hxxps://www[.]youtube[.]com/watch?v=FRHZ1HMP_SU

Resubmissions

18/08/2024, 17:12 UTC

240818-vqy9kaxfqp 3

18/08/2024, 17:09 UTC

240818-vn982sxern 4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18/08/2024, 17:09 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/watch?v=FRHZ1HMP_SU

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\NumberOfSubdomain = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "549"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "321"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "677"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "1858"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "866"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 6e48f99f91f1da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 30293f6891f1da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "1045"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "23"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.msn.com\ = "122"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.msn.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "189"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\Total = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b43d6e6691f1da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9a82be7991f1da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 9f148d6c91f1da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = bd5a0ca091f1da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe

Suspicious behavior: MapViewOfSection 10 IoCs

pid	Process
3056	MicrosoftEdgeCP.exe
3056	MicrosoftEdgeCP.exe
3056	MicrosoftEdgeCP.exe
3056	MicrosoftEdgeCP.exe
3056	MicrosoftEdgeCP.exe
3056	MicrosoftEdgeCP.exe
3056	MicrosoftEdgeCP.exe
3056	MicrosoftEdgeCP.exe
3056	MicrosoftEdgeCP.exe
3056	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1356	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1356	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1356	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4648	MicrosoftEdge.exe
3056	MicrosoftEdgeCP.exe
1356	MicrosoftEdgeCP.exe
3056	MicrosoftEdgeCP.exe
4592	MicrosoftEdgeCP.exe
4592	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2644	3056	MicrosoftEdgeCP.exe	78
PID 3056 wrote to memory of 2644	3056	MicrosoftEdgeCP.exe	78
PID 3056 wrote to memory of 2644	3056	MicrosoftEdgeCP.exe	78
PID 3056 wrote to memory of 2644	3056	MicrosoftEdgeCP.exe	78
PID 3056 wrote to memory of 2644	3056	MicrosoftEdgeCP.exe	78
PID 3056 wrote to memory of 2644	3056	MicrosoftEdgeCP.exe	78
PID 3056 wrote to memory of 2644	3056	MicrosoftEdgeCP.exe	78
PID 3056 wrote to memory of 2644	3056	MicrosoftEdgeCP.exe	78
PID 3056 wrote to memory of 2240	3056	MicrosoftEdgeCP.exe	83
PID 3056 wrote to memory of 2240	3056	MicrosoftEdgeCP.exe	83
PID 3056 wrote to memory of 2240	3056	MicrosoftEdgeCP.exe	83
PID 3056 wrote to memory of 2240	3056	MicrosoftEdgeCP.exe	83
PID 3056 wrote to memory of 2240	3056	MicrosoftEdgeCP.exe	83
PID 3056 wrote to memory of 2240	3056	MicrosoftEdgeCP.exe	83

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://www.youtube.com/watch?v=FRHZ1HMP_SU"
1⤵
PID:612

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4648

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4252

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1356

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2644

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4592

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1856

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2240

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:220

Network

DNS

www.youtube.com

MicrosoftEdge.exe

Remote address:

8.8.8.8:53

Request

www.youtube.com

IN A

Response

www.youtube.com

IN CNAME

youtube-ui.l.google.com

youtube-ui.l.google.com

IN A

216.58.214.174

youtube-ui.l.google.com

IN A

142.250.179.78

youtube-ui.l.google.com

IN A

142.250.75.238

youtube-ui.l.google.com

IN A

172.217.20.206

youtube-ui.l.google.com

IN A

142.250.178.142

youtube-ui.l.google.com

IN A

142.250.74.238

youtube-ui.l.google.com

IN A

142.250.179.110

youtube-ui.l.google.com

IN A

142.250.201.174

youtube-ui.l.google.com

IN A

172.217.20.174

youtube-ui.l.google.com

IN A

216.58.214.78

youtube-ui.l.google.com

IN A

216.58.215.46
GET

https://www.youtube.com/watch?v=FRHZ1HMP_SU

MicrosoftEdgeCP.exe

Remote address:

