GET https://www.youtube.com/embed/eWtmKMq16WE

HTTP Request

GET https://www.youtube.com/s/player/8fc6998a/www-player.css

HTTP Request

GET https://www.youtube.com/s/player/8fc6998a/player_ias.vflset/en_US/embed.js

HTTP Request

GET https://www.youtube.com/s/player/8fc6998a/www-embed-player.vflset/www-embed-player.js

HTTP Request

GET https://www.youtube.com/s/player/8fc6998a/player_ias.vflset/en_US/base.js
151.101.130.137:80

http://code.jquery.com/jquery-latest.js

http

msedge.exe

2.1kB
88.4kB
39
69

HTTP Request

GET http://code.jquery.com/jquery-latest.js

HTTP Response

200
104.18.11.207:80

http://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css

http

msedge.exe

772 B
6.6kB
9
11

HTTP Request

GET http://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css

HTTP Response

200
216.58.201.118:443

https://i.ytimg.com/vi_webp/HhAcHB1S2K0/sddefault.webp

tls, http2

msedge.exe

5.0kB
133.1kB
82
105

HTTP Request

GET https://i.ytimg.com/vi_webp/eWtmKMq16WE/sddefault.webp

HTTP Request

GET https://i.ytimg.com/vi/ZpbIpFoR6rw/sddefault.jpg

HTTP Request

GET https://i.ytimg.com/vi_webp/HhAcHB1S2K0/sddefault.webp
104.18.11.207:80

http://netdna.bootstrapcdn.com/font-awesome/3.1.1/font/fontawesome-webfont.woff?v=3.1.0

http

msedge.exe

1.4kB
36.6kB
20
32

HTTP Request

GET http://netdna.bootstrapcdn.com/font-awesome/3.1.1/font/fontawesome-webfont.woff?v=3.1.0

HTTP Response

200
88.212.201.198:445

counter.yadro.ru

260 B
200 B
5
5
216.58.213.2:443

https://googleads.g.doubleclick.net/pagead/id

tls, http2

msedge.exe

1.8kB
6.9kB
14
15

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/id
142.250.180.6:443

https://static.doubleclick.net/instream/ad_status.js

tls, http2

msedge.exe

1.8kB
6.9kB
15
15

HTTP Request

GET https://static.doubleclick.net/instream/ad_status.js
172.217.169.74:443

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

tls, http2

msedge.exe

2.1kB
7.3kB
18
19

HTTP Request

OPTIONS https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

HTTP Request

OPTIONS https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

HTTP Request

OPTIONS https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create
172.217.169.74:443

jnn-pa.googleapis.com

tls, http2

msedge.exe

999 B
6.2kB
9
8
172.217.169.74:443

jnn-pa.googleapis.com

tls, http2

msedge.exe

999 B
6.2kB
9
8
142.250.178.4:443

https://www.google.com/js/th/-aHqd6-BO3_mjJT7ECguOU3P98pnfei3uuRpfk-xhaw.js

tls, http2

msedge.exe

2.5kB
28.1kB
30
30

HTTP Request

GET https://www.google.com/js/th/-aHqd6-BO3_mjJT7ECguOU3P98pnfei3uuRpfk-xhaw.js
142.250.178.1:443

yt3.ggpht.com

tls, http2

msedge.exe

1.0kB
10.7kB
10
11
142.250.178.1:443

yt3.ggpht.com

tls

msedge.exe

1.1kB
9.7kB
12
10
142.250.178.1:443

https://yt3.ggpht.com/ytc/AIdro_m9OeTN7Ni8svx0B7yiqMBWoibcYrErY9YlJE_0tDtkJXU=s68-c-k-c0x00ffffff-no-rj

tls, http2

msedge.exe

2.6kB
21.9kB
25
30

HTTP Request

GET https://yt3.ggpht.com/ytc/AIdro_lSBcr-bLYIJ4JZ2XX3ocIByYfsnThctyssRxftZBhfkcA=s68-c-k-c0x00ffffff-no-rj

HTTP Request

GET https://yt3.ggpht.com/ytc/AIdro_nWfSolFsP4s7-I90-6OnLnV-wvidIvsY_mf1J7bgwE-YQ=s68-c-k-c0x00ffffff-no-rj

HTTP Request

GET https://yt3.ggpht.com/ytc/AIdro_m9OeTN7Ni8svx0B7yiqMBWoibcYrErY9YlJE_0tDtkJXU=s68-c-k-c0x00ffffff-no-rj
88.212.201.204:445

counter.yadro.ru

260 B
200 B
5
5
88.212.202.52:445

counter.yadro.ru

260 B
200 B
5
5
142.250.187.206:443

play.google.com

tls, http2

msedge.exe

1.0kB
7.9kB
10
10
142.250.187.206:443

https://play.google.com/log?format=json&hasfast=true&authuser=0

tls, http2

msedge.exe

2.0kB
8.7kB
17
19

HTTP Request

OPTIONS https://play.google.com/log?format=json&hasfast=true&authuser=0

HTTP Request

OPTIONS https://play.google.com/log?format=json&hasfast=true&authuser=0
23.62.61.137:443

https://www.bing.com/th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90

tls, http2

1.4kB
6.5kB
16
12

HTTP Request

GET https://www.bing.com/th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90

