daae07490831bceddafde61b3a1829043648e5ca24778b4a69ffab9829fd97de

Resubmissions

11/08/2024, 21:28 UTC

240811-1btcnaygrj 3

11/08/2024, 13:53 UTC

240811-q62x6swgla 3

11/08/2024, 13:52 UTC

240811-q6pmvawgkc 3

20/07/2024, 19:16 UTC

240720-xyvx8awcnb 1

20/07/2024, 19:14 UTC

240720-xx5q2awclf 1

20/07/2024, 19:11 UTC

240720-xwd7pawcjh 1

20/07/2024, 19:09 UTC

240720-xtxk9axern 1

20/07/2024, 19:08 UTC

240720-xtfmqsxeql 6

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 19:08 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c12.html
Size

7KB
MD5

ed05d5b3d7de3d798bf68dfa44fa4aca
SHA1

8b93622287614b48dff54351aa6f956a6c670b73
SHA256

daae07490831bceddafde61b3a1829043648e5ca24778b4a69ffab9829fd97de
SHA512

d256bb6ac71c7d82f31c6d1e5c13536ec9c81ddb3c5060c017240be3ddf2a3f9a966924add381fcb2af26561dd04c7b593548b6fb271ad52c0c477a0086361d6
SSDEEP

192:xosfzn2lcWYAA6Si6SP6g+6k12045Tw8R2:xosfSlYY8b2k12j5Tw8R2

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
93	pastebin.com
92	pastebin.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3064	msedge.exe
3064	msedge.exe
1444	msedge.exe
1444	msedge.exe
1928	identity_helper.exe
1928	identity_helper.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	684	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	684	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 4704	1444	msedge.exe	84
PID 1444 wrote to memory of 4704	1444	msedge.exe	84
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 468	1444	msedge.exe	85
PID 1444 wrote to memory of 3064	1444	msedge.exe	86
PID 1444 wrote to memory of 3064	1444	msedge.exe	86
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87
PID 1444 wrote to memory of 972	1444	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c12.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7d0b46f8,0x7ffa7d0b4708,0x7ffa7d0b4718
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2740 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2624 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2128917029310997705,17216831199244032064,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1160

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x30c 0x3c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:684

Network

DNS

149.220.183.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

149.220.183.52.in-addr.arpa

IN PTR

Response
DNS

64.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

64.159.190.20.in-addr.arpa

IN PTR

Response
DNS

227.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

227.187.250.142.in-addr.arpa

IN PTR

Response

227.187.250.142.in-addr.arpa

IN PTR

lhr25s34-in-f31e100net
DNS

73.144.22.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.144.22.2.in-addr.arpa

IN PTR

Response

73.144.22.2.in-addr.arpa

IN PTR

a2-22-144-73deploystaticakamaitechnologiescom
DNS

57.169.31.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

57.169.31.20.in-addr.arpa

IN PTR

Response
DNS

196.249.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.249.167.52.in-addr.arpa

IN PTR

Response
DNS

youtu.be

msedge.exe

Remote address:

8.8.8.8:53

Request

youtu.be

IN A

Response

youtu.be

IN A

216.58.201.110
GET

https://youtu.be/MrSAkJZ31lA

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /MrSAkJZ31lA HTTP/2.0
host: youtu.be
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /watch?v=MrSAkJZ31lA&feature=youtu.be HTTP/2.0
host: www.youtube.com
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.youtube.com/s/player/d60b0ef9/player_ias.vflset/en_US/base.js

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /s/player/d60b0ef9/player_ias.vflset/en_US/base.js HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: YSC=KgZZNY6ghD0
cookie: __Secure-YEC=CgtxbkpUOFhrVjZGQSjElvC0BjIKCgJHQhIEGgAgDA%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgDA%3D%3D
GET

https://www.youtube.com/s/desktop/060ac52e/jsbin/desktop_polymer.vflset/desktop_polymer.js

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /s/desktop/060ac52e/jsbin/desktop_polymer.vflset/desktop_polymer.js HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: YSC=KgZZNY6ghD0
cookie: __Secure-YEC=CgtxbkpUOFhrVjZGQSjElvC0BjIKCgJHQhIEGgAgDA%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgDA%3D%3D
GET

https://www.youtube.com/s/desktop/060ac52e/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /s/desktop/060ac52e/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: YSC=KgZZNY6ghD0
cookie: __Secure-YEC=CgtxbkpUOFhrVjZGQSjElvC0BjIKCgJHQhIEGgAgDA%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgDA%3D%3D
GET

https://www.youtube.com/s/desktop/060ac52e/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /s/desktop/060ac52e/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: YSC=KgZZNY6ghD0
cookie: __Secure-YEC=CgtxbkpUOFhrVjZGQSjElvC0BjIKCgJHQhIEGgAgDA%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgDA%3D%3D
GET

https://www.youtube.com/s/desktop/060ac52e/jsbin/webcomponents-sd.vflset/webcomponents-sd.js

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /s/desktop/060ac52e/jsbin/webcomponents-sd.vflset/webcomponents-sd.js HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: YSC=KgZZNY6ghD0
cookie: __Secure-YEC=CgtxbkpUOFhrVjZGQSjElvC0BjIKCgJHQhIEGgAgDA%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgDA%3D%3D
GET

https://www.youtube.com/s/desktop/060ac52e/jsbin/intersection-observer.min.vflset/intersection-observer.min.js

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /s/desktop/060ac52e/jsbin/intersection-observer.min.vflset/intersection-observer.min.js HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: YSC=KgZZNY6ghD0
cookie: __Secure-YEC=CgtxbkpUOFhrVjZGQSjElvC0BjIKCgJHQhIEGgAgDA%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgDA%3D%3D
GET

https://www.youtube.com/s/desktop/060ac52e/jsbin/scheduler.vflset/scheduler.js

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /s/desktop/060ac52e/jsbin/scheduler.vflset/scheduler.js HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: YSC=KgZZNY6ghD0
cookie: __Secure-YEC=CgtxbkpUOFhrVjZGQSjElvC0BjIKCgJHQhIEGgAgDA%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgDA%3D%3D
GET

https://www.youtube.com/s/desktop/060ac52e/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /s/desktop/060ac52e/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: YSC=KgZZNY6ghD0
cookie: __Secure-YEC=CgtxbkpUOFhrVjZGQSjElvC0BjIKCgJHQhIEGgAgDA%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgDA%3D%3D
GET

https://www.youtube.com/s/player/d60b0ef9/www-player.css

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /s/player/d60b0ef9/www-player.css HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: YSC=KgZZNY6ghD0
cookie: __Secure-YEC=CgtxbkpUOFhrVjZGQSjElvC0BjIKCgJHQhIEGgAgDA%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgDA%3D%3D
GET

https://www.youtube.com/s/desktop/060ac52e/cssbin/www-main-desktop-watch-page-skeleton.css

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /s/desktop/060ac52e/cssbin/www-main-desktop-watch-page-skeleton.css HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: YSC=KgZZNY6ghD0
cookie: __Secure-YEC=CgtxbkpUOFhrVjZGQSjElvC0BjIKCgJHQhIEGgAgDA%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgDA%3D%3D
GET

https://www.youtube.com/s/desktop/060ac52e/cssbin/www-main-desktop-player-skeleton.css

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /s/desktop/060ac52e/cssbin/www-main-desktop-player-skeleton.css HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: YSC=KgZZNY6ghD0
cookie: __Secure-YEC=CgtxbkpUOFhrVjZGQSjElvC0BjIKCgJHQhIEGgAgDA%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgDA%3D%3D
GET

https://www.youtube.com/s/desktop/060ac52e/cssbin/www-onepick.css

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /s/desktop/060ac52e/cssbin/www-onepick.css HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: YSC=KgZZNY6ghD0
cookie: __Secure-YEC=CgtxbkpUOFhrVjZGQSjElvC0BjIKCgJHQhIEGgAgDA%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgDA%3D%3D
GET

https://www.youtube.com/s/_/ytmainappweb/_/ss/k=ytmainappweb.kevlar_base.vyXY6lrOKDQ.L.B1.O/am=AAAI0AI/d=0/br=1/rs=AGKMywFfBI9QV9dG-tZh8wQaw-Yyn6090w

msedge.exe

Remote address:

216.58.201.110:443

Request

GET /s/_/ytmainappweb/_/ss/k=ytmainappweb.kevlar_base.vyXY6lrOKDQ.L.B1.O/am=AAAI0AI/d=0/br=1/rs=AGKMywFfBI9QV9dG-tZh8wQaw-Yyn6090w HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: YSC=KgZZNY6ghD0
cookie: __Secure-YEC=CgtxbkpUOFhrVjZGQSjElvC0BjIKCgJHQhIEGgAgDA%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgDA%3D%3D
POST

https://consent.youtube.com/save?continue=https://www.youtube.com/watch%3Fv%3DMrSAkJZ31lA%26feature%3Dyoutu.be&gl=GB&m=0&pc=yt&x=5&src=2&hl=en&bl=653459994&cm=2&set_eom=true

msedge.exe

Remote address:

216.58.201.110:443

Request

POST /save?continue=https://www.youtube.com/watch%3Fv%3DMrSAkJZ31lA%26feature%3Dyoutu.be&gl=GB&m=0&pc=yt&x=5&src=2&hl=en&bl=653459994&cm=2&set_eom=true HTTP/2.0
host: consent.youtube.com
content-length: 0
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
content-type: text/plain
accept: */*
origin: https://www.youtube.com
sec-fetch-site: same-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: YSC=KgZZNY6ghD0
cookie: __Secure-YEC=CgtxbkpUOFhrVjZGQSjElvC0BjIKCgJHQhIEGgAgDA%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgDA%3D%3D
cookie: PREF=tz=UTC
cookie: SOCS=CAESEwgDEgk2NTM0NTk5OTQaAmVuIAEaBgiA_Ou0Bg
DNS

www.youtube.com

msedge.exe

Remote address:

8.8.8.8:53

Request

www.youtube.com

IN A

Response

www.youtube.com

IN CNAME

youtube-ui.l.google.com

youtube-ui.l.google.com

IN A

142.250.187.206

youtube-ui.l.google.com

IN A

216.58.201.110

youtube-ui.l.google.com

IN A

142.250.179.238

youtube-ui.l.google.com

IN A

142.250.200.14

youtube-ui.l.google.com

IN A

216.58.204.78

youtube-ui.l.google.com

IN A

142.250.178.14

youtube-ui.l.google.com

IN A

172.217.169.78

youtube-ui.l.google.com

IN A

172.217.16.238

youtube-ui.l.google.com

IN A

172.217.169.46

youtube-ui.l.google.com

IN A

216.58.212.238

youtube-ui.l.google.com

IN A

172.217.169.14

youtube-ui.l.google.com

IN A

142.250.200.46

youtube-ui.l.google.com

IN A

142.250.187.238

youtube-ui.l.google.com

IN A

142.250.180.14
DNS

i.ytimg.com

msedge.exe

Remote address:

8.8.8.8:53

Request

i.ytimg.com

IN A

Response

i.ytimg.com

IN A

216.58.204.86

i.ytimg.com

IN A

172.217.169.22

i.ytimg.com

IN A

142.250.200.22

i.ytimg.com

IN A

216.58.213.22

i.ytimg.com

IN A

142.250.180.22

i.ytimg.com

IN A

142.250.178.22

i.ytimg.com

IN A

142.250.187.246

i.ytimg.com

IN A

142.250.200.54

i.ytimg.com

IN A

142.250.187.214

i.ytimg.com

IN A

142.250.179.246

i.ytimg.com

IN A

216.58.201.118

i.ytimg.com

IN A

216.58.212.214

i.ytimg.com

IN A

172.217.169.54

i.ytimg.com

IN A

172.217.169.86

i.ytimg.com

IN A

172.217.16.246
DNS

rr1---sn-aigzrn76.googlevideo.com

msedge.exe

Remote address:

8.8.8.8:53

Request

rr1---sn-aigzrn76.googlevideo.com

IN A

Response

rr1---sn-aigzrn76.googlevideo.com

IN CNAME

rr1.sn-aigzrn76.googlevideo.com

rr1.sn-aigzrn76.googlevideo.com

IN A

173.194.137.70
GET

https://i.ytimg.com/generate_204

msedge.exe

Remote address:

216.58.204.86:443

Request

GET /generate_204 HTTP/2.0
host: i.ytimg.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://rr1---sn-aigzrn76.googlevideo.com/generate_204

msedge.exe

Remote address:

173.194.137.70:443

Request

GET /generate_204 HTTP/1.1
Host: rr1---sn-aigzrn76.googlevideo.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
DNT: 1
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Accept: */*
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: empty
Referer: https://www.youtube.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 204 No Content

Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Server: gvs 1.0
Date: Sat, 20 Jul 2024 19:08:52 GMT
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Content-Length: 0
GET

https://rr1---sn-aigzrn76.googlevideo.com/generate_204?conn2

msedge.exe

Remote address:

173.194.137.70:443

Request

GET /generate_204?conn2 HTTP/1.1
Host: rr1---sn-aigzrn76.googlevideo.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
DNT: 1
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Accept: */*
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: empty
Referer: https://www.youtube.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 204 No Content

Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Server: gvs 1.0
Date: Sat, 20 Jul 2024 19:08:52 GMT
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Content-Length: 0
DNS

110.201.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

110.201.58.216.in-addr.arpa

IN PTR

Response

110.201.58.216.in-addr.arpa

IN PTR

lhr48s48-in-f141e100net

110.201.58.216.in-addr.arpa

IN PTR

prg03s02-in-f110�I

110.201.58.216.in-addr.arpa

IN PTR

prg03s02-in-f14�I
DNS

206.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.187.250.142.in-addr.arpa

IN PTR

Response

206.187.250.142.in-addr.arpa

IN PTR

lhr25s33-in-f141e100net
DNS

accounts.google.com

msedge.exe

Remote address:

8.8.8.8:53

Request

accounts.google.com

IN A

Response

accounts.google.com

IN A

108.177.127.84
GET

https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en

msedge.exe

Remote address:

108.177.127.84:443

Request

GET /ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en HTTP/2.0
host: accounts.google.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

86.204.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.204.58.216.in-addr.arpa

IN PTR

Response

86.204.58.216.in-addr.arpa

IN PTR

lhr48s49-in-f221e100net

86.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f22�H

86.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f86�H
DNS

234.16.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

234.16.217.172.in-addr.arpa

IN PTR

Response

234.16.217.172.in-addr.arpa

IN PTR

mad08s04-in-f101e100net

234.16.217.172.in-addr.arpa

IN PTR

lhr48s28-in-f10�I
DNS

70.137.194.173.in-addr.arpa

Remote address:

8.8.8.8:53

Request

70.137.194.173.in-addr.arpa

IN PTR

Response

70.137.194.173.in-addr.arpa

IN PTR

lhr48s05-in-f61e100net
DNS

84.127.177.108.in-addr.arpa

Remote address:

8.8.8.8:53

Request

84.127.177.108.in-addr.arpa

IN PTR

Response

84.127.177.108.in-addr.arpa

IN PTR

el-in-f841e100net
DNS

jnn-pa.googleapis.com

msedge.exe

Remote address:

8.8.8.8:53

Request

jnn-pa.googleapis.com

IN A

Response

jnn-pa.googleapis.com

IN A

142.250.200.42

jnn-pa.googleapis.com

IN A

172.217.169.42

jnn-pa.googleapis.com

IN A

142.250.180.10

jnn-pa.googleapis.com

IN A

142.250.178.10

jnn-pa.googleapis.com

IN A

142.250.187.202

jnn-pa.googleapis.com

IN A

216.58.204.74

jnn-pa.googleapis.com

IN A

142.250.200.10

jnn-pa.googleapis.com

IN A

142.250.187.234

jnn-pa.googleapis.com

IN A

172.217.169.10

jnn-pa.googleapis.com

IN A

216.58.201.106

jnn-pa.googleapis.com

IN A

172.217.16.234

jnn-pa.googleapis.com

IN A

142.250.179.234
OPTIONS

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

msedge.exe

Remote address:

142.250.200.42:443

Request

OPTIONS /$rpc/google.internal.waa.v1.Waa/Create HTTP/2.0
host: jnn-pa.googleapis.com
accept: */*
access-control-request-method: POST
access-control-request-headers: content-type,x-goog-api-key,x-user-agent
origin: https://www.youtube.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

42.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

42.200.250.142.in-addr.arpa

IN PTR

Response

42.200.250.142.in-addr.arpa

IN PTR

lhr48s30-in-f101e100net
DNS

99.201.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

99.201.58.216.in-addr.arpa

IN PTR

Response

99.201.58.216.in-addr.arpa

IN PTR

lhr48s48-in-f31e100net

99.201.58.216.in-addr.arpa

IN PTR

prg03s02-in-f3�G

99.201.58.216.in-addr.arpa

IN PTR

prg03s02-in-f99�G
DNS

yt3.ggpht.com

msedge.exe

Remote address:

8.8.8.8:53

Request

yt3.ggpht.com

IN A

Response

yt3.ggpht.com

IN CNAME

photos-ugc.l.googleusercontent.com

photos-ugc.l.googleusercontent.com

IN A

142.250.187.193
DNS

play.google.com

msedge.exe

Remote address:

8.8.8.8:53

Request

play.google.com

IN A

Response

play.google.com

IN A

142.250.200.46
DNS

www.google.com

msedge.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.180.4
GET

https://yt3.ggpht.com/t6aV4H3yhpqFutVJvhoh0sCx6J5_sJQIw8htebSia9pCEe8RzMs_HF7KD3xtkq4vsfqDpwmi=s48-c-k-c0x00ffffff-no-rj

msedge.exe

Remote address:

142.250.187.193:443

Request

GET /t6aV4H3yhpqFutVJvhoh0sCx6J5_sJQIw8htebSia9pCEe8RzMs_HF7KD3xtkq4vsfqDpwmi=s48-c-k-c0x00ffffff-no-rj HTTP/2.0
host: yt3.ggpht.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://yt3.ggpht.com/pyJrgRJt_77DZ1O_ek96CcfX8BPiEXdoGt8wqPeKfBpk-E8zVplqjj16mHK9EFbIi3wGCO2D3g=s100-w72-h100-c-k-c0x00ffffff-no-nd-rj

msedge.exe

Remote address:

142.250.187.193:443

Request

GET /pyJrgRJt_77DZ1O_ek96CcfX8BPiEXdoGt8wqPeKfBpk-E8zVplqjj16mHK9EFbIi3wGCO2D3g=s100-w72-h100-c-k-c0x00ffffff-no-nd-rj HTTP/2.0
host: yt3.ggpht.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://yt3.ggpht.com/QqoTjrpKRDMfGFPYpgIaTmHkbQ6Lk-brN77OxCYwl0jTtluavivXDdd4lR2wQsr_hcIggw=s136-w136-h136-c-k-c0x00ffffff-no-nd-rj

msedge.exe

Remote address:

142.250.187.193:443

Request

GET /QqoTjrpKRDMfGFPYpgIaTmHkbQ6Lk-brN77OxCYwl0jTtluavivXDdd4lR2wQsr_hcIggw=s136-w136-h136-c-k-c0x00ffffff-no-nd-rj HTTP/2.0
host: yt3.ggpht.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
OPTIONS

https://play.google.com/log?format=json&hasfast=true&authuser=0

msedge.exe

Remote address:

142.250.200.46:443

Request

OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/2.0
host: play.google.com
accept: */*
access-control-request-method: POST
access-control-request-headers: x-goog-authuser
origin: https://www.youtube.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
OPTIONS

https://play.google.com/log?format=json&hasfast=true&authuser=0

msedge.exe

Remote address:

142.250.200.46:443

Request

OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/2.0
host: play.google.com
accept: */*
access-control-request-method: POST
access-control-request-headers: x-goog-authuser
origin: https://www.youtube.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.google.com/js/th/G9IHigwxVH3Mn3WnChzJeeVNQhz-kZ0Q5G-GviBI-tI.js

msedge.exe

Remote address:

142.250.180.4:443

Request

GET /js/th/G9IHigwxVH3Mn3WnChzJeeVNQhz-kZ0Q5G-GviBI-tI.js HTTP/2.0
host: www.google.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

193.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

193.187.250.142.in-addr.arpa

IN PTR

Response

193.187.250.142.in-addr.arpa

IN PTR

lhr25s33-in-f11e100net
DNS

4.180.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

4.180.250.142.in-addr.arpa

IN PTR

Response

4.180.250.142.in-addr.arpa

IN PTR

lhr25s32-in-f41e100net
DNS

46.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

46.200.250.142.in-addr.arpa

IN PTR

Response

46.200.250.142.in-addr.arpa

IN PTR

lhr48s30-in-f141e100net
DNS

youtube.com

msedge.exe

Remote address:

8.8.8.8:53

Request

youtube.com

IN A

Response

youtube.com

IN A

216.58.201.110
GET

https://youtube.com/

msedge.exe

Remote address:

216.58.201.110:443

Request

GET / HTTP/2.0
host: youtube.com
pragma: no-cache
cache-control: no-cache
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
origin: https://www.youtube.com
sec-fetch-site: same-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

consent.youtube.com

msedge.exe

Remote address:

8.8.8.8:53

Request

consent.youtube.com

IN A

Response

consent.youtube.com

IN A

216.58.201.110
DNS

pastebin.com

msedge.exe

Remote address:

8.8.8.8:53

Request

pastebin.com

IN A

Response

pastebin.com

IN A

104.20.4.235

pastebin.com

IN A

104.20.3.235

pastebin.com

IN A

172.67.19.24
GET

https://pastebin.com/raw/h1j3cpu4

msedge.exe

Remote address:

104.20.4.235:443

Request

GET /raw/h1j3cpu4 HTTP/2.0
host: pastebin.com
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:01 GMT
content-type: text/plain; charset=utf-8
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1;mode=block
cache-control: public, max-age=1801
cf-cache-status: EXPIRED
last-modified: Sat, 20 Jul 2024 18:31:37 GMT
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a653e44a9d7887a-LHR
content-encoding: br
GET

https://pastebin.com/favicon.ico

msedge.exe

Remote address:

104.20.4.235:443

Request

GET /favicon.ico HTTP/2.0
host: pastebin.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://pastebin.com/raw/h1j3cpu4
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:01 GMT
content-type: image/x-icon
last-modified: Tue, 12 Mar 2024 09:18:35 GMT
etag: W/"65f01deb-13e"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4994
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a653e467bf9887a-LHR
content-encoding: br
DNS

235.4.20.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

235.4.20.104.in-addr.arpa

IN PTR

Response
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR

Response
DNS

56.126.166.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

56.126.166.20.in-addr.arpa

IN PTR

Response
DNS

56.126.166.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

56.126.166.20.in-addr.arpa

IN PTR

Response
DNS

147.142.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

147.142.123.92.in-addr.arpa

IN PTR

Response

147.142.123.92.in-addr.arpa

IN PTR

a92-123-142-147deploystaticakamaitechnologiescom
DNS

147.142.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

147.142.123.92.in-addr.arpa

IN PTR

Response

147.142.123.92.in-addr.arpa

IN PTR

a92-123-142-147deploystaticakamaitechnologiescom
DNS

mboost.me

msedge.exe

Remote address:

8.8.8.8:53

Request

mboost.me

IN A

Response

mboost.me

IN A

172.67.214.146

mboost.me

IN A

104.21.67.56
DNS

mboost.me

msedge.exe

Remote address:

8.8.8.8:53

Request

mboost.me

IN A

Response

mboost.me

IN A

172.67.214.146

mboost.me

IN A

104.21.67.56
GET

https://mboost.me/a/c12

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /a/c12 HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: text/html; charset=utf-8
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
x-content-type-options: nosniff
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
x-powered-by: Next.js
cache-control: private, no-cache, no-store, max-age=0, must-revalidate
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ep28Nmz9Sfry2fcD8iPXCJP7FIayqwactKd6HUCB4pjmV%2F12VXBj6BdKQaxwAmmI%2F6HMf4vLtaSHQea%2Bk2f45bwlQpPcMvAXH47Go8oDmjgVDuUOUpqOHBrrkDg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e79da49bec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/_next/static/css/e8ea4f8b7b858637.css

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /_next/static/css/e8ea4f8b7b858637.css HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript; charset=utf-8
content-length: 1562
x-amz-id-2: 9akD6bT8ixozhp/VEvRh7LpC92Hk5oEOcsHxsxSLJZ4GhWR5nInaKM9iaiOwChD3X9Ighp8ZPJA=
x-amz-request-id: MXWV1D90H2GJBMGP
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Thu, 24 Mar 2022 17:17:45 GMT
x-amz-version-id: XBsWUVr.p_M6cJ6trmAwu3yrcA8w0l_q
etag: "a3d68b609a2393a4bd30f7aceadcbfed"
cf-cache-status: HIT
age: 251991
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iOYkmLAEH4ZjiQ%2F%2BDYfZt6afqHbsQziDxvRXwA67%2F2p%2BgYyw1W282gjifH3czYXNGbGKNBCAq4%2BzbMwK%2BZrnkexbnbkOa%2FwFwbLn0VY0eu8cfu2PgjKTSO4bml0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a653e7b8c83bec1-LHR
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/cdn-cgi/apps/head/gfZfIedvFNHE-6vwuf_1JemVCGU.js

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /cdn-cgi/apps/head/gfZfIedvFNHE-6vwuf_1JemVCGU.js HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-bgj: minify
etag: W/"4731-1853e924baa"
last-modified: Fri, 23 Dec 2022 10:40:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 251991
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iYPayQWcJUCtk5OUAdCAWFdxfxG6qiSLHb8ylW51uKrjY%2F%2BwGCPkDq47y2UTdqonDUYeztZ6DQRrOVXY4qwOFXxHKO%2BQOI%2F1LNyvFhvDldXhfyQ0S7vqCCwMOzo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e7b8c7ebec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/_next/static/chunks/webpack-ee7e63bc15b31913.js

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /_next/static/chunks/webpack-ee7e63bc15b31913.js HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-bgj: minify
etag: W/"637-1853e924bac"
last-modified: Fri, 23 Dec 2022 10:40:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 251096
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pJcL2RgOms4A6abinvToBgkaYGcGiuLfkhrwPuvdOReX6xsiAXD5gI0nDlLgvdC1L4yqN9ztj9Oc5gqHVs8NOmAs4Z2dGQZzTtbrXEyUtiL9w61ieK68ITisVFg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e7becf5bec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/_next/static/chunks/framework-3b5a00d5d7e8d93b.js

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /_next/static/chunks/framework-3b5a00d5d7e8d93b.js HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-bgj: minify
etag: W/"1fee-1853e924bac"
last-modified: Fri, 23 Dec 2022 10:40:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 251096
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BaUdB8MVmAxA9ffK%2BN96mE40qeLReR3eOo1kToemzOM688vX1Ue3jeuXap8NfHu5WNCYUEuYTwBDlBg5AqOgj8C%2FJQmN6sIpzICCSJlQu4okDAcsjn%2FgCfwwcQ4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e7bed02bec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/_next/static/chunks/main-9c0a1441bfd93a46.js

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /_next/static/chunks/main-9c0a1441bfd93a46.js HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-bgj: minify
etag: W/"4d-1853e924baa"
last-modified: Fri, 23 Dec 2022 10:40:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 251095
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yPIWTNCe5lxIKvvNYLmXqEmLC%2FNraRi%2FQeBcgDIS6LqJZemn6r48O4NSjYnkgw1wJcOaAZpSyC6fD4uFghVl59g5MAcktTyrcsd%2ByDc3dqxaqgIjwUReiPKFuX8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e7bed04bec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/_next/static/chunks/pages/_app-de8ad9055c7bf200.js

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /_next/static/chunks/pages/_app-de8ad9055c7bf200.js HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript; charset=utf-8
content-length: 1319
x-amz-id-2: jSErZ8+hqLb+mgGLcaG9wPTS1myBAWm5glZZDgyrzogZaZqjQXQvjTg6MHzLbG+wlyMBKcj4gmE=
x-amz-request-id: 06G5T258TQ5HR3ZK
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Thu, 24 Mar 2022 17:17:45 GMT
x-amz-version-id: VXpBoMtHmKhxQd8oy46Im7ZYa3jC4nh4
etag: "6264a1e9b77fb62709fe17332fb61c63"
cf-cache-status: HIT
age: 251096
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZmnF3fXLpvm7%2B8a0fy%2BXN6uqDo2Dr199ayXaEvPCoYAO44awC9278Ijb1pOfdox3IifOqQMmMj4q6HzRjrH5SKHqRN77atZ4lshyZgrHlijGyQEQEsIb42OwKJk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a653e7bed05bec1-LHR
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/_next/static/chunks/pages/stepid-46a57750bc80809b.js

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /_next/static/chunks/pages/stepid-46a57750bc80809b.js HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-bgj: minify
etag: W/"14d39-1853e924baa"
last-modified: Fri, 23 Dec 2022 10:40:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 251096
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XQp%2FYeBqS5zhJ5is7vkSdg4cf9BN3Me%2BWjaay773rc0qJGUFEUcEgj5CkAceGKD%2FRu4Hk6uaG55%2Bak5OiD9hoWuzJy0Q3LFMth5TmYNLbYKVmYiiExde1TsbyPM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e7becffbec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/_next/static/U24YZNy5IhNICH6T1tM3N/_buildManifest.js