216.58.214.174:443

Request

GET /watch?v=FRHZ1HMP_SU HTTP/2.0
host: www.youtube.com
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 302

content-type: application/binary
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 18 Aug 2024 17:09:37 GMT
location: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DFRHZ1HMP_SU
strict-transport-security: max-age=31536000
x-frame-options: SAMEORIGIN
content-security-policy: require-trusted-types-for 'script'
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
cross-origin-opener-policy: same-origin-allow-popups; report-to="youtube_main"
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DFRHZ1HMP_SU

MicrosoftEdgeCP.exe

Remote address:

216.58.214.174:443

Request

GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DFRHZ1HMP_SU HTTP/2.0
host: www.youtube.com
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 18 Aug 2024 17:09:38 GMT
strict-transport-security: max-age=31536000
x-frame-options: SAMEORIGIN
content-security-policy: require-trusted-types-for 'script'
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
cross-origin-opener-policy: same-origin; report-to="youtube_main"
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-encoding: br
server: ESF
x-xss-protection: 0
set-cookie: YSC=5o2v7-KeQlo; Domain=.youtube.com; Path=/; Secure; HttpOnly
set-cookie: VISITOR_INFO1_LIVE=; Domain=.youtube.com; Expires=Mon, 22-Nov-2021 17:09:38 GMT; Path=/; Secure; HttpOnly
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.youtube.com/img/desktop/supported_browsers/yt_logo_rgb_light.png

MicrosoftEdgeCP.exe

Remote address:

216.58.214.174:443

Request

GET /img/desktop/supported_browsers/yt_logo_rgb_light.png HTTP/2.0
host: www.youtube.com
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DFRHZ1HMP_SU
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: YSC=5o2v7-KeQlo

Response

HTTP/2.0 200

accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube-marketing"
report-to: {"group":"youtube-marketing","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}
content-length: 9171
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 17 Aug 2024 12:02:31 GMT
expires: Sun, 17 Aug 2025 12:02:31 GMT
cache-control: public, max-age=31536000
age: 104827
last-modified: Wed, 16 Oct 2019 17:15:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.youtube.com/img/desktop/supported_browsers/dinosaur.png

MicrosoftEdgeCP.exe

Remote address:

216.58.214.174:443

Request

GET /img/desktop/supported_browsers/dinosaur.png HTTP/2.0
host: www.youtube.com
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DFRHZ1HMP_SU
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: YSC=5o2v7-KeQlo

Response

HTTP/2.0 200

accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube-marketing"
report-to: {"group":"youtube-marketing","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}
content-length: 59088
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 17 Aug 2024 11:58:02 GMT
expires: Sun, 17 Aug 2025 11:58:02 GMT
cache-control: public, max-age=31536000
age: 105096
last-modified: Wed, 16 Oct 2019 17:15:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.youtube.com/img/desktop/supported_browsers/opera.png

MicrosoftEdgeCP.exe

Remote address:

216.58.214.174:443

Request

GET /img/desktop/supported_browsers/opera.png HTTP/2.0
host: www.youtube.com
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DFRHZ1HMP_SU
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: YSC=5o2v7-KeQlo

Response

HTTP/2.0 200

accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube-marketing"
report-to: {"group":"youtube-marketing","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}
content-length: 2375
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 13 Aug 2024 15:52:11 GMT
expires: Wed, 13 Aug 2025 15:52:11 GMT
cache-control: public, max-age=31536000
age: 436647
last-modified: Wed, 16 Oct 2019 17:15:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.youtube.com/img/desktop/supported_browsers/edgium.png

MicrosoftEdgeCP.exe

Remote address:

216.58.214.174:443

Request

GET /img/desktop/supported_browsers/edgium.png HTTP/2.0
host: www.youtube.com
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DFRHZ1HMP_SU
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: YSC=5o2v7-KeQlo

Response

HTTP/2.0 200

accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube-marketing"
report-to: {"group":"youtube-marketing","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}
content-length: 7121
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 17 Aug 2024 00:52:36 GMT
expires: Sun, 17 Aug 2025 00:52:36 GMT
cache-control: public, max-age=31536000
age: 145022
last-modified: Wed, 12 Feb 2020 21:45:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.youtube.com/img/desktop/supported_browsers/chrome.png

MicrosoftEdgeCP.exe

Remote address:

216.58.214.174:443

Request

GET /img/desktop/supported_browsers/chrome.png HTTP/2.0
host: www.youtube.com
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DFRHZ1HMP_SU
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: YSC=5o2v7-KeQlo

Response

HTTP/2.0 200

accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube-marketing"
report-to: {"group":"youtube-marketing","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}
content-length: 6213
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 12 Aug 2024 16:57:39 GMT
expires: Tue, 12 Aug 2025 16:57:39 GMT
cache-control: public, max-age=31536000
age: 519119
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.youtube.com/img/desktop/supported_browsers/firefox.png

MicrosoftEdgeCP.exe

Remote address:

216.58.214.174:443

Request

GET /img/desktop/supported_browsers/firefox.png HTTP/2.0
host: www.youtube.com
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DFRHZ1HMP_SU
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: YSC=5o2v7-KeQlo

Response

HTTP/2.0 200

accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube-marketing"
report-to: {"group":"youtube-marketing","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}
content-length: 9291
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 16 Aug 2024 03:09:18 GMT
expires: Sat, 16 Aug 2025 03:09:18 GMT
cache-control: public, max-age=31536000
age: 223220
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

174.214.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

174.214.58.216.in-addr.arpa

IN PTR

Response

174.214.58.216.in-addr.arpa

IN PTR

mad01s26-in-f141e100net

174.214.58.216.in-addr.arpa

IN PTR

mad01s26-in-f174�I

174.214.58.216.in-addr.arpa

IN PTR

par10s42-in-f14�I
DNS

c.pki.goog

MicrosoftEdge.exe

Remote address:

8.8.8.8:53

Request

c.pki.goog

IN A

Response

c.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

216.58.214.67
GET

http://c.pki.goog/r/r1.crl

MicrosoftEdgeCP.exe

Remote address:

216.58.214.67:80

Request

GET /r/r1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: c.pki.goog

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 854
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sun, 18 Aug 2024 16:29:28 GMT
Expires: Sun, 18 Aug 2024 17:19:28 GMT
Cache-Control: public, max-age=3000
Age: 2409
Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
DNS

o.pki.goog

MicrosoftEdge.exe

Remote address:

8.8.8.8:53

Request

o.pki.goog

IN A

Response

o.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

216.58.214.67
GET

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEHGN%2BKTRSIp4CcztJxB9gYQ%3D

MicrosoftEdgeCP.exe

Remote address:

216.58.214.67:80

Request

GET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEHGN%2BKTRSIp4CcztJxB9gYQ%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Sun, 18 Aug 2024 16:21:21 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 2896
GET

http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCjHbN8Q48ByBJsBZfEZOeO

MicrosoftEdgeCP.exe

Remote address:

216.58.214.67:80

Request

GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCjHbN8Q48ByBJsBZfEZOeO HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Sun, 18 Aug 2024 16:59:21 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 617
GET

http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDAezvzBOn2FxIghPLaMkP6

MicrosoftEdgeCP.exe

Remote address:

216.58.214.67:80

Request

GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDAezvzBOn2FxIghPLaMkP6 HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Sun, 18 Aug 2024 16:44:34 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 1504
DNS

25.140.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

25.140.123.92.in-addr.arpa

IN PTR

Response

25.140.123.92.in-addr.arpa

IN PTR

a92-123-140-25deploystaticakamaitechnologiescom
DNS

67.214.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

67.214.58.216.in-addr.arpa

IN PTR

Response

67.214.58.216.in-addr.arpa

IN PTR

fra15s10-in-f31e100net

67.214.58.216.in-addr.arpa

IN PTR

fra15s10-in-f67�G

67.214.58.216.in-addr.arpa

IN PTR

par10s39-in-f3�G
GET

https://www.youtube.com/favicon.ico

MicrosoftEdge.exe

Remote address:

216.58.214.174:443

Request

GET /favicon.ico HTTP/2.0
host: www.youtube.com
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
dnt: 1

Response

HTTP/2.0 200

accept-ranges: bytes
content-encoding: br
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube-marketing"
report-to: {"group":"youtube-marketing","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}
content-length: 162
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 17 Aug 2024 12:02:13 GMT
expires: Sun, 17 Aug 2025 12:02:13 GMT
cache-control: public, max-age=31536000
age: 104846
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
content-type: image/x-icon
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D