HTTP Response

200
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
14
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
14
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
14
204.79.197.200:443

https://tse1.mm.bing.net/th?id=OADD2.10239360313430_12K7UVO7ZVIINTRIE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

tls, http2

73.8kB
2.1MB
1507
1503

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239370255173_1DU5CK10FBZ5UERKJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239360313429_1X5GXWWD8KTODKAD6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239370255172_1LGH0N1M3BEVIZPTE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239360313430_12K7UVO7ZVIINTRIE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

8.8.8.8:53

www.youtube.com

dns

msedge.exe

61 B
319 B
1
1

DNS Request

www.youtube.com

DNS Response

172.217.169.46

142.250.179.238

142.250.180.14

142.250.187.206

142.250.187.238

142.250.178.14

172.217.16.238

142.250.200.14

142.250.200.46

216.58.201.110

216.58.204.78

216.58.213.14

172.217.169.14

216.58.212.238
8.8.8.8:53

netdna.bootstrapcdn.com

dns

msedge.exe

69 B
101 B
1
1

DNS Request

netdna.bootstrapcdn.com

DNS Response

104.18.11.207

104.18.10.207
8.8.8.8:53

code.jquery.com

dns

msedge.exe

61 B
125 B
1
1

DNS Request

code.jquery.com

DNS Response

151.101.130.137

151.101.194.137

151.101.66.137

151.101.2.137
8.8.8.8:53

i.ytimg.com

dns

msedge.exe

57 B
281 B
1
1

DNS Request

i.ytimg.com

DNS Response

216.58.201.118

216.58.204.86

216.58.213.22

216.58.212.246

172.217.169.86

172.217.169.54

142.250.179.246

142.250.180.22

142.250.187.214

142.250.187.246

142.250.178.22

172.217.16.246

142.250.200.22

142.250.200.54
172.217.169.46:443

www.youtube.com

https

msedge.exe

38.2kB
44.9kB
60
66
8.8.8.8:53

counter.yadro.ru

dns

62 B
110 B
1
1

DNS Request

counter.yadro.ru

DNS Response

88.212.201.198

88.212.201.204

88.212.202.52
8.8.8.8:53

149.220.183.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

149.220.183.52.in-addr.arpa
8.8.8.8:53

79.190.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

79.190.18.2.in-addr.arpa
8.8.8.8:53

20.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

20.160.190.20.in-addr.arpa
8.8.8.8:53

46.169.217.172.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

46.169.217.172.in-addr.arpa
8.8.8.8:53

137.130.101.151.in-addr.arpa

dns

74 B
134 B
1
1

DNS Request

137.130.101.151.in-addr.arpa
8.8.8.8:53

207.11.18.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

207.11.18.104.in-addr.arpa
8.8.8.8:53

118.201.58.216.in-addr.arpa

dns

73 B
173 B
1
1

DNS Request

118.201.58.216.in-addr.arpa
8.8.8.8:53

googleads.g.doubleclick.net

dns

msedge.exe

73 B
89 B
1
1

DNS Request

googleads.g.doubleclick.net

DNS Response

216.58.213.2
8.8.8.8:53

static.doubleclick.net

dns

msedge.exe

68 B
84 B
1
1

DNS Request

static.doubleclick.net

DNS Response

142.250.180.6
216.58.213.2:443

googleads.g.doubleclick.net

https

msedge.exe

4.5kB
8.8kB
19
24
8.8.8.8:53

jnn-pa.googleapis.com

dns

msedge.exe

67 B
243 B
1
1

DNS Request

jnn-pa.googleapis.com

DNS Response

172.217.169.74

142.250.179.234

142.250.180.10

142.250.187.202

142.250.187.234

142.250.178.10

172.217.16.234

142.250.200.10

142.250.200.42

216.58.201.106

216.58.204.74
8.8.8.8:53

www.google.com

dns

msedge.exe

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

142.250.178.4
8.8.8.8:53

yt3.ggpht.com

dns

msedge.exe

59 B
120 B
1
1

DNS Request

yt3.ggpht.com

DNS Response

142.250.178.1
172.217.169.74:443

jnn-pa.googleapis.com

https

msedge.exe

11.4kB
140.0kB
72
123
8.8.8.8:53

227.212.58.216.in-addr.arpa

dns

73 B
171 B
1
1

DNS Request

227.212.58.216.in-addr.arpa
8.8.8.8:53

2.213.58.216.in-addr.arpa

dns

71 B
138 B
1
1

DNS Request

2.213.58.216.in-addr.arpa
8.8.8.8:53

6.180.250.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

6.180.250.142.in-addr.arpa
8.8.8.8:53

74.169.217.172.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

74.169.217.172.in-addr.arpa
8.8.8.8:53