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /_next/static/U24YZNy5IhNICH6T1tM3N/_buildManifest.js HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-bgj: minify
cf-polished: origSize=66885
etag: W/"10545-1853e924baa"
last-modified: Fri, 23 Dec 2022 10:40:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 251096
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sVhaPunNhaCDDhwHmzv27Kdy4z2faUf3HK8MlGMBC0758FP6BJZV6p8XuDX0mAeKCQfb0NioaLKH1LHxwinuLCee5ChM%2BvxFtlyXSAihcfqUagpwqjlgmoORqPs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e7bed00bec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/_next/static/U24YZNy5IhNICH6T1tM3N/_ssgManifest.js

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /_next/static/U24YZNy5IhNICH6T1tM3N/_ssgManifest.js HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-bgj: minify
etag: W/"4d9-1853e924baa"
last-modified: Fri, 23 Dec 2022 10:40:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 251096
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BreTg2WJetX4rJfheitoDbedOTarlNGHPbLR49cX8UBf8h77wR3kxicDJfScjmeMYgTRohDiDtIAeUQqCbBwc78H9NUrqNF3eF%2BzMFrOOaO6UTuVtqOqv9b%2FALw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e7bed03bec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/cdn-cgi/apps/body/igzKfeQUrNHc0naBa2qmjkX4970.js

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /cdn-cgi/apps/body/igzKfeQUrNHc0naBa2qmjkX4970.js HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-bgj: minify
cf-polished: origSize=141058
etag: W/"22702-1853e924bac"
last-modified: Fri, 23 Dec 2022 10:40:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 251096
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xD87JZvNHipYj4jIhTcKGm5nN2i7QoTt5F9tI%2BYfktRsGnmXewIX9r2pWImWjTclP%2FtfCaVvEeF5yijVdL6PhMxegE2XwTNMAo8w71eP669c7k7MnG8KOoJIoBg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e7becf8bec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/_next/static/chunks/450-5c8498350627b338.js

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /_next/static/chunks/450-5c8498350627b338.js HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: application/signed-exchange;v=b3;q=0.9,*/*;q=0.8
purpose: prefetch
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-bgj: minify
etag: W/"1054-1853e924baa"
last-modified: Fri, 23 Dec 2022 10:40:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 250890
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yvxB2vnecqeCgskJzkOYyKsyg6a7f3rIcur8S3cPAHfK0%2FLyp8y3D80drSI%2FYU8tc%2BQIy2hmMPWQEXs6oj5bqVfUrTNHgtExAVnx7pR8%2F%2F1G58s%2BSFxRIRenruI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e7d3ea4bec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/_next/static/chunks/pages/index-9e96a9924046731a.js

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /_next/static/chunks/pages/index-9e96a9924046731a.js HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: application/signed-exchange;v=b3;q=0.9,*/*;q=0.8
purpose: prefetch
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-bgj: minify
etag: W/"3bbf-1853e924bab"
last-modified: Fri, 23 Dec 2022 10:40:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 250890
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2xaVTHrOudSNs%2FYMgbB5UwhSSjJ6qNDAfQi0Y1Jy9K4%2BBI6YyVVKWWm8koz8dYG6QDI3BQybMYra5G25yn3uYmtRffnG9m1PThymPKxoyPjBF1wmVKwyrYEz%2BmE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e7d3ea2bec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/_next/static/chunks/pages/faq-10d357850ccf4336.js

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /_next/static/chunks/pages/faq-10d357850ccf4336.js HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: application/signed-exchange;v=b3;q=0.9,*/*;q=0.8
purpose: prefetch
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-bgj: minify
etag: W/"3a7e-1853e924bac"
last-modified: Fri, 23 Dec 2022 10:40:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 250890
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I6nJnSXGz9BBkYLojIByHZMaJGlFDzi0dncYiHc%2B0mB98RLpzSP0eUHQrUwgv%2FVf0kP%2BRxv7jaFdztGJdHPLm6iZvW9a5%2BBF3R6%2BYBFAZ3Zu0u33uGoZ%2B1bEfQQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e7d3e9ebec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/_next/static/chunks/pages/login-135eb3a32f93fa35.js

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /_next/static/chunks/pages/login-135eb3a32f93fa35.js HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: application/signed-exchange;v=b3;q=0.9,*/*;q=0.8
purpose: prefetch
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-bgj: minify
etag: W/"1ba3-1853e924bab"
last-modified: Fri, 23 Dec 2022 10:40:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 250890
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=plpHzdD3utdnL9kaON5cDz%2F8%2BEC7MC2xaTJBXMGoBd9%2FLOFNBa3GYh0guIn7r7GuhHOlcH%2F0WhWUu3ClxufDgBER%2F37r8RLnSYYcF5H705MaZf3izZwk6TalJDI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e7d3eadbec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/_next/static/chunks/pages/privacy-5b025f7e994fa373.js

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /_next/static/chunks/pages/privacy-5b025f7e994fa373.js HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: application/signed-exchange;v=b3;q=0.9,*/*;q=0.8
purpose: prefetch
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-bgj: minify
etag: W/"2f9d-1853e924bac"
last-modified: Fri, 23 Dec 2022 10:40:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 250890
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BHZj%2BoIkjSqsycij55wyE8uQTneYaBNxuX7uMaKaAUMlNrEJnVQ%2Bth746pkuGMRV4Cb2rPazivdzmwPbZ81xdbIeWcwNpFM1ELpkurmSavBP2GZHmgAF4VVuN8s%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e7d3ea8bec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://api.mboost.me/v1/login/check

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /v1/login/check HTTP/2.0
host: api.mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
origin: https://mboost.me
sec-fetch-site: same-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: text/html; charset=utf-8
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
x-content-type-options: nosniff
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
access-control-allow-origin: https://mboost.me
vary: Origin
access-control-allow-credentials: true
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FlNCLSqzTLK9xTwr6FLBbdtGOcXTBCbA%2B0zdTo2T%2BkzTZmQvykl9VFhejiJWYzhlHFd4C3mutc3Q8%2BtuJHilHOGE8PWI%2BzDObB4koEFtZCKaPnTCygeeWXvEqUXtMomE"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653e7d8f3ebec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://mboost.me/favicon.ico

msedge.exe

Remote address:

172.67.214.146:443

Request

GET /favicon.ico HTTP/2.0
host: mboost.me
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://mboost.me/a/c12
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: _gid=GA1.2.2113206539.1721502550
cookie: _gat=1
cookie: _ga_5G1MH09G6M=GS1.1.1721502550.1.0.1721502550.0.0.0
cookie: _ga=GA1.1.1414229854.1721502550

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-type: image/x-icon
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
x-content-type-options: nosniff
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
cache-control: public, max-age=14400
last-modified: Fri, 24 Jan 2020 03:43:55 GMT
etag: W/"1fc8-16fd5a62de1"
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CcN%2FAys3ozxAZvBxt8EzrgGBmkgwp4NOZ3WaslPwp0yHCY2xmM9MY5czrDv1p7r54%2BNXU48hGjwC0W4z%2BSkKhgk1sVnrYWnahSaX9MpBw2OoIHSq04vDHFJZoOk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a653e814c01bec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
POST

https://api.mboost.me/v1/steps/https%3A%2F%2Fwww.youtube.com%2Fc%2Fzodiacexploits

msedge.exe

Remote address:

172.67.214.146:443

Request

POST /v1/steps/https%3A%2F%2Fwww.youtube.com%2Fc%2Fzodiacexploits HTTP/2.0
host: api.mboost.me
content-length: 0
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
origin: https://mboost.me
sec-fetch-site: same-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: _gid=GA1.2.2113206539.1721502550
cookie: _gat=1
cookie: _ga=GA1.1.1414229854.1721502550
cookie: _ga_5G1MH09G6M=GS1.1.1721502550.1.0.1721502553.0.0.0

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:16 GMT
content-type: text/html; charset=utf-8
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
x-content-type-options: nosniff
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
access-control-allow-origin: https://mboost.me
vary: Origin
access-control-allow-credentials: true
set-cookie: MBSec=s%3A6UfoEys6ByBOHYEDnPrpn6Xb93akbXqX.Jr5wqVL8U6dtdjSNDn1%2BKQ0ZyhUiVxCg5wz2BZtA210; Domain=.mboost.me; Path=/; Expires=Sun, 20 Jul 2025 19:09:16 GMT; Secure
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=alDECeh7wdOYQ3JHzST7quLU34KxsZjwZqQ6f1uyHZNc%2B%2FqGSZQePum0Lsk4mAGNEU%2FCUqp8byDHZIOD5aSrINeh8ppTsdWY7w8yuFpdlA2KXcQ8Oh%2Bp01VTay6GJim4"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a653ea2f949bec1-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
DNS

146.214.67.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

146.214.67.172.in-addr.arpa

IN PTR

Response
DNS

146.214.67.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

146.214.67.172.in-addr.arpa

IN PTR

Response
DNS

api.mboost.me

msedge.exe

Remote address:

8.8.8.8:53

Request

api.mboost.me

IN A

Response

api.mboost.me

IN A

172.67.214.146

api.mboost.me

IN A

104.21.67.56
DNS

api.mboost.me

msedge.exe

Remote address:

8.8.8.8:53

Request

api.mboost.me

IN A

Response

api.mboost.me

IN A

172.67.214.146

api.mboost.me

IN A

104.21.67.56
DNS

cdn.wearedevs.net

msedge.exe

Remote address:

8.8.8.8:53

Request

cdn.wearedevs.net

IN A

Response

cdn.wearedevs.net

IN A

104.26.6.147

cdn.wearedevs.net

IN A

172.67.71.2

cdn.wearedevs.net

IN A

104.26.7.147
DNS

cdn.wearedevs.net

msedge.exe

Remote address:

8.8.8.8:53

Request

cdn.wearedevs.net

IN A

Response

cdn.wearedevs.net

IN A

172.67.71.2

cdn.wearedevs.net

IN A

104.26.6.147

cdn.wearedevs.net

IN A

104.26.7.147
DNS

resources.infolinks.com

msedge.exe

Remote address:

8.8.8.8:53

Request

resources.infolinks.com

IN A

Response

resources.infolinks.com

IN A

172.66.42.247

resources.infolinks.com

IN A

172.66.41.9
DNS

resources.infolinks.com

msedge.exe

Remote address:

8.8.8.8:53

Request

resources.infolinks.com

IN A

Response

resources.infolinks.com

IN A

172.66.41.9

resources.infolinks.com

IN A

172.66.42.247
GET

https://resources.infolinks.com/js/infolinks_main.js

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /js/infolinks_main.js HTTP/2.0
host: resources.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript
last-modified: Thu, 18 Jul 2024 11:12:27 GMT
etag: W/"10f0-61d83a7774ca9"
cache-control: max-age=3600
expires: Sat, 20 Jul 2024 16:12:58 GMT
via: 1.1 google
cf-cache-status: HIT
age: 14172
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a653e7e58a963d4-LHR
content-encoding: br
GET

https://resources.infolinks.com/js/1941.019-3.034/ice.js

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /js/1941.019-3.034/ice.js HTTP/2.0
host: resources.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:10 GMT
content-type: application/javascript
last-modified: Tue, 09 Jul 2024 14:35:57 GMT
etag: W/"2f9a1-61cd172a052d4"
cache-control: max-age=2592000
expires: Mon, 19 Aug 2024 15:43:12 GMT
via: 1.1 google
cf-cache-status: HIT
age: 12358
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a653e7ee9a163d4-LHR
content-encoding: br
GET

https://router.infolinks.com/usync/manage?pid=3188496&wsid=0&pdom=mboost.me&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /usync/manage?pid=3188496&wsid=0&pdom=mboost.me&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12 HTTP/2.0
host: router.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-type: text/javascript;charset=UTF-8
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: max-age=0
p3p: CP="NON DSP NID OUR COR"
set-cookie: cuid=72263127-bb8d-4ad8-950c-204590aea808; Domain=infolinks.com; Expires=Mon, 20-Jul-2026 19:09:11 GMT; Path=/; SameSite=None; Secure
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a653e800ae263d4-LHR
content-encoding: br
GET

https://router.infolinks.com/gsd?evt=afterGSD&pid=3188496&wsid=0&pdom=mboost.me&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&jsv=1941.019-3.034&_cb=17215025504730

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /gsd?evt=afterGSD&pid=3188496&wsid=0&pdom=mboost.me&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&jsv=1941.019-3.034&_cb=17215025504730 HTTP/2.0
host: router.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-length: 0
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a653e800ae363d4-LHR
GET

https://router.infolinks.com/usync/lcmanage?pid=3188496&wsid=0&pdom=mboost.me&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /usync/lcmanage?pid=3188496&wsid=0&pdom=mboost.me&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12 HTTP/2.0
host: router.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-length: 0
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a653e800ae063d4-LHR
POST

https://rt3001.infolinks.com/action/doq.htm?pcode=utf-8&r=17215025506971

msedge.exe

Remote address:

172.66.42.247:443

Request

POST /action/doq.htm?pcode=utf-8&r=17215025506971 HTTP/2.0
host: rt3001.infolinks.com
content-length: 1236
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
content-type: application/x-www-form-urlencoded
accept: */*
origin: https://mboost.me
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-type: text/html;charset=UTF-8
x-application-context: application:prod
access-control-allow-origin: https://mboost.me
vary: Origin
access-control-allow-credentials: true
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: cuid=72263127-bb8d-4ad8-950c-204590aea808; Domain=infolinks.com; Expires=Mon, 20-Jul-2026 19:09:11 GMT; Path=/; SameSite=None
p3p: CP="NON DSP NID OUR COR"
content-language: en-US
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a653e817c9a63d4-LHR
content-encoding: br
GET

https://resources.infolinks.com/js/1941.019-3.034/in_search.js

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /js/1941.019-3.034/in_search.js HTTP/2.0
host: resources.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-type: application/javascript
last-modified: Tue, 09 Jul 2024 14:35:57 GMT
etag: W/"2702f-61cd172a04eec"
cache-control: max-age=2592000
expires: Mon, 19 Aug 2024 15:40:49 GMT
via: 1.1 google
cf-cache-status: HIT
age: 12502
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a653e82ae1c63d4-LHR
content-encoding: br
GET

https://resources.infolinks.com/js/1941.019-3.034/bubble.js

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /js/1941.019-3.034/bubble.js HTTP/2.0
host: resources.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-type: application/javascript
last-modified: Tue, 09 Jul 2024 14:35:57 GMT
etag: W/"3a858-61cd172a052d4"
cache-control: max-age=2592000
expires: Mon, 19 Aug 2024 15:52:49 GMT
via: 1.1 google
cf-cache-status: HIT
age: 11782
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a653e82ae1963d4-LHR
content-encoding: br
GET

https://resources.infolinks.com/js/1941.019-3.034/in_text.js

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /js/1941.019-3.034/in_text.js HTTP/2.0
host: resources.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-type: application/javascript
last-modified: Tue, 09 Jul 2024 14:35:57 GMT
etag: W/"295a-61cd172a05aa5"
cache-control: max-age=2592000
expires: Mon, 19 Aug 2024 17:37:35 GMT
via: 1.1 google
cf-cache-status: HIT
age: 5496
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a653e832eb163d4-LHR
content-encoding: br
GET

https://resources.infolinks.com/js/1941.019-3.034/intag_incontent.js

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /js/1941.019-3.034/intag_incontent.js HTTP/2.0
host: resources.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-type: application/javascript
last-modified: Tue, 09 Jul 2024 14:35:57 GMT
etag: W/"31bea-61cd172a06275"
cache-control: max-age=2592000
expires: Mon, 19 Aug 2024 16:03:08 GMT
via: 1.1 google
cf-cache-status: HIT
age: 11163
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a653e832eb263d4-LHR
content-encoding: br
GET

https://rt3001.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A1%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A0%2C%22sdata%22%3A%22the%20buttons%22%2C%22scs%22%3A%22JUVgi0PldI%22%7D%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502551026&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A1%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A0%2C%22sdata%22%3A%22the%20buttons%22%2C%22scs%22%3A%22JUVgi0PldI%22%7D%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502551026&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-type: image/gif
content-length: 962
cache-control: max-age=2592000
cf-bgj: imgq:85,h2pri
cf-polished: origSize=1631, status=webp_bigger
etag: "65f-5f7533fb919ab"
expires: Mon, 19 Aug 2024 17:46:31 GMT
last-modified: Mon, 20 Mar 2023 11:30:06 GMT
via: 1.1 google
cf-cache-status: HIT
age: 4960
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a653e83cf7463d4-LHR
GET

https://resources.infolinks.com/static/skins/loader.gif

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /static/skins/loader.gif HTTP/2.0
host: resources.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-type: image/webp
content-length: 902
cache-control: max-age=2592000
cf-bgj: imgq:85,h2pri
cf-polished: origFmt=png, origSize=1488
content-disposition: inline; filename="loader-bg.webp"
vary: Accept
etag: "5d0-5f7533fb6c3f6"
expires: Mon, 19 Aug 2024 18:58:43 GMT
last-modified: Mon, 20 Mar 2023 11:30:06 GMT
via: 1.1 google
cf-cache-status: HIT
age: 628
accept-ranges: bytes
server: cloudflare
cf-ray: 8a653e83cf7663d4-LHR
GET

https://resources.infolinks.com/static/skins/loader-bg.png

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /static/skins/loader-bg.png HTTP/2.0
host: resources.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-type: text/html;charset=UTF-8
content-length: 0
x-application-context: application:prod
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a653e83cf8263d4-LHR
GET

https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&capara=%7B%22failedAlgos%22%3A%22aapalgo%22%7D

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&capara=%7B%22failedAlgos%22%3A%22aapalgo%22%7D HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-type: text/plain;charset=UTF-8
content-length: 0
x-application-context: application:prod
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a653e83cf7e63d4-LHR
GET

https://rt3001.infolinks.com/action/getads.htm?hks=%5B%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502551119&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/getads.htm?hks=%5B%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502551119&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-type: text/html;charset=UTF-8
content-length: 0
x-application-context: application:prod
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a653e83cf7963d4-LHR
GET

https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&capara=%7B%22mode%22%3A%22default%22%2C%22markers%22%3A0%7D

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&capara=%7B%22mode%22%3A%22default%22%2C%22markers%22%3A0%7D HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:12 GMT
content-type: text/html;charset=UTF-8
x-application-context: application:prod
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NON DSP NID OUR COR"
content-language: en-US
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a653e833ed263d4-LHR
content-encoding: br
GET

https://rt3001.infolinks.com/action/adview.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&bdc=1&midx=0&emd=NTd-bnVsbF9tYWN5c18zMDB4MjUw&rts=1721502551697&prod_t=d&jsv=1941.019-3.034&skin=sidebar&theme=def&sdata=the%20buttons&scs=JUVgi0PldI&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/adview.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&bdc=1&midx=0&emd=NTd-bnVsbF9tYWN5c18zMDB4MjUw&rts=1721502551697&prod_t=d&jsv=1941.019-3.034&skin=sidebar&theme=def&sdata=the%20buttons&scs=JUVgi0PldI&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
origin: https://mboost.me
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:12 GMT
content-type: image/webp
content-length: 18338
cache-control: max-age=2592000
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=28867
content-disposition: inline; filename="macys_300x250.webp"
vary: Accept
etag: "70c3-5f7533fc20aef"
expires: Mon, 19 Aug 2024 16:37:34 GMT
last-modified: Mon, 20 Mar 2023 11:30:07 GMT
via: 1.1 google
cf-cache-status: HIT
age: 9098
accept-ranges: bytes
server: cloudflare
cf-ray: 8a653e877cb763d4-LHR
GET

https://resources.infolinks.com/static/brands/macys_300x250.jpg

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /static/brands/macys_300x250.jpg HTTP/2.0
host: resources.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:12 GMT
content-type: text/html;charset=UTF-8
content-length: 0
x-application-context: application:prod
access-control-allow-origin: https://mboost.me
vary: Origin
access-control-allow-credentials: true
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: tv=|NTd-bnVsbF9tYWN5c18zMDB4MjUw~1; Domain=infolinks.com; Expires=Sun, 21-Jul-2024 06:59:59 GMT; Path=/; SameSite=None
p3p: CP="NON DSP NID OUR COR"
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a653e876c9e63d4-LHR
GET

https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&prod_t=d&sdata=the%20buttons&bdc=1&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&prod_t=d&sdata=the%20buttons&bdc=1&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:13 GMT
content-type: text/html;charset=UTF-8
content-length: 0
x-application-context: application:prod
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a653e8ddc8563d4-LHR
GET

https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&capara=%7B%22error%22%3A%22ICE_HB%20was%20not%20found%20on%20window%20-%20init%20not%20fired.%22%7D

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&capara=%7B%22error%22%3A%22ICE_HB%20was%20not%20found%20on%20window%20-%20init%20not%20fired.%22%7D HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:41 GMT
content-type: text/html;charset=UTF-8
content-length: 0
x-application-context: application:prod
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a653f3ca94763d4-LHR
GET

https://rt3001.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A2%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A1%2C%22as%22%3A%22300*250~400*300%22%2C%22sdata%22%3A%22the%20buttons%22%2C%22scs%22%3A%22JUVgi0PldI%22%7D%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502581699&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A2%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A1%2C%22as%22%3A%22300*250~400*300%22%2C%22sdata%22%3A%22the%20buttons%22%2C%22scs%22%3A%22JUVgi0PldI%22%7D%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502581699&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:42 GMT
content-type: text/html;charset=UTF-8
x-application-context: application:prod
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NON DSP NID OUR COR"
content-language: en-US
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a653f42e9da63d4-LHR
content-encoding: br
GET

https://rt3001.infolinks.com/action/adview.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&bdc=2&midx=0&emd=NTd-bnVsbF9zZWFtbGVzc19waXp6YV8zMDB4MjUw&rts=1721502582301&prod_t=d&jsv=1941.019-3.034&skin=sidebar&theme=def&sdata=the%20buttons&scs=JUVgi0PldI&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/adview.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&bdc=2&midx=0&emd=NTd-bnVsbF9zZWFtbGVzc19waXp6YV8zMDB4MjUw&rts=1721502582301&prod_t=d&jsv=1941.019-3.034&skin=sidebar&theme=def&sdata=the%20buttons&scs=JUVgi0PldI&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
origin: https://mboost.me
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:42 GMT
content-type: image/webp
content-length: 28400
cache-control: max-age=2592000
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=41655
content-disposition: inline; filename="seamless_pizza_300x250.webp"
vary: Accept
etag: "a2b7-5f7533fc22260"
expires: Mon, 19 Aug 2024 17:22:15 GMT
last-modified: Mon, 20 Mar 2023 11:30:07 GMT
via: 1.1 google
cf-cache-status: HIT
age: 6447
accept-ranges: bytes
server: cloudflare
cf-ray: 8a653f46bee863d4-LHR
GET

https://resources.infolinks.com/static/brands/seamless_pizza_300x250.jpg

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /static/brands/seamless_pizza_300x250.jpg HTTP/2.0
host: resources.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:42 GMT
content-type: text/html;charset=UTF-8
content-length: 0
x-application-context: application:prod
access-control-allow-origin: https://mboost.me
vary: Origin
access-control-allow-credentials: true
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: tv=|NTd-bnVsbF9zZWFtbGVzc19waXp6YV8zMDB4MjUw~1; Domain=infolinks.com; Expires=Sun, 21-Jul-2024 06:59:59 GMT; Path=/; SameSite=None
p3p: CP="NON DSP NID OUR COR"
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a653f46aede63d4-LHR
GET

https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&prod_t=d&sdata=the%20buttons&bdc=2&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&prod_t=d&sdata=the%20buttons&bdc=2&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:43 GMT
content-type: text/html;charset=UTF-8
content-length: 0
x-application-context: application:prod
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a653f4cff9863d4-LHR
GET

https://rt3001.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A3%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A2%2C%22as%22%3A%22300*250~400*300%22%2C%22sdata%22%3A%22the%20buttons%22%2C%22scs%22%3A%22JUVgi0PldI%22%7D%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502612304&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A3%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A2%2C%22as%22%3A%22300*250~400*300%22%2C%22sdata%22%3A%22the%20buttons%22%2C%22scs%22%3A%22JUVgi0PldI%22%7D%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502612304&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:10:13 GMT
content-type: text/html;charset=UTF-8
x-application-context: application:prod
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NON DSP NID OUR COR"
content-language: en-US
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a6540023cf863d4-LHR
content-encoding: br
GET

https://rt3001.infolinks.com/action/adview.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&bdc=3&midx=0&emd=NTd-bnVsbF9zZWFtbGVzc19waXp6YV8zMDB4MjUw&rts=1721502612817&prod_t=d&jsv=1941.019-3.034&skin=sidebar&theme=def&sdata=the%20buttons&scs=JUVgi0PldI&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/adview.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&bdc=3&midx=0&emd=NTd-bnVsbF9zZWFtbGVzc19waXp6YV8zMDB4MjUw&rts=1721502612817&prod_t=d&jsv=1941.019-3.034&skin=sidebar&theme=def&sdata=the%20buttons&scs=JUVgi0PldI&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
origin: https://mboost.me
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:10:13 GMT
content-type: text/html;charset=UTF-8
content-length: 0
x-application-context: application:prod
access-control-allow-origin: https://mboost.me
vary: Origin
access-control-allow-credentials: true
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: tv=|NTd-bnVsbF9zZWFtbGVzc19waXp6YV8zMDB4MjUw~1; Domain=infolinks.com; Expires=Sun, 21-Jul-2024 06:59:59 GMT; Path=/; SameSite=None
p3p: CP="NON DSP NID OUR COR"
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a654005686163d4-LHR
GET

https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&prod_t=d&sdata=the%20buttons&bdc=3&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&prod_t=d&sdata=the%20buttons&bdc=3&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:10:14 GMT
content-type: text/html;charset=UTF-8
content-length: 0
x-application-context: application:prod
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a65400bbf5963d4-LHR
GET

https://rt3001.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A4%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A3%2C%22as%22%3A%22300*250~400*300%22%2C%22sdata%22%3A%22the%20buttons%22%2C%22scs%22%3A%22JUVgi0PldI%22%7D%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502642826&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A4%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A3%2C%22as%22%3A%22300*250~400*300%22%2C%22sdata%22%3A%22the%20buttons%22%2C%22scs%22%3A%22JUVgi0PldI%22%7D%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502642826&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:10:43 GMT
content-type: text/html;charset=UTF-8
x-application-context: application:prod
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NON DSP NID OUR COR"
content-language: en-US
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a6540c0f9a063d4-LHR
content-encoding: br
GET

https://rt3001.infolinks.com/action/adview.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&bdc=4&midx=0&emd=NTd-bnVsbF9tYWNfMzAweDI1MA&rts=1721502643346&prod_t=d&jsv=1941.019-3.034&skin=sidebar&theme=def&sdata=the%20buttons&scs=JUVgi0PldI&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/adview.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&bdc=4&midx=0&emd=NTd-bnVsbF9tYWNfMzAweDI1MA&rts=1721502643346&prod_t=d&jsv=1941.019-3.034&skin=sidebar&theme=def&sdata=the%20buttons&scs=JUVgi0PldI&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
origin: https://mboost.me
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:10:43 GMT
content-type: image/webp
content-length: 11528
cache-control: max-age=2592000
cf-bgj: imgq:85,h2pri
cf-polished: qual=85, origFmt=jpeg, origSize=26790
content-disposition: inline; filename="mac_300x250.webp"
vary: Accept
etag: "68a6-5f7533fc22a30"
expires: Mon, 19 Aug 2024 18:20:05 GMT
last-modified: Mon, 20 Mar 2023 11:30:07 GMT
via: 1.1 google
cf-cache-status: HIT
age: 3038
accept-ranges: bytes
server: cloudflare
cf-ray: 8a6540c43da063d4-LHR
GET

https://resources.infolinks.com/static/brands/mac_300x250.jpg

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /static/brands/mac_300x250.jpg HTTP/2.0
host: resources.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:10:43 GMT
content-type: text/html;charset=UTF-8
content-length: 0
x-application-context: application:prod
access-control-allow-origin: https://mboost.me
vary: Origin
access-control-allow-credentials: true
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: tv=|NTd-bnVsbF9tYWNfMzAweDI1MA~1; Domain=infolinks.com; Expires=Sun, 21-Jul-2024 06:59:59 GMT; Path=/; SameSite=None
p3p: CP="NON DSP NID OUR COR"
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a6540c43d9363d4-LHR
GET

https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&prod_t=d&sdata=the%20buttons&bdc=4&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D

msedge.exe

Remote address:

172.66.42.247:443

Request

GET /action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&prod_t=d&sdata=the%20buttons&bdc=4&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D HTTP/2.0
host: rt3001.infolinks.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:10:45 GMT
content-type: text/html;charset=UTF-8
content-length: 0
x-application-context: application:prod
cache-control: no-cache,no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a6540ca8e0863d4-LHR
GET

https://cdn.wearedevs.net/images/icons/twitter.png

msedge.exe

Remote address:

104.26.6.147:443

Request

GET /images/icons/twitter.png HTTP/2.0
host: cdn.wearedevs.net
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Sat, 20 Jul 2024 19:09:11 GMT
content-type: image/webp
content-length: 316
cache-control: max-age=2592000
cache-control: public
cf-bgj: imgq:100,h2pri
cf-polished: origFmt=png, origSize=670
content-disposition: inline; filename="twitter.webp"
etag: "61c62c55-29e"
expires: Fri, 16 Aug 2024 21:01:23 GMT
last-modified: Fri, 24 Dec 2021 20:23:49 GMT
vary: Accept
cf-cache-status: HIT
age: 252318
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wAUuYUl00u4ufxcw5zlx%2B0t3vOKPYighy4g2IBrGs7jPV%2FvWVJE7eiCrrIRO%2FGC4gCaNsRRp6S9172Z9WakVotIl10sopZgYdsqLI3xYMDONj2rQjRE%2F7E8y29xTJJfIbPe7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=0nbeVHJe_nbkxehU6e.DMk67HKyV3yToV4B5RoqciGU-1721502551-1.0.1.1-6KMLL1dBl7.mRcJjaGTk5TDcv.tI72CSkeDn2m5RxyMueICHsHOKM07SB4XryA2G1at.V7vRcsu3EQ8Hzx_QYNhslCEF.q1YHxlO09kTVebfSymcCFjx2Z0aXrcKlaaCCkZV1TJ7iB.AK5x0eu.jFry3kwy3XG.rYl2393cJrhk"}],"group":"cf-csp-endpoint","max_age":86400}
content-security-policy-report-only: script-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=0nbeVHJe_nbkxehU6e.DMk67HKyV3yToV4B5RoqciGU-1721502551-1.0.1.1-6KMLL1dBl7.mRcJjaGTk5TDcv.tI72CSkeDn2m5RxyMueICHsHOKM07SB4XryA2G1at.V7vRcsu3EQ8Hzx_QYNhslCEF.q1YHxlO09kTVebfSymcCFjx2Z0aXrcKlaaCCkZV1TJ7iB.AK5x0eu.jFry3kwy3XG.rYl2393cJrhk; report-to cf-csp-endpoint
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 8a653e80cc08bec4-LHR
alt-svc: h3=":443"; ma=86400
DNS

apps.identrust.com

msedge.exe

Remote address:

8.8.8.8:53

Request

apps.identrust.com

IN A

Response

apps.identrust.com

IN CNAME

identrust.edgesuite.net

identrust.edgesuite.net

IN CNAME

a1952.dscq.akamai.net

a1952.dscq.akamai.net

IN A

2.18.190.81

a1952.dscq.akamai.net

IN A

2.18.190.80
DNS

apps.identrust.com

msedge.exe

Remote address:

8.8.8.8:53

Request

apps.identrust.com

IN A

Response

apps.identrust.com

IN CNAME

identrust.edgesuite.net

identrust.edgesuite.net

IN CNAME

a1952.dscq.akamai.net

a1952.dscq.akamai.net

IN A

2.18.190.81

a1952.dscq.akamai.net

IN A

2.18.190.80
DNS

region1.google-analytics.com

msedge.exe

Remote address:

8.8.8.8:53

Request

region1.google-analytics.com

IN A

Response

region1.google-analytics.com

IN A

216.239.32.36

region1.google-analytics.com

IN A

216.239.34.36
DNS

region1.google-analytics.com

msedge.exe

Remote address:

8.8.8.8:53

Request

region1.google-analytics.com

IN A

Response

region1.google-analytics.com

IN A

216.239.34.36

region1.google-analytics.com

IN A

216.239.32.36
GET

http://apps.identrust.com/roots/dstrootcax3.p7c

msedge.exe

Remote address:

2.18.190.81:80

Request

GET /roots/dstrootcax3.p7c HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: apps.identrust.com

Response

HTTP/1.1 200 OK

X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex
Referrer-Policy: same-origin
Last-Modified: Wed, 08 Feb 2023 16:52:56 GMT
ETag: "37d-5f433188daa00"
Accept-Ranges: bytes
Content-Length: 893
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
Content-Type: application/pkcs7-mime
Cache-Control: max-age=3600
Expires: Sat, 20 Jul 2024 20:09:10 GMT
Date: Sat, 20 Jul 2024 19:09:10 GMT
Connection: keep-alive
POST

https://region1.google-analytics.com/g/collect?v=2&tid=G-5G1MH09G6M&gtm=45je47h0v872206000za200&_p=1721502549939&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1414229854.1721502550&ul=en-us&sr=1280x720&uaa=x86&uamb=0&uam=&uap=Windows&uapv=10.0&uaw=0&frm=0&pscdl=noapi&_s=1&sid=1721502550&sct=1&seg=0&dl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&dt=Check%20us%20out%20first!%20%7C%20MediaBooster&en=page_view&_fv=1&_ss=1&_ee=1&tfd=951&_z=fetch

msedge.exe

Remote address:

216.239.32.36:443

Request

POST /g/collect?v=2&tid=G-5G1MH09G6M&gtm=45je47h0v872206000za200&_p=1721502549939&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1414229854.1721502550&ul=en-us&sr=1280x720&uaa=x86&uamb=0&uam=&uap=Windows&uapv=10.0&uaw=0&frm=0&pscdl=noapi&_s=1&sid=1721502550&sct=1&seg=0&dl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&dt=Check%20us%20out%20first!%20%7C%20MediaBooster&en=page_view&_fv=1&_ss=1&_ee=1&tfd=951&_z=fetch HTTP/2.0
host: region1.google-analytics.com
content-length: 0
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
origin: https://mboost.me
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

router.infolinks.com

msedge.exe

Remote address:

8.8.8.8:53

Request

router.infolinks.com

IN A

Response

router.infolinks.com

IN A

172.66.42.247

router.infolinks.com

IN A

172.66.41.9
DNS

router.infolinks.com

msedge.exe

Remote address:

8.8.8.8:53

Request

router.infolinks.com

IN A

Response

router.infolinks.com

IN A

172.66.42.247

router.infolinks.com

IN A

172.66.41.9
DNS

rt3001.infolinks.com

msedge.exe

Remote address:

8.8.8.8:53

Request

rt3001.infolinks.com

IN A

Response

rt3001.infolinks.com

IN A

172.66.41.9

rt3001.infolinks.com

IN A

172.66.42.247
DNS

rt3001.infolinks.com

msedge.exe

Remote address:

8.8.8.8:53

Request

rt3001.infolinks.com

IN A

Response

rt3001.infolinks.com

IN A

172.66.42.247

rt3001.infolinks.com

IN A

172.66.41.9
DNS

72.169.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

72.169.217.172.in-addr.arpa

IN PTR

Response

72.169.217.172.in-addr.arpa

IN PTR

lhr48s09-in-f81e100net
DNS

72.169.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

72.169.217.172.in-addr.arpa

IN PTR

Response

72.169.217.172.in-addr.arpa

IN PTR

lhr48s09-in-f81e100net
DNS

78.204.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

78.204.58.216.in-addr.arpa

IN PTR

Response

78.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f781e100net

78.204.58.216.in-addr.arpa

IN PTR

lhr48s49-in-f14�H

78.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f14�H
DNS

78.204.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

78.204.58.216.in-addr.arpa

IN PTR

Response

78.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f141e100net

78.204.58.216.in-addr.arpa

IN PTR

lhr48s49-in-f14�H

78.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f78�H
DNS

247.42.66.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

247.42.66.172.in-addr.arpa

IN PTR

Response
DNS

247.42.66.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

247.42.66.172.in-addr.arpa

IN PTR

Response
DNS

147.6.26.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

147.6.26.104.in-addr.arpa

IN PTR

Response
DNS

147.6.26.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

147.6.26.104.in-addr.arpa

IN PTR

Response
DNS

81.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

81.190.18.2.in-addr.arpa

IN PTR

Response

81.190.18.2.in-addr.arpa

IN PTR

a2-18-190-81deploystaticakamaitechnologiescom
DNS

81.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

81.190.18.2.in-addr.arpa

IN PTR

Response

81.190.18.2.in-addr.arpa

IN PTR

a2-18-190-81deploystaticakamaitechnologiescom
DNS

36.32.239.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

36.32.239.216.in-addr.arpa

IN PTR

Response
DNS

36.32.239.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

36.32.239.216.in-addr.arpa

IN PTR

Response
DNS

imasdk.googleapis.com

msedge.exe

Remote address:

8.8.8.8:53

Request

imasdk.googleapis.com

IN A

Response

imasdk.googleapis.com

IN A

142.250.180.10
DNS

imasdk.googleapis.com

msedge.exe

Remote address:

8.8.8.8:53

Request

imasdk.googleapis.com

IN A

Response

imasdk.googleapis.com

IN A

142.250.180.10
GET

https://imasdk.googleapis.com/js/sdkloader/ima3.js

msedge.exe

Remote address:

142.250.180.10:443

Request

GET /js/sdkloader/ima3.js HTTP/2.0
host: imasdk.googleapis.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

securepubads.g.doubleclick.net

msedge.exe

Remote address:

8.8.8.8:53

Request

securepubads.g.doubleclick.net

IN A

Response

securepubads.g.doubleclick.net

IN A

142.250.179.226
DNS

securepubads.g.doubleclick.net

msedge.exe

Remote address:

8.8.8.8:53

Request

securepubads.g.doubleclick.net

IN A

Response

securepubads.g.doubleclick.net

IN A

142.250.179.226
GET

https://securepubads.g.doubleclick.net/pagead/ima_ppub_config?ippd=https%3A%2F%2Fmboost.me%2Fa%2Fc12

msedge.exe

Remote address:

142.250.179.226:443

Request

GET /pagead/ima_ppub_config?ippd=https%3A%2F%2Fmboost.me%2Fa%2Fc12 HTTP/2.0
host: securepubads.g.doubleclick.net
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
origin: https://mboost.me
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://mboost.me/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

10.180.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

10.180.250.142.in-addr.arpa

IN PTR

Response

10.180.250.142.in-addr.arpa

IN PTR

lhr25s32-in-f101e100net
DNS

10.180.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

10.180.250.142.in-addr.arpa

IN PTR

Response

10.180.250.142.in-addr.arpa

IN PTR

lhr25s32-in-f101e100net
DNS

226.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

226.179.250.142.in-addr.arpa

IN PTR

Response

226.179.250.142.in-addr.arpa

IN PTR

lhr25s31-in-f21e100net
DNS

226.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

226.179.250.142.in-addr.arpa

IN PTR

Response

226.179.250.142.in-addr.arpa

IN PTR

lhr25s31-in-f21e100net
DNS

yt3.googleusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

yt3.googleusercontent.com

IN A

Response

yt3.googleusercontent.com

IN A

142.250.178.1
DNS

yt3.googleusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

yt3.googleusercontent.com

IN A

Response

yt3.googleusercontent.com

IN A

142.250.178.1
GET

https://yt3.googleusercontent.com/t6aV4H3yhpqFutVJvhoh0sCx6J5_sJQIw8htebSia9pCEe8RzMs_HF7KD3xtkq4vsfqDpwmi=s160-c-k-c0x00ffffff-no-rj

msedge.exe

Remote address:

142.250.178.1:443

Request

GET /t6aV4H3yhpqFutVJvhoh0sCx6J5_sJQIw8htebSia9pCEe8RzMs_HF7KD3xtkq4vsfqDpwmi=s160-c-k-c0x00ffffff-no-rj HTTP/2.0
host: yt3.googleusercontent.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://yt3.googleusercontent.com/LwpYyREjQXYfSbZJt9k-8119bZA9bEfkOhFPi--bYUZLEtXEJ6qh1-cByXz5FIdMlXwb2sCt=w1707-fcrop64=1,00005a57ffffa5a8-k-c0xffffffff-no-nd-rj

msedge.exe

Remote address:

142.250.178.1:443

Request

GET /LwpYyREjQXYfSbZJt9k-8119bZA9bEfkOhFPi--bYUZLEtXEJ6qh1-cByXz5FIdMlXwb2sCt=w1707-fcrop64=1,00005a57ffffa5a8-k-c0xffffffff-no-nd-rj HTTP/2.0
host: yt3.googleusercontent.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://www.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

1.178.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.178.250.142.in-addr.arpa

IN PTR

Response

1.178.250.142.in-addr.arpa

IN PTR

lhr48s27-in-f11e100net
DNS

1.178.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.178.250.142.in-addr.arpa

IN PTR

Response

1.178.250.142.in-addr.arpa

IN PTR

lhr48s27-in-f11e100net
DNS

19.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.229.111.52.in-addr.arpa

IN PTR

Response
DNS

19.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.229.111.52.in-addr.arpa

IN PTR

Response
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

ax-0001.ax-msedge.net

ax-0001.ax-msedge.net

IN A

150.171.27.10

ax-0001.ax-msedge.net

IN A

150.171.28.10
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

ax-0001.ax-msedge.net

ax-0001.ax-msedge.net

IN A

150.171.27.10

ax-0001.ax-msedge.net

IN A

150.171.28.10
GET

https://tse1.mm.bing.net/th?id=OADD2.10239339388051_1DI9F3V3Y6K7A0KMB&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.27.10:443

Request

GET /th?id=OADD2.10239339388051_1DI9F3V3Y6K7A0KMB&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 626199
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 69AFBD81B3F341719B987080F4A286DF Ref B: LON04EDGE1120 Ref C: 2024-07-20T19:10:18Z
date: Sat, 20 Jul 2024 19:10:17 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239339388050_13LHMV8LNZUBG68MF&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.27.10:443

Request

GET /th?id=OADD2.10239339388050_13LHMV8LNZUBG68MF&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 715625
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5140D520652B44E8AB20B9D28B64C9AC Ref B: LON04EDGE1120 Ref C: 2024-07-20T19:10:18Z
date: Sat, 20 Jul 2024 19:10:17 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301063_149G85DV7JWSKM1IM&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.27.10:443

Request

GET /th?id=OADD2.10239317301063_149G85DV7JWSKM1IM&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 736378
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 93CCDA02BB1E42C89968A6BFA5D3CB0B Ref B: LON04EDGE1120 Ref C: 2024-07-20T19:10:18Z
date: Sat, 20 Jul 2024 19:10:17 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301496_1OD7PWAV06HYZ5MV4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.27.10:443

Request

GET /th?id=OADD2.10239317301496_1OD7PWAV06HYZ5MV4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 826023
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5AB6730E0A1A40EA939000240830974A Ref B: LON04EDGE1120 Ref C: 2024-07-20T19:10:18Z
date: Sat, 20 Jul 2024 19:10:17 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340418559_1LXGGCLQWFST3067K&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.27.10:443