MicrosoftEdge.exe

Remote address:

216.58.214.67:80

Request

GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: ocsp.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 1446
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Sun, 18 Aug 2024 16:31:05 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 2313
GET

http://c.pki.goog/r/r1.crl

MicrosoftEdge.exe

Remote address:

216.58.214.67:80

Request

GET /r/r1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: c.pki.goog

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 854
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sun, 18 Aug 2024 16:29:28 GMT
Expires: Sun, 18 Aug 2024 17:19:28 GMT
Cache-Control: public, max-age=3000
Age: 2410
Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
GET

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEHGN%2BKTRSIp4CcztJxB9gYQ%3D

MicrosoftEdge.exe

Remote address:

216.58.214.67:80

Request

GET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEHGN%2BKTRSIp4CcztJxB9gYQ%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Sun, 18 Aug 2024 16:21:21 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 2898
DNS

234.75.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

234.75.250.142.in-addr.arpa

IN PTR

Response

234.75.250.142.in-addr.arpa

IN PTR

par10s41-in-f101e100net
DNS

67.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

67.179.250.142.in-addr.arpa

IN PTR

Response

67.179.250.142.in-addr.arpa

IN PTR

par21s19-in-f31e100net
DNS

www.msn.com

MicrosoftEdge.exe

Remote address:

8.8.8.8:53

Request

www.msn.com

IN A

Response

www.msn.com

IN CNAME

www-msn-com.a-0003.a-msedge.net

www-msn-com.a-0003.a-msedge.net

IN CNAME

a-0003.a-msedge.net

a-0003.a-msedge.net

IN A

204.79.197.203
GET

https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default

MicrosoftEdgeCP.exe

Remote address:

204.79.197.203:443

Request

GET /spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default HTTP/2.0
host: www.msn.com
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: USRLOC=; MUID=2ECB9DE19F4A6EF1243489B69EE66F10; _EDGE_V=1; OptanonConsent=isGpcEnabled=0&datestamp=Thu+Apr+04+2024+12%3A47%3A15+GMT%2B0000+(Coordinated+Universal+Time)&version=202310.2.0&isIABGlobal=false; sptmarket=en-US|US|gb|en-gb|en-gb|en||RefA=2B330F31AAA3469D8413406C612B7332.RefC=2024-04-04T12:47:16Z; MUIDB=2ECB9DE19F4A6EF1243489B69EE66F10