1.178.250.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

1.178.250.142.in-addr.arpa
8.8.8.8:53

3.180.250.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

3.180.250.142.in-addr.arpa
8.8.8.8:53

play.google.com

dns

msedge.exe

61 B
77 B
1
1

DNS Request

play.google.com

DNS Response

142.250.187.206
142.250.187.206:443

play.google.com

https

msedge.exe

14.0kB
11.2kB
36
43
8.8.8.8:53

206.187.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

206.187.250.142.in-addr.arpa
8.8.8.8:53

counter.yadro.ru

dns

62 B
110 B
1
1

DNS Request

counter.yadro.ru

DNS Response

88.212.201.204

88.212.202.52

88.212.201.198
8.8.8.8:53

137.61.62.23.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

137.61.62.23.in-addr.arpa
224.0.0.251:5353

532 B
8
8.8.8.8:53

28.118.140.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

28.118.140.52.in-addr.arpa
8.8.8.8:53

157.123.68.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

157.123.68.40.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

171.39.242.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

171.39.242.20.in-addr.arpa
8.8.8.8:53

77.190.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

77.190.18.2.in-addr.arpa
8.8.8.8:53

14.251.17.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

14.251.17.2.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

62 B
173 B
1
1

DNS Request

tse1.mm.bing.net

DNS Response

204.79.197.200

13.107.21.200
8.8.8.8:53

55.36.223.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

55.36.223.20.in-addr.arpa
216.58.213.2:443

googleads.g.doubleclick.net

https

msedge.exe

3.2kB
5.0kB
20
23

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
32KB

MD5
8b46159f0c940fc3e6abf99185f44f11

SHA1
1a2e27feaf823cf1a84a203d1bcd320a7f6771d1

SHA256
c77f0313cc7771a1dbcb739c98e4a8387669747c359cb59593b13c3891164979

SHA512
6e780c00db95c810b62752a5335e214d815aeaedaa220fda93a191b514d8d6a077e772665a1ba7f321d124c17b1d62a4f4b3837e4e4c65eb3d4e029999389560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
74bb3cc957caa0fe573d4a8e62836a46

SHA1
86ffdb07670347d4cd9840fc5787f530724e360e

SHA256
3bd2b272bc9f367b3f0622d01ee7683bf19cc210b623ae0472387c54f8ecdf7e

SHA512
927b7b4b84eff554945cb50daf6fcb482aab525176b6037ab85b5cba9e12325bff4848102b6b12cfde6772fd58934b263f30d2c6c9212152a2bb0caf945034a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5771300547fb015428a02684810641f7

SHA1
01e2ee3d6031d32a6360cc219eb6600ac079686e

SHA256
bfbf21b439bc4f3950d66816760146c969e060cec74440e49055f1cc2eea7d99

SHA512
0627340fe924ba8617eec18a85bfd2e3788f30292baea9d90f128740d36fb0aea774b887ef71d52c0aa4a5e86acbbf0e53c1efc823b4bdc4fe52b57ac5a30dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
06b8449828a7fdf645db445815a2df4d

SHA1
ef700c78c09606bfaaaba48ead39f81c98445ae3

SHA256
1e1fed8c8cfc8d1f91e3e0569930e8670cc211587396fa84f403044f9c9b388c

SHA512
604d64f0cb5d1163b6b20d350aa95ca82df6130a7ada91ad820dfe9b0f66a876727a72b11f9192c6d537096c814d136d3755e4e597723bde93dbfc9404685133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
691cd8a50eb40a9ad5762037e3686f60

SHA1
f334818be62900ade8a020d6ab3d96c08908136f

SHA256
7ec6443bc40acb56190b9e31a8ab411de753ee49ae9d5a34990b73d65af00e78

SHA512
1afdd5ac26b1df3749ac723d98a2df4d22160e662ae85d71974048196a27925f74e0424798bc028cc0fde727849c14dc2980ccf357dc61f4b04e68e22d4d9c6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4c14739eaad0d2b67fde6f0b93e330c3

SHA1
9289ac425db484c9622d6df5489dbb5f90f29132

SHA256
238f5ad283783aaed903333c42215ce60176f36d1a352133a60bb205d3ea06d2

SHA512
49bcc65fd7cc3439f5b405fe4043e3c692e40cb6e2fb87de66747cab8d912f67749c830354999830bb0d318a6ba222f44b9abc15cbc178f662ec187cf3e947f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a37be82ddab0ca1874289bf79792cdc7

SHA1
3997114c9c4231a0d3b622a2b340eac7e1cec1c2

SHA256
64fab53848c97be2b00834f6db9cea1b065df6c1fab99f3b96d7830a50e64c69

SHA512
f0bc5b698f71bf7207ec7ec786ba09187878d02c291bef07627ccd0d8626827db70476f867a2d338797fb93123813207b53bd1763baf62752d8cbf7e6e16c3c7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request