Request

GET /th?id=OADD2.10239340418559_1LXGGCLQWFST3067K&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 540045
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3382126DAB6E4A89ADD910CE35AB31EE Ref B: LON04EDGE1120 Ref C: 2024-07-20T19:10:18Z
date: Sat, 20 Jul 2024 19:10:17 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340418560_12H05GS2AXF1O4KMU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.27.10:443

Request

GET /th?id=OADD2.10239340418560_12H05GS2AXF1O4KMU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 512342
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 077812A623884F40951218AEAEFE01FD Ref B: LON04EDGE1120 Ref C: 2024-07-20T19:10:19Z
date: Sat, 20 Jul 2024 19:10:18 GMT
DNS

26.35.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.35.223.20.in-addr.arpa

IN PTR

Response
DNS

26.35.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.35.223.20.in-addr.arpa

IN PTR

Response

216.58.201.110:443

https://consent.youtube.com/save?continue=https://www.youtube.com/watch%3Fv%3DMrSAkJZ31lA%26feature%3Dyoutu.be&gl=GB&m=0&pc=yt&x=5&src=2&hl=en&bl=653459994&cm=2&set_eom=true

tls, http2

msedge.exe

82.4kB
2.8MB
1417
2057

HTTP Request

GET https://youtu.be/MrSAkJZ31lA

HTTP Request

GET https://www.youtube.com/watch?v=MrSAkJZ31lA&feature=youtu.be

HTTP Request

GET https://www.youtube.com/s/player/d60b0ef9/player_ias.vflset/en_US/base.js

HTTP Request

GET https://www.youtube.com/s/desktop/060ac52e/jsbin/desktop_polymer.vflset/desktop_polymer.js

HTTP Request

GET https://www.youtube.com/s/desktop/060ac52e/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js

HTTP Request

GET https://www.youtube.com/s/desktop/060ac52e/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js

HTTP Request

GET https://www.youtube.com/s/desktop/060ac52e/jsbin/webcomponents-sd.vflset/webcomponents-sd.js

HTTP Request

GET https://www.youtube.com/s/desktop/060ac52e/jsbin/intersection-observer.min.vflset/intersection-observer.min.js

HTTP Request

GET https://www.youtube.com/s/desktop/060ac52e/jsbin/scheduler.vflset/scheduler.js

HTTP Request

GET https://www.youtube.com/s/desktop/060ac52e/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js

HTTP Request

GET https://www.youtube.com/s/player/d60b0ef9/www-player.css

HTTP Request

GET https://www.youtube.com/s/desktop/060ac52e/cssbin/www-main-desktop-watch-page-skeleton.css

HTTP Request

GET https://www.youtube.com/s/desktop/060ac52e/cssbin/www-main-desktop-player-skeleton.css

HTTP Request

GET https://www.youtube.com/s/desktop/060ac52e/cssbin/www-onepick.css

HTTP Request

GET https://www.youtube.com/s/_/ytmainappweb/_/ss/k=ytmainappweb.kevlar_base.vyXY6lrOKDQ.L.B1.O/am=AAAI0AI/d=0/br=1/rs=AGKMywFfBI9QV9dG-tZh8wQaw-Yyn6090w

HTTP Request

POST https://consent.youtube.com/save?continue=https://www.youtube.com/watch%3Fv%3DMrSAkJZ31lA%26feature%3Dyoutu.be&gl=GB&m=0&pc=yt&x=5&src=2&hl=en&bl=653459994&cm=2&set_eom=true
216.58.201.110:443

youtu.be

tls, http2

msedge.exe

999 B
8.0kB
9
9
216.58.204.86:443

https://i.ytimg.com/generate_204

tls, http2

msedge.exe

1.6kB
6.3kB
12
11

HTTP Request

GET https://i.ytimg.com/generate_204
173.194.137.70:443

https://rr1---sn-aigzrn76.googlevideo.com/generate_204

tls, http

msedge.exe

1.6kB
5.8kB
11
11

HTTP Request

GET https://rr1---sn-aigzrn76.googlevideo.com/generate_204

HTTP Response

204
173.194.137.70:443

https://rr1---sn-aigzrn76.googlevideo.com/generate_204?conn2

tls, http

msedge.exe

1.6kB
5.8kB
11
11

HTTP Request

GET https://rr1---sn-aigzrn76.googlevideo.com/generate_204?conn2

HTTP Response

204
108.177.127.84:443

https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en

tls, http2

msedge.exe

2.0kB
7.5kB
14
17

HTTP Request

GET https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3D%252Fsignin_passive%26feature%3Dpassive&hl=en
142.250.200.42:443

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

tls, http2

msedge.exe

1.8kB
6.8kB
14
16

HTTP Request

OPTIONS https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create
142.250.187.193:443

yt3.ggpht.com

tls

msedge.exe

977 B
9.7kB
10
10
142.250.187.193:443

yt3.ggpht.com

tls

msedge.exe

1.1kB
9.7kB
12
10
142.250.187.193:443

https://yt3.ggpht.com/QqoTjrpKRDMfGFPYpgIaTmHkbQ6Lk-brN77OxCYwl0jTtluavivXDdd4lR2wQsr_hcIggw=s136-w136-h136-c-k-c0x00ffffff-no-nd-rj

tls, http2

msedge.exe

2.3kB
20.5kB
18
26

HTTP Request

GET https://yt3.ggpht.com/t6aV4H3yhpqFutVJvhoh0sCx6J5_sJQIw8htebSia9pCEe8RzMs_HF7KD3xtkq4vsfqDpwmi=s48-c-k-c0x00ffffff-no-rj

HTTP Request

GET https://yt3.ggpht.com/pyJrgRJt_77DZ1O_ek96CcfX8BPiEXdoGt8wqPeKfBpk-E8zVplqjj16mHK9EFbIi3wGCO2D3g=s100-w72-h100-c-k-c0x00ffffff-no-nd-rj

HTTP Request

GET https://yt3.ggpht.com/QqoTjrpKRDMfGFPYpgIaTmHkbQ6Lk-brN77OxCYwl0jTtluavivXDdd4lR2wQsr_hcIggw=s136-w136-h136-c-k-c0x00ffffff-no-nd-rj
142.250.200.46:443

play.google.com

tls, http2

msedge.exe

943 B
7.5kB
8
9
142.250.200.46:443

https://play.google.com/log?format=json&hasfast=true&authuser=0

tls, http2

msedge.exe

1.8kB
8.2kB
13
15

HTTP Request

OPTIONS https://play.google.com/log?format=json&hasfast=true&authuser=0

HTTP Request

OPTIONS https://play.google.com/log?format=json&hasfast=true&authuser=0
142.250.180.4:443

https://www.google.com/js/th/G9IHigwxVH3Mn3WnChzJeeVNQhz-kZ0Q5G-GviBI-tI.js

tls, http2

msedge.exe

1.9kB
28.2kB
16
30

HTTP Request

GET https://www.google.com/js/th/G9IHigwxVH3Mn3WnChzJeeVNQhz-kZ0Q5G-GviBI-tI.js
216.58.201.110:443

https://youtube.com/

tls, http2

msedge.exe

1.8kB
9.3kB
14
17

HTTP Request

GET https://youtube.com/
104.20.4.235:443

https://pastebin.com/favicon.ico

tls, http2

msedge.exe

1.9kB
4.3kB
13
16

HTTP Request

GET https://pastebin.com/raw/h1j3cpu4

HTTP Response

200

HTTP Request

GET https://pastebin.com/favicon.ico

HTTP Response

200
172.67.214.146:443

https://api.mboost.me/v1/steps/https%3A%2F%2Fwww.youtube.com%2Fc%2Fzodiacexploits

tls, http2

msedge.exe

8.0kB
152.7kB
111
170

HTTP Request

GET https://mboost.me/a/c12

HTTP Response

200

HTTP Request

GET https://mboost.me/_next/static/css/e8ea4f8b7b858637.css

HTTP Request

GET https://mboost.me/cdn-cgi/apps/head/gfZfIedvFNHE-6vwuf_1JemVCGU.js

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://mboost.me/_next/static/chunks/webpack-ee7e63bc15b31913.js

HTTP Request

GET https://mboost.me/_next/static/chunks/framework-3b5a00d5d7e8d93b.js

HTTP Request

GET https://mboost.me/_next/static/chunks/main-9c0a1441bfd93a46.js

HTTP Request

GET https://mboost.me/_next/static/chunks/pages/_app-de8ad9055c7bf200.js

HTTP Request

GET https://mboost.me/_next/static/chunks/pages/stepid-46a57750bc80809b.js

HTTP Request

GET https://mboost.me/_next/static/U24YZNy5IhNICH6T1tM3N/_buildManifest.js

HTTP Request

GET https://mboost.me/_next/static/U24YZNy5IhNICH6T1tM3N/_ssgManifest.js

HTTP Request

GET https://mboost.me/cdn-cgi/apps/body/igzKfeQUrNHc0naBa2qmjkX4970.js

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://mboost.me/_next/static/chunks/450-5c8498350627b338.js

HTTP Request

GET https://mboost.me/_next/static/chunks/pages/index-9e96a9924046731a.js

HTTP Request

GET https://mboost.me/_next/static/chunks/pages/faq-10d357850ccf4336.js

HTTP Request

GET https://mboost.me/_next/static/chunks/pages/login-135eb3a32f93fa35.js

HTTP Request

GET https://mboost.me/_next/static/chunks/pages/privacy-5b025f7e994fa373.js

HTTP Request

GET https://api.mboost.me/v1/login/check

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://mboost.me/favicon.ico

HTTP Response

200

HTTP Request

POST https://api.mboost.me/v1/steps/https%3A%2F%2Fwww.youtube.com%2Fc%2Fzodiacexploits

HTTP Response

200
172.67.214.146:443

mboost.me

tls, http2

msedge.exe

943 B
3.1kB
8
6
172.66.42.247:443

https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&prod_t=d&sdata=the%20buttons&bdc=4&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D

tls, http2

msedge.exe

17.6kB
247.6kB
167
272

HTTP Request

GET https://resources.infolinks.com/js/infolinks_main.js

HTTP Response

200

HTTP Request

GET https://resources.infolinks.com/js/1941.019-3.034/ice.js

HTTP Response

200

HTTP Request

GET https://router.infolinks.com/usync/manage?pid=3188496&wsid=0&pdom=mboost.me&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12

HTTP Request

GET https://router.infolinks.com/gsd?evt=afterGSD&pid=3188496&wsid=0&pdom=mboost.me&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&jsv=1941.019-3.034&_cb=17215025504730

HTTP Request

GET https://router.infolinks.com/usync/lcmanage?pid=3188496&wsid=0&pdom=mboost.me&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

POST https://rt3001.infolinks.com/action/doq.htm?pcode=utf-8&r=17215025506971

HTTP Response

200

HTTP Request

GET https://resources.infolinks.com/js/1941.019-3.034/in_search.js

HTTP Request

GET https://resources.infolinks.com/js/1941.019-3.034/bubble.js

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://resources.infolinks.com/js/1941.019-3.034/in_text.js

HTTP Request

GET https://resources.infolinks.com/js/1941.019-3.034/intag_incontent.js

HTTP Request

GET https://rt3001.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A1%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A0%2C%22sdata%22%3A%22the%20buttons%22%2C%22scs%22%3A%22JUVgi0PldI%22%7D%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502551026&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://resources.infolinks.com/static/skins/loader.gif

HTTP Request

GET https://resources.infolinks.com/static/skins/loader-bg.png

HTTP Request

GET https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&capara=%7B%22failedAlgos%22%3A%22aapalgo%22%7D

HTTP Request

GET https://rt3001.infolinks.com/action/getads.htm?hks=%5B%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502551119&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false

HTTP Request

GET https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&capara=%7B%22mode%22%3A%22default%22%2C%22markers%22%3A0%7D

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://rt3001.infolinks.com/action/adview.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&bdc=1&midx=0&emd=NTd-bnVsbF9tYWN5c18zMDB4MjUw&rts=1721502551697&prod_t=d&jsv=1941.019-3.034&skin=sidebar&theme=def&sdata=the%20buttons&scs=JUVgi0PldI&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A

HTTP Request

GET https://resources.infolinks.com/static/brands/macys_300x250.jpg

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&prod_t=d&sdata=the%20buttons&bdc=1&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D

HTTP Response

200

HTTP Request

GET https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&capara=%7B%22error%22%3A%22ICE_HB%20was%20not%20found%20on%20window%20-%20init%20not%20fired.%22%7D

HTTP Response

200

HTTP Request

GET https://rt3001.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A2%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A1%2C%22as%22%3A%22300*250~400*300%22%2C%22sdata%22%3A%22the%20buttons%22%2C%22scs%22%3A%22JUVgi0PldI%22%7D%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502581699&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false

HTTP Response

200

HTTP Request

GET https://rt3001.infolinks.com/action/adview.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&bdc=2&midx=0&emd=NTd-bnVsbF9zZWFtbGVzc19waXp6YV8zMDB4MjUw&rts=1721502582301&prod_t=d&jsv=1941.019-3.034&skin=sidebar&theme=def&sdata=the%20buttons&scs=JUVgi0PldI&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A

HTTP Request

GET https://resources.infolinks.com/static/brands/seamless_pizza_300x250.jpg

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&prod_t=d&sdata=the%20buttons&bdc=2&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D

HTTP Response

200

HTTP Request

GET https://rt3001.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A3%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A2%2C%22as%22%3A%22300*250~400*300%22%2C%22sdata%22%3A%22the%20buttons%22%2C%22scs%22%3A%22JUVgi0PldI%22%7D%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502612304&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false

HTTP Response

200

HTTP Request

GET https://rt3001.infolinks.com/action/adview.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&bdc=3&midx=0&emd=NTd-bnVsbF9zZWFtbGVzc19waXp6YV8zMDB4MjUw&rts=1721502612817&prod_t=d&jsv=1941.019-3.034&skin=sidebar&theme=def&sdata=the%20buttons&scs=JUVgi0PldI&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A

HTTP Response

200

HTTP Request

GET https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&prod_t=d&sdata=the%20buttons&bdc=3&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D

HTTP Response

200

HTTP Request

GET https://rt3001.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A4%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A3%2C%22as%22%3A%22300*250~400*300%22%2C%22sdata%22%3A%22the%20buttons%22%2C%22scs%22%3A%22JUVgi0PldI%22%7D%5D&rid=0e860f43-18d2-473b-aad4-6ed33197c47b&jsv=1941.019-3.034&sr=1280X680&rts=1721502642826&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=92.0.4515.131&dv=p&ce=t&purl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&tzo=-0000&c=c&strg=true&sua=%7B%22architecture%22%3A%22x86%22%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0%22%2C%22uaFullVersion%22%3A%2292.0.902.67%22%7D&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A&cuid=72263127-bb8d-4ad8-950c-204590aea808&hbnr=false