Response

HTTP/2.0 200

cache-control: max-age=0, private
content-length: 64991
content-type: text/html; charset=utf-8
set-cookie: _C_ETH=1; domain=.msn.com; path=/; secure; httponly
set-cookie: _C_Auth=
set-cookie: sptmarket=en-US|US|gb|en-gb|en-gb|en||cf=8|RefA=2B330F31AAA3469D8413406C612B7332.RefC=2024-04-04T12:47:16Z; expires=Tue, 18 Aug 2026 17:09:40 GMT; path=/
set-cookie: _EDGE_S=SID=2D702DB671EE6C663BBE396970296D37; domain=.msn.com; path=/; httponly
access-control-allow-methods: HEAD,GET,OPTIONS
x-ceto-origin-forwardonerror: https://staticview.msn.com
content-security-policy: child-src 'self';connect-src 'self' *.mavideo.microsoft.com arc.msn.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn browser.events.data.msn.com browser.events.data.msn.cn browser.events.data.microsoftstart.com browser.events.data.microsoftstart.cn business.bing.com/api/ events-sandbox.data.msn.com events-sandbox.data.msn.cn events-sandbox.data.microsoftstart.com events-sandbox.data.microsoftstart.cn finance-services.msn.com https://bingretailmsndata.azureedge.net/msndata/ https://petrol.office.microsoft.com/v1/feedback https://privacyportal.onetrust.com/request/v1/consentreceipts https://services.bingapis.com img-s-msn-com.akamaized.net login.microsoftonline.com notification.services.msn.com ris.api.iris.microsoft.com srtb.msn.com srtb.msn.cn usgov.business.bing.com/api/ www.bing.com/HPImageArchive.aspx www.bing.com/api/custom/opal/reco/ www.bing.com/api/v1/mediation/tracking www.bing.com/api/v1/mediation/trends www.bing.com/as/ www.bing.com/AS/Suggestions www.bing.com/AS/Suggestions/v2 www.bing.com/historyHandler www.bing.com/profile/history/data www.bing.com/retail/msn/api/shopcard www.bing.com/retailexp/msn/api/ www.bing.com/retailexpdata/msndata/ www.bing.com/th www.msn.com www.microsoftstart.com *.oneservice.msn.com *.oneservice.msn.cn api.msn.com api.msn.cn ent-api.msn.com ent-api.msn.cn ppe-api.msn.com ppe-api.msn.cn graph.microsoft.com/v1.0/;default-src 'none';font-src 'self' assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-src login.live.com login.microsoftonline.com www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search;img-src https://* blob: data:;report-to csp-endpoint;style-src 'self' 'unsafe-inline' c.s-microsoft.com/mscc/ assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;worker-src 'self' 'report-sample';script-src 'self' 'report-sample' assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn c.s-microsoft.com/mscc/ https://clarity.microsoft.com/js/879b55d3-7b96-457b-af7c-03a114c2ae20 platform.bing.com/geo/AutoSuggest/v1 www.bing.com/as/ www.bing.com/s/as/ 'unsafe-inline'
x-robots-tag: noindex
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1
x-ua-compatible: IE=Edge;chrome=1
x-fabric-cluster: pmeprodneu
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]},{"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://deff.nelreports.net/api/report"}]}
strict-transport-security: max-age=1209600; includeSubDomains; preload
x-ceto-ref: 66c22ad441a64959ac49586491b3760f|AFD:035E3C150F0C437B86A306919DF22B69|2024-08-18T17:09:40.471Z
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 035E3C150F0C437B86A306919DF22B69 Ref B: LON04EDGE1108 Ref C: 2024-08-18T17:09:40Z
date: Sun, 18 Aug 2024 17:09:40 GMT
GET

https://www.msn.com/bundles/v1/edge/latest/manifest.appcache?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default

MicrosoftEdgeCP.exe

Remote address:

204.79.197.203:443

Request

GET /bundles/v1/edge/latest/manifest.appcache?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default HTTP/2.0
host: www.msn.com
accept: */*
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.msn.com
accept-encoding: gzip, deflate, br
cookie: USRLOC=; MUID=2ECB9DE19F4A6EF1243489B69EE66F10; _EDGE_V=1; OptanonConsent=isGpcEnabled=0&datestamp=Thu+Apr+04+2024+12%3A47%3A15+GMT%2B0000+(Coordinated+Universal+Time)&version=202310.2.0&isIABGlobal=false; _C_ETH=1; _EDGE_S=SID=2D702DB671EE6C663BBE396970296D37; sptmarket=en-US|US|gb|en-gb|en-gb|en||cf=8|RefA=2B330F31AAA3469D8413406C612B7332.RefC=2024-04-04T12:47:16Z; MUIDB=2ECB9DE19F4A6EF1243489B69EE66F10

Response

HTTP/2.0 200

cache-control: no-cache, no-store, no-transform
content-length: 70
content-type: text/cache-manifest
content-encoding: gzip
content-md5: Rqmsx87pIMK1GFYNCRhAAQ==
last-modified: Mon, 26 Jul 2021 22:20:05 GMT
etag: 0x8D9508385701DBF
vary: Origin
x-ms-request-id: 8e5159e9-801e-003b-4b75-fc6eb8000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
akamai-request-bc: [a=2.16.128.206,b=9137143,c=g,n=GB_EN_LONDON,o=20940]
server-timing: clientrtt; dur=1, clienttt; dur=2, origin; dur=0, cdntime; dur=2, wpo;dur=0,1s;dur=0
akamai-cache-status: RefreshHit from child, Hit from parent
akamai-server-ip: 2.16.128.206
akamai-request-id: 8b6bf7
access-control-allow-credentials: true
access-control-allow-origin: https://www.msn.com
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
timing-allow-origin: *
akamai-grn: 0.ce801002.1724000981.8b6bf7
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F5621EFBE7F147E1BF3825FB8C836C9C Ref B: LON04EDGE1108 Ref C: 2024-08-18T17:09:41Z
date: Sun, 18 Aug 2024 17:09:40 GMT
GET

https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default

MicrosoftEdgeCP.exe

Remote address:

204.79.197.203:443

Request

GET /spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default HTTP/2.0
host: www.msn.com
accept: */*
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: _C_Auth=; USRLOC=; MUID=2ECB9DE19F4A6EF1243489B69EE66F10; _EDGE_V=1; OptanonConsent=isGpcEnabled=0&datestamp=Thu+Apr+04+2024+12%3A47%3A15+GMT%2B0000+(Coordinated+Universal+Time)&version=202310.2.0&isIABGlobal=false; _C_ETH=1; _EDGE_S=SID=2D702DB671EE6C663BBE396970296D37; sptmarket=en-US|US|gb|en-gb|en-gb|en||cf=8|RefA=2B330F31AAA3469D8413406C612B7332.RefC=2024-04-04T12:47:16Z; MUIDB=2ECB9DE19F4A6EF1243489B69EE66F10

Response

HTTP/2.0 200

cache-control: max-age=0, private
content-length: 65000
content-type: text/html; charset=utf-8
set-cookie: _C_ETH=1; expires=Sat, 17 Aug 2024 17:09:41 GMT; domain=.msn.com; path=/; secure; httponly
set-cookie: _C_Auth=
set-cookie: _EDGE_S=SID=2D702DB671EE6C663BBE396970296D37; domain=.msn.com; path=/; httponly
access-control-allow-methods: HEAD,GET,OPTIONS
x-ceto-origin-forwardonerror: https://staticview.msn.com
content-security-policy: child-src 'self';connect-src 'self' *.mavideo.microsoft.com arc.msn.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn browser.events.data.msn.com browser.events.data.msn.cn browser.events.data.microsoftstart.com browser.events.data.microsoftstart.cn business.bing.com/api/ events-sandbox.data.msn.com events-sandbox.data.msn.cn events-sandbox.data.microsoftstart.com events-sandbox.data.microsoftstart.cn finance-services.msn.com https://bingretailmsndata.azureedge.net/msndata/ https://petrol.office.microsoft.com/v1/feedback https://privacyportal.onetrust.com/request/v1/consentreceipts https://services.bingapis.com img-s-msn-com.akamaized.net login.microsoftonline.com notification.services.msn.com ris.api.iris.microsoft.com srtb.msn.com srtb.msn.cn usgov.business.bing.com/api/ www.bing.com/HPImageArchive.aspx www.bing.com/api/custom/opal/reco/ www.bing.com/api/v1/mediation/tracking www.bing.com/api/v1/mediation/trends www.bing.com/as/ www.bing.com/AS/Suggestions www.bing.com/AS/Suggestions/v2 www.bing.com/historyHandler www.bing.com/profile/history/data www.bing.com/retail/msn/api/shopcard www.bing.com/retailexp/msn/api/ www.bing.com/retailexpdata/msndata/ www.bing.com/th www.msn.com www.microsoftstart.com *.oneservice.msn.com *.oneservice.msn.cn api.msn.com api.msn.cn ent-api.msn.com ent-api.msn.cn ppe-api.msn.com ppe-api.msn.cn graph.microsoft.com/v1.0/;default-src 'none';font-src 'self' assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-src login.live.com login.microsoftonline.com www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search;img-src https://* blob: data:;report-to csp-endpoint;style-src 'self' 'unsafe-inline' c.s-microsoft.com/mscc/ assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;worker-src 'self' 'report-sample';script-src 'self' 'report-sample' assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn c.s-microsoft.com/mscc/ https://clarity.microsoft.com/js/879b55d3-7b96-457b-af7c-03a114c2ae20 platform.bing.com/geo/AutoSuggest/v1 www.bing.com/as/ www.bing.com/s/as/ 'unsafe-inline'
x-robots-tag: noindex
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1
x-ua-compatible: IE=Edge;chrome=1
x-fabric-cluster: pmeprodneu
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]},{"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://deff.nelreports.net/api/report"}]}
strict-transport-security: max-age=1209600; includeSubDomains; preload
x-ceto-ref: 66c22ad5d77a43e5ace2eeea492c051c|AFD:9D188DC679B74CA8B283D063C4038B9E|2024-08-18T17:09:41.227Z
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9D188DC679B74CA8B283D063C4038B9E Ref B: LON04EDGE1108 Ref C: 2024-08-18T17:09:41Z
date: Sun, 18 Aug 2024 17:09:41 GMT
GET

https://www.msn.com/bundles/v1/edge/latest/manifest.appcache?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default

MicrosoftEdgeCP.exe

Remote address:

204.79.197.203:443

Request

GET /bundles/v1/edge/latest/manifest.appcache?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default HTTP/2.0
host: www.msn.com
accept: */*
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.msn.com
accept-encoding: gzip, deflate, br
cookie: USRLOC=; MUID=2ECB9DE19F4A6EF1243489B69EE66F10; _EDGE_V=1; OptanonConsent=isGpcEnabled=0&datestamp=Sun+Aug+18+2024+17%3A09%3A40+GMT%2B0000+(Coordinated+Universal+Time)&version=202310.2.0&isIABGlobal=false&browserGpcFlag=0; _EDGE_S=SID=2D702DB671EE6C663BBE396970296D37; sptmarket=en-US|US|gb|en-gb|en-gb|en||cf=8|RefA=2B330F31AAA3469D8413406C612B7332.RefC=2024-04-04T12:47:16Z; MUIDB=2ECB9DE19F4A6EF1243489B69EE66F10

Response

HTTP/2.0 200

cache-control: no-cache, no-store, no-transform
content-length: 70
content-type: text/cache-manifest
content-encoding: gzip
content-md5: Rqmsx87pIMK1GFYNCRhAAQ==
last-modified: Mon, 26 Jul 2021 22:20:05 GMT
etag: 0x8D9508385701DBF
vary: Origin
x-ms-request-id: 8e5159e9-801e-003b-4b75-fc6eb8000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
akamai-request-bc: [a=2.16.128.206,b=9137171,c=g,n=GB_EN_LONDON,o=20940]
server-timing: clientrtt; dur=1, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0
akamai-cache-status: Hit from child
akamai-server-ip: 2.16.128.206
akamai-request-id: 8b6c13
access-control-allow-credentials: true
access-control-allow-origin: https://www.msn.com
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
timing-allow-origin: *
akamai-grn: 0.ce801002.1724000981.8b6c13
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8F7D755800824ACBAC3BF18259398D57 Ref B: LON04EDGE1108 Ref C: 2024-08-18T17:09:41Z
date: Sun, 18 Aug 2024 17:09:41 GMT
DNS

assets.msn.com

MicrosoftEdgeCP.exe

Remote address:

8.8.8.8:53

Request

assets.msn.com

IN A

Response

assets.msn.com

IN CNAME

assets.msn.com.edgekey.net

assets.msn.com.edgekey.net

IN CNAME

e28578.d.akamaiedge.net

e28578.d.akamaiedge.net

IN A

95.101.143.176

e28578.d.akamaiedge.net

IN A

95.101.143.122

e28578.d.akamaiedge.net

IN A

95.101.143.105

e28578.d.akamaiedge.net

IN A

95.101.143.128

e28578.d.akamaiedge.net

IN A

95.101.143.155

e28578.d.akamaiedge.net

IN A

95.101.143.104

e28578.d.akamaiedge.net

IN A

95.101.143.121
DNS

browser.events.data.msn.com

MicrosoftEdgeCP.exe

Remote address:

8.8.8.8:53

Request

browser.events.data.msn.com

IN A

Response

browser.events.data.msn.com

IN CNAME

global.asimov.events.data.trafficmanager.net

global.asimov.events.data.trafficmanager.net

IN CNAME

onedscolprduks02.uksouth.cloudapp.azure.com

onedscolprduks02.uksouth.cloudapp.azure.com

IN A

51.132.193.104
GET

https://assets.msn.com/bundles/v1/edge/latest/vendors.c47bf4f4981f23895ddb.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.176:443

Request

GET /bundles/v1/edge/latest/vendors.c47bf4f4981f23895ddb.js HTTP/