HTTP Response

200

HTTP Request

GET https://rt3001.infolinks.com/action/adview.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&bdc=4&midx=0&emd=NTd-bnVsbF9tYWNfMzAweDI1MA&rts=1721502643346&prod_t=d&jsv=1941.019-3.034&skin=sidebar&theme=def&sdata=the%20buttons&scs=JUVgi0PldI&rsd=0r39LjYUmvX1IVVH2EsYI_P9fEpJiogzuHTPLugl2R2Cf0XaWqR2yOgbXcM7Smr9WQwMdsU0f0CKD8nzLdZJFJ5EcXP3eYN-FuoUNCJqmQfUUJGSoZLo1P7wZDh88rcibOmyXJXvi7Doicd_gikxxxEbtBBr2SKr&rsk=41&rcs=kLBaM42NYDBPF0euQBbj8A

HTTP Request

GET https://resources.infolinks.com/static/brands/mac_300x250.jpg

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://rt3001.infolinks.com/action/dcl.htm?rid=0e860f43-18d2-473b-aad4-6ed33197c47b&prod_t=d&sdata=the%20buttons&bdc=4&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D

HTTP Response

200
104.26.6.147:443

https://cdn.wearedevs.net/images/icons/twitter.png

tls, http2

msedge.exe

1.7kB
6.1kB
14
13

HTTP Request

GET https://cdn.wearedevs.net/images/icons/twitter.png

HTTP Response

200
2.18.190.81:80

http://apps.identrust.com/roots/dstrootcax3.p7c

http

msedge.exe

468 B
1.7kB
7
6

HTTP Request

GET http://apps.identrust.com/roots/dstrootcax3.p7c

HTTP Response

200
216.239.32.36:443

https://region1.google-analytics.com/g/collect?v=2&tid=G-5G1MH09G6M&gtm=45je47h0v872206000za200&_p=1721502549939&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1414229854.1721502550&ul=en-us&sr=1280x720&uaa=x86&uamb=0&uam=&uap=Windows&uapv=10.0&uaw=0&frm=0&pscdl=noapi&_s=1&sid=1721502550&sct=1&seg=0&dl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&dt=Check%20us%20out%20first!%20%7C%20MediaBooster&en=page_view&_fv=1&_ss=1&_ee=1&tfd=951&_z=fetch

tls, http2

msedge.exe

2.0kB
6.6kB
13
11

HTTP Request

POST https://region1.google-analytics.com/g/collect?v=2&tid=G-5G1MH09G6M&gtm=45je47h0v872206000za200&_p=1721502549939&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1414229854.1721502550&ul=en-us&sr=1280x720&uaa=x86&uamb=0&uam=&uap=Windows&uapv=10.0&uaw=0&frm=0&pscdl=noapi&_s=1&sid=1721502550&sct=1&seg=0&dl=https%3A%2F%2Fmboost.me%2Fa%2Fc12&dt=Check%20us%20out%20first!%20%7C%20MediaBooster&en=page_view&_fv=1&_ss=1&_ee=1&tfd=951&_z=fetch
142.250.180.10:443

https://imasdk.googleapis.com/js/sdkloader/ima3.js

tls, http2

msedge.exe

4.6kB
160.9kB
77
123

HTTP Request

GET https://imasdk.googleapis.com/js/sdkloader/ima3.js
142.250.179.226:443

https://securepubads.g.doubleclick.net/pagead/ima_ppub_config?ippd=https%3A%2F%2Fmboost.me%2Fa%2Fc12

tls, http2

msedge.exe

1.8kB
6.9kB
14
16

HTTP Request

GET https://securepubads.g.doubleclick.net/pagead/ima_ppub_config?ippd=https%3A%2F%2Fmboost.me%2Fa%2Fc12
142.250.178.1:443

https://yt3.googleusercontent.com/LwpYyREjQXYfSbZJt9k-8119bZA9bEfkOhFPi--bYUZLEtXEJ6qh1-cByXz5FIdMlXwb2sCt=w1707-fcrop64=1,00005a57ffffa5a8-k-c0xffffffff-no-nd-rj

tls, http2

msedge.exe

3.0kB
98.2kB
36
78

HTTP Request

GET https://yt3.googleusercontent.com/t6aV4H3yhpqFutVJvhoh0sCx6J5_sJQIw8htebSia9pCEe8RzMs_HF7KD3xtkq4vsfqDpwmi=s160-c-k-c0x00ffffff-no-rj

HTTP Request

GET https://yt3.googleusercontent.com/LwpYyREjQXYfSbZJt9k-8119bZA9bEfkOhFPi--bYUZLEtXEJ6qh1-cByXz5FIdMlXwb2sCt=w1707-fcrop64=1,00005a57ffffa5a8-k-c0xffffffff-no-nd-rj
142.250.178.1:443

yt3.googleusercontent.com

tls, http2

msedge.exe

999 B
10.7kB
9
11
150.171.27.10:443

tse1.mm.bing.net

tls, http2

1.3kB
8.3kB
17
15
150.171.27.10:443

tse1.mm.bing.net

tls, http2

1.2kB
8.3kB
16
14
150.171.27.10:443

tse1.mm.bing.net

tls, http2

1.2kB
8.3kB
16
14
150.171.27.10:443

https://tse1.mm.bing.net/th?id=OADD2.10239340418560_12H05GS2AXF1O4KMU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

tls, http2

140.3kB
4.1MB
2985
2980

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239339388051_1DI9F3V3Y6K7A0KMB&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239339388050_13LHMV8LNZUBG68MF&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301063_149G85DV7JWSKM1IM&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301496_1OD7PWAV06HYZ5MV4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340418559_1LXGGCLQWFST3067K&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340418560_12H05GS2AXF1O4KMU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Response

200
150.171.27.10:443

tse1.mm.bing.net

tls, http2

1.2kB
8.3kB
16
14

8.8.8.8:53

149.220.183.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

149.220.183.52.in-addr.arpa
8.8.8.8:53

64.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

64.159.190.20.in-addr.arpa
8.8.8.8:53

227.187.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

227.187.250.142.in-addr.arpa
8.8.8.8:53

73.144.22.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

73.144.22.2.in-addr.arpa
224.0.0.251:5353

459 B
7
8.8.8.8:53

57.169.31.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

57.169.31.20.in-addr.arpa
8.8.8.8:53

196.249.167.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

196.249.167.52.in-addr.arpa
8.8.8.8:53

youtu.be

dns

msedge.exe

54 B
70 B
1
1

DNS Request

youtu.be

DNS Response

216.58.201.110
8.8.8.8:53

www.youtube.com

dns

msedge.exe

61 B
319 B
1
1

DNS Request

www.youtube.com

DNS Response

142.250.187.206

216.58.201.110

142.250.179.238

142.250.200.14

216.58.204.78

142.250.178.14

172.217.169.78

172.217.16.238

172.217.169.46

216.58.212.238

172.217.169.14

142.250.200.46

142.250.187.238

142.250.180.14
142.250.187.206:443

www.youtube.com

https

msedge.exe

43.6kB
305.9kB
169
322
8.8.8.8:53

i.ytimg.com

dns

msedge.exe

57 B
297 B
1
1

DNS Request

i.ytimg.com

DNS Response

216.58.204.86

172.217.169.22

142.250.200.22

216.58.213.22

142.250.180.22

142.250.178.22

142.250.187.246

142.250.200.54

142.250.187.214

142.250.179.246

216.58.201.118

216.58.212.214

172.217.169.54

172.217.169.86

172.217.16.246
8.8.8.8:53

rr1---sn-aigzrn76.googlevideo.com

dns

msedge.exe

79 B
125 B
1
1

DNS Request

rr1---sn-aigzrn76.googlevideo.com

DNS Response

173.194.137.70
8.8.8.8:53

110.201.58.216.in-addr.arpa

dns

73 B
173 B
1
1

DNS Request

110.201.58.216.in-addr.arpa
8.8.8.8:53

206.187.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

206.187.250.142.in-addr.arpa
216.58.204.86:443

i.ytimg.com

https

msedge.exe

11.0kB
220.9kB
93
191
8.8.8.8:53

accounts.google.com

dns

msedge.exe

65 B
81 B
1
1

DNS Request

accounts.google.com

DNS Response

108.177.127.84
108.177.127.84:443

accounts.google.com

https

msedge.exe

10.4kB
138.7kB
80
144
8.8.8.8:53

86.204.58.216.in-addr.arpa

dns

72 B
171 B
1
1

DNS Request

86.204.58.216.in-addr.arpa
8.8.8.8:53

234.16.217.172.in-addr.arpa

dns

73 B
142 B
1
1

DNS Request

234.16.217.172.in-addr.arpa
8.8.8.8:53

70.137.194.173.in-addr.arpa

dns

73 B
111 B
1
1

DNS Request

70.137.194.173.in-addr.arpa
8.8.8.8:53

84.127.177.108.in-addr.arpa

dns

73 B
106 B
1
1

DNS Request

84.127.177.108.in-addr.arpa
8.8.8.8:53

jnn-pa.googleapis.com

dns

msedge.exe

67 B
259 B
1
1

DNS Request

jnn-pa.googleapis.com

DNS Response

142.250.200.42

172.217.169.42

142.250.180.10

142.250.178.10

142.250.187.202

216.58.204.74

142.250.200.10

142.250.187.234

172.217.169.10

216.58.201.106

172.217.16.234

142.250.179.234
142.250.200.42:443

jnn-pa.googleapis.com

https

msedge.exe

8.9kB
96.6kB
50
84
8.8.8.8:53

42.200.250.142.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

42.200.250.142.in-addr.arpa
8.8.8.8:53

99.201.58.216.in-addr.arpa

dns

72 B
169 B
1
1

DNS Request

99.201.58.216.in-addr.arpa
8.8.8.8:53

yt3.ggpht.com

dns

msedge.exe

59 B
120 B
1
1

DNS Request

yt3.ggpht.com

DNS Response

142.250.187.193
8.8.8.8:53

play.google.com

dns

msedge.exe

61 B
77 B
1
1

DNS Request

play.google.com

DNS Response

142.250.200.46
8.8.8.8:53

www.google.com

dns

msedge.exe

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

142.250.180.4
142.250.200.46:443

play.google.com

https

msedge.exe

16.5kB
13.5kB
44
47
8.8.8.8:53

193.187.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

193.187.250.142.in-addr.arpa
8.8.8.8:53

4.180.250.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

4.180.250.142.in-addr.arpa
8.8.8.8:53

46.200.250.142.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

46.200.250.142.in-addr.arpa
8.8.8.8:53

youtube.com

dns

msedge.exe

57 B
73 B
1
1

DNS Request

youtube.com

DNS Response

216.58.201.110
142.250.187.193:443

yt3.ggpht.com

https

msedge.exe

4.9kB
27.6kB
21
28
8.8.8.8:53

consent.youtube.com

dns

msedge.exe

65 B
81 B
1
1

DNS Request

consent.youtube.com

DNS Response

216.58.201.110
8.8.8.8:53

pastebin.com

dns

msedge.exe

58 B
106 B
1
1

DNS Request

pastebin.com

DNS Response

104.20.4.235

104.20.3.235

172.67.19.24
8.8.8.8:53

235.4.20.104.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

235.4.20.104.in-addr.arpa
8.8.8.8:53

103.169.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

103.169.127.40.in-addr.arpa
8.8.8.8:53

56.126.166.20.in-addr.arpa

dns

144 B
316 B
2
2

DNS Request

56.126.166.20.in-addr.arpa

DNS Request

56.126.166.20.in-addr.arpa
8.8.8.8:53

147.142.123.92.in-addr.arpa

dns

146 B
278 B
2
2

DNS Request

147.142.123.92.in-addr.arpa

DNS Request

147.142.123.92.in-addr.arpa
8.8.8.8:53

mboost.me

dns

msedge.exe

110 B
174 B
2
2

DNS Request

mboost.me

DNS Request

mboost.me

DNS Response

172.67.214.146

104.21.67.56

DNS Response

172.67.214.146

104.21.67.56
8.8.8.8:53

146.214.67.172.in-addr.arpa

dns

146 B
270 B
2
2

DNS Request

146.214.67.172.in-addr.arpa

DNS Request

146.214.67.172.in-addr.arpa
8.8.8.8:53

api.mboost.me

dns

msedge.exe

118 B
182 B
2
2

DNS Request

api.mboost.me

DNS Request

api.mboost.me

DNS Response

172.67.214.146

104.21.67.56

DNS Response

172.67.214.146

104.21.67.56
8.8.8.8:53

cdn.wearedevs.net

dns

msedge.exe

126 B
222 B
2
2

DNS Request

cdn.wearedevs.net

DNS Request

cdn.wearedevs.net

DNS Response

104.26.6.147

172.67.71.2

104.26.7.147

DNS Response

172.67.71.2

104.26.6.147

104.26.7.147
8.8.8.8:53

resources.infolinks.com

dns

msedge.exe

138 B
202 B
2
2

DNS Request

resources.infolinks.com

DNS Request

resources.infolinks.com

DNS Response

172.66.42.247

172.66.41.9

DNS Response

172.66.41.9

172.66.42.247
8.8.8.8:53

apps.identrust.com

dns

msedge.exe

128 B
330 B
2
2

DNS Request

apps.identrust.com

DNS Request

apps.identrust.com

DNS Response

2.18.190.81

2.18.190.80

DNS Response

2.18.190.81

2.18.190.80
8.8.8.8:53

region1.google-analytics.com

dns

msedge.exe

148 B
212 B
2
2

DNS Request

region1.google-analytics.com

DNS Request

region1.google-analytics.com

DNS Response

216.239.32.36

216.239.34.36

DNS Response

216.239.34.36

216.239.32.36
8.8.8.8:53

router.infolinks.com

dns

msedge.exe

132 B
196 B
2
2

DNS Request

router.infolinks.com

DNS Request

router.infolinks.com

DNS Response

172.66.42.247

172.66.41.9

DNS Response

172.66.42.247

172.66.41.9
8.8.8.8:53

rt3001.infolinks.com

dns

msedge.exe

132 B
196 B
2
2

DNS Request

rt3001.infolinks.com

DNS Request

rt3001.infolinks.com

DNS Response

172.66.41.9

172.66.42.247

DNS Response

172.66.42.247

172.66.41.9
8.8.8.8:53

72.169.217.172.in-addr.arpa

dns

146 B
222 B
2
2

DNS Request

72.169.217.172.in-addr.arpa

DNS Request

72.169.217.172.in-addr.arpa
8.8.8.8:53

78.204.58.216.in-addr.arpa

dns

144 B
342 B
2
2

DNS Request

78.204.58.216.in-addr.arpa

DNS Request

78.204.58.216.in-addr.arpa
8.8.8.8:53

247.42.66.172.in-addr.arpa

dns

144 B
268 B
2
2

DNS Request

247.42.66.172.in-addr.arpa

DNS Request

247.42.66.172.in-addr.arpa
8.8.8.8:53

147.6.26.104.in-addr.arpa

dns

142 B
266 B
2
2

DNS Request

147.6.26.104.in-addr.arpa

DNS Request

147.6.26.104.in-addr.arpa
8.8.8.8:53

81.190.18.2.in-addr.arpa

dns

140 B
266 B
2
2

DNS Request

81.190.18.2.in-addr.arpa

DNS Request

81.190.18.2.in-addr.arpa
8.8.8.8:53

36.32.239.216.in-addr.arpa

dns

144 B
264 B
2
2

DNS Request

36.32.239.216.in-addr.arpa

DNS Request

36.32.239.216.in-addr.arpa
8.8.8.8:53

imasdk.googleapis.com

dns

msedge.exe

134 B
166 B
2
2

DNS Request

imasdk.googleapis.com

DNS Request

imasdk.googleapis.com

DNS Response

142.250.180.10

DNS Response

142.250.180.10
8.8.8.8:53

securepubads.g.doubleclick.net

dns

msedge.exe

152 B
184 B
2
2

DNS Request

securepubads.g.doubleclick.net

DNS Request

securepubads.g.doubleclick.net

DNS Response

142.250.179.226

DNS Response

142.250.179.226
8.8.8.8:53

10.180.250.142.in-addr.arpa

dns

146 B
224 B
2
2

DNS Request

10.180.250.142.in-addr.arpa

DNS Request

10.180.250.142.in-addr.arpa
8.8.8.8:53

226.179.250.142.in-addr.arpa

dns

148 B
224 B
2
2

DNS Request

226.179.250.142.in-addr.arpa

DNS Request

226.179.250.142.in-addr.arpa
8.8.8.8:53

yt3.googleusercontent.com

dns

msedge.exe

142 B
174 B
2
2

DNS Request

yt3.googleusercontent.com

DNS Request

yt3.googleusercontent.com

DNS Response

142.250.178.1

DNS Response

142.250.178.1
8.8.8.8:53

1.178.250.142.in-addr.arpa

dns

144 B
220 B
2
2

DNS Request

1.178.250.142.in-addr.arpa

DNS Request

1.178.250.142.in-addr.arpa
142.250.200.46:443

play.google.com

https

msedge.exe

3.7kB
7.3kB
10
13
142.250.180.4:443

www.google.com

https

msedge.exe

3.8kB
9.3kB
10
11
216.239.32.36:443

region1.google-analytics.com

https

msedge.exe

2.6kB
7.0kB
7
10
142.250.187.206:443

www.youtube.com

https

msedge.exe

7.8kB
3.2kB
12
12
8.8.8.8:53

19.229.111.52.in-addr.arpa

dns

144 B
316 B
2
2

DNS Request

19.229.111.52.in-addr.arpa

DNS Request

19.229.111.52.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

124 B
340 B
2
2

DNS Request

tse1.mm.bing.net

DNS Request

tse1.mm.bing.net

DNS Response

150.171.27.10

150.171.28.10

DNS Response

150.171.27.10

150.171.28.10
8.8.8.8:53

26.35.223.20.in-addr.arpa

dns

142 B
314 B
2
2

DNS Request

26.35.223.20.in-addr.arpa

DNS Request

26.35.223.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c86c838cf1dc704d2be375f04e1e6c6

SHA1
ad2911a13a3addc86cc46d4329b2b1621cbe7e35

SHA256
dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

SHA512
a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f3335bf37563e4537db3624ee378da

SHA1
57543abc3d97c2a2b251b446820894f4b0111aeb

SHA256
494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

SHA512
2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
47KB

MD5
818a47b474bbcefc3e2a2859e374c9bd

SHA1
e01df60fcca6dd035052e1e823c431e0f05eda1c

SHA256
ec14646ac9285ab6dd258848f4b811dde887f353977af397f03fa54dd30d8880

SHA512
7b65f17c269e2c550ee006281d58a5fa6cc721d40c35a21319491f8d8c0d0814cfdbe426708680ae4cce40d9059616a2c11544dfb6b429b61e768e7e33b5cfbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
aab7fece8e050b8ece760a1a134e3c6c

SHA1
d630e5546a2e36f71a196e855a212088b1669cd3

SHA256
8398d9a3ee72d60255925baa3299ae0aa562d958087f36a018f22bcd723dfbf5

SHA512
30c8a830ad29622b650c38e6805902f0eeb7f62f201ed2ccc7829c22722fa3781aded55f51a1e97c41727835fa8a094ade8ab13089ae66dd8150abec83c3224c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
7320cea62c7844b96e89738d622ac056

SHA1
5cfbc03fd8c9b40c1ade539b26f9c05ec0fa99ad

SHA256
ec8f8bf9ee4a5f990a085557b913d40b061e034ca8e3cc036ecda12536a807dd

SHA512
f05a3e9ff71cbd9a7192c4b5edac481728089fa23eb1fa738d91fb92ff04fa2c6ba97bb991c6455f9e699d3a5e0f2e94856e7729d46a3015d90b6afed46503d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a00a8a986cc422e0750040715abd9094

SHA1
428bb2d92fe5d76dc3f4c3fd3ac7a404f6a172bf

SHA256
515113f1159bc47cda9c0c7c42724b66d1d7c32875bac0363d78847cbda8bb2b

SHA512
81dbbe6fb16815747b55a3a9efd06c47c1bd9cbe79edff4f7f3865e7bb76f8c3fc4ac0161808094a11832441bfc00a5363c0a77f0de0fe2903867219c944751b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
56f1033d996c9e94e4fc0db3ea7dfdd7

SHA1
fe753fe4c48ebafd0ae0d992631446ea15f708bb

SHA256
e61d836a382a494a40325c64756ae12f2d17edc4c89808c9372ae442e537d68b

SHA512
bb05fed5bde56e0e5f00a3f590c6e08695470cfb55103da076a2f2b6d720637e3ebd550f52a6f98012dd61f9d0823ff771a0fa45947062e1e8709b2d28cea776

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db1d684cd135a742b3611a6167af4121

SHA1
0d082d0986f62823f4775a88fe91b0a80a04a40f

SHA256
402ed0f21ed81390e73b85012ec2a9bb5e809be03e05b9727ed5edd381650d7b

SHA512
90318ccb2da8add07fc170fc7b6035da37e6143583f87b738819dbc3f6690feca695e0a6e64970959b59b9d24260d7e07382bd4921ce69e50521399a7cb7c620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
526b242ebf8b69cd05269e32722001ae

SHA1
bcdec029e0053d8f795ae9c8ded01fe7aadd3a4a

SHA256
42e514f759a5252ca815fe8d9ff3725d888e4fe93b1de55bae997d0471f19ecd

SHA512
790a6eb39eb482c5884700bc09062d8df61998ac7078cee440fa3c497bfd2a7ea82a79a5f2abfc205f1c51ee4a28731fe91ba4a4e4cc0df698280b281225154c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
df1cad5ec8de0d47a8ad6b1ba921f0dd

SHA1
b18fa163074422e3fd2a6433b04e32d1a2150349

SHA256
17f05752bac5b645be1c535a2cfdf60cd2c41c20eae1ae9bfb3ef5de922fa18b

SHA512
e20530c5ca9f13858e80023612044635ae500cc782e4655ec3967bbf54ec212cd479e57467f144476883449a6688bfe6d6ba5d1e602ccc441249a8c2e5831237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\34ba8a79-9941-4362-b8e4-a9d6cce41d3b\index-dir\the-real-index

Filesize
2KB

MD5
c2db27f9560d44dfa02b7d9ebe2a9dfe

SHA1
e83edf7bc3e5049c817eaf779069ece10c870332

SHA256
dff6e846150867dac5daa9fd309ff0f5821a942f1159ce3e28d8580269faa675

SHA512
b2d233a3858f55aad3365ccabcc71e4ac19af1cdb1491b0c9bd6e1fd0bc2b3484b172f9359a880a201e3b0a773a72f45589de0d0c8beeeb36d83e09fd45a8ef3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\34ba8a79-9941-4362-b8e4-a9d6cce41d3b\index-dir\the-real-index~RFe5879af.TMP

Filesize
48B

MD5
52a257e2d0d3bffe9fbc81dc296485c8

SHA1
bce3c6f886f510aeeedfb7ff829070e0bcb7fd61

SHA256
2455b5c670de61791e022cb2833a3b1a6554565ac832ca84cc738ef9fc27bd9d

SHA512
014cc661c5312ce0e36960c07147d93f8e02ece53fc71a17813cc891c89b84d38011cf13a89a1edae7b031a996cbeb504778dc02d7d612705050ad4d8b6b3127

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
7fe9c58fcce28e3e07858c49d74e60ef

SHA1
0ecbac9865089ea233d71ca1616dba628c9cc361

SHA256
71fbc7c8e974ae1ee2e5bc5a3c76d9110e344ee8f73d348c161fed2d79871627

SHA512
6d24b3cd4dd1d199bcb9e414ae92e4e8cd229431268a0b0f64c37cf79fa245f4dbeb54fa46f57ab029546ca501a7e19807ea1eff7c74fd4740497573357e05ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
aba2c49fa6362f813341048206ca9029

SHA1
a323a002e3b333ba84ff773bebc4c3c59698246d

SHA256
d13ea9a490f0c5a9a59af4bc65a000a3859db2d475a7157334c9fa483f30f6cf

SHA512
5e82d9d017dc18f018a47712a47b054cabf4933c6fb60b65d8354957e1bd13431060d3a4076354d4093335473101b40b45e1c0d398972a0b51347dec5afae576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
188e464e7307742ded7803fef117ef3d

SHA1
7c290cb5e5ee65b7ec4045fe7e800c2064566e82

SHA256
e337ed99ed43f59debb509ce2caaf353b81d16203076428d9ffba55915c5333e

SHA512
7eb300c2894186f7a4e1c4ab92a1b52a316aadfc16ee3f7fe9bd1b274b01b8983304ba3a06189aced06113cc94cec7ad19a8586d80dadb64fb3045daf3ec457b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
12b848964a3dc8d6350eaebff607b884

SHA1
213bb2517b2604ab0df3b4b466a788e0e52375c8

SHA256
1f4ccc932cfe5ff735c5ac7f74490b5eda58865a0d6fe2e1550fb843f530a0d1

SHA512
415487da13fec80c8de4218eee82b0dda21aeff42c73ffbf9d1d4614f524f2dbda76f876db75b70af098559b106bae5d8d380a80fd8774f073bc29f76380e7b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp

Filesize
82B

MD5
489eaa3d0989254502628372cf2ff053

SHA1
4d330bf31d70cd9803cf2f13df0627513b3798e3

SHA256
bc439488b989413f2950fc1df44ec96699ba627826b91eb1703cb4466a55f438

SHA512
e449417632cb8a60b65054fdc245ed1ec2ea8e6aedbd9792425ce32e872ff7e2f0fed3cdd08cd54d9c474c429bb3df9823c687aebe6c9884bf77a8bdf61b4a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57d1e6.TMP

Filesize
89B

MD5
2f7f258ba30559366d2d4098b29a7f18

SHA1
e27b5c4968bf98186f178d0d2149297f8b53be0c

SHA256
840f044eab0f4e1a15720bc8675ea5434ba90c94a9ccc111c557977b61f9fdff

SHA512
b3ef61c80c320851035baf8a86160ee5b35fae298f1d6108f179a1f76cb7c1c2618f3dc459e230da9808c5348b54ff8d6dc74f0dc13e628d5eb907524424824b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
6f464c92b7f8a60915ab6e29c598ace7

SHA1
b3fe30d1238e0fe19742790ea0db5daf3755627f

SHA256
23587d56cf9a9f80edd81af60841ac1a364a28d926be61423fecef1ecb503d8e

SHA512
8c4c7f498871ff6d4ec5ae06d9f891496fd31615e2752625826bc19b2b5e5bc625bc155129c6aaa09f0238a4079d0d46c8c1df5ad22466813d7eba93e0a157f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582239.TMP

Filesize
48B

MD5
9b8340dd80e4fa0c7d3d6b74e9c535ce

SHA1
19db10b7b2652ff765185c7733152c5fd9e7fce9

SHA256
7fc2a2e03031a3b4c7d66640f4a6cdfda8bc5ebc146a4f4152ff5b82344172ad

SHA512
624839437469a48f0e042821747b1fb2435aaf407c29adb7aa7dc2687bb52b91f11d759d8ba568b1b3216dc625d4335f2bd487eb00c41d76f0e414a6324d1536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0184664b316973af5f82c70eae1eb224

SHA1
76034bb2f465c28ea6228cb9e6e346a54875dcf4

SHA256
33a5801ac7bc1a0e5762431072d97cb0d56593aa91a871c2cd4cc68775af59fa

SHA512
4361e8e598fe7e734ae1cf99fdc3b1ed4a3d4243642ea64aefbe98e7fa6e05936fd37b04d317c8bb2284fa08d543b897a18249ec82edad4137f57f3116e2a2da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a34eeb33665a9733ea1e605a4fd3322c

SHA1
5b2be0d4f2478744916831a8e99a14c310dfe55c

SHA256
dce4091d68e8f6d0fdd1fe9dc1d213c954e93451a9292b03e15a9e624352f73f

SHA512
b4be54759abd55485d875ccdca57018e995fc81fffd2820e48ca52e2a83c9b840e0ff2ffd8e02e76044427238382f982dfcdba9970d6919d0ce8ccddd6f42d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58389f.TMP

Filesize
874B

MD5
80648eb7b0e55c80ee59bc8cb02ad8f3

SHA1
3fe2b94b5e9fcc7c829496495ca7518444dbb099

SHA256
62721a43895efc79c6a89787f4568bbe4be94c255333702b9890f10640b9b57a

SHA512
279a7c942e90761fd2e5b96990ea66987d020de9cc40997983a535f898d9e17896f21885177e814267ef2a0005dbd8cf6036513491266f15a0faa1a870a60de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
377b67be1b73be46b387be81604f4aa2

SHA1
d192340a5f35c3eea7614d0e755753dcb4cfdcea

SHA256
026d5162b688babf9ec7019e575b76c48b7c0c6c143ba7fc10d7a2a6c2e796a3

SHA512
1b3312de164bc31178ea03b05c1df948552f9a148d788eb2cf91dfa0724f1951dd60aaa0dc37c50285a829328febd4e619ec469174d66fde7025ee7862f41c8c

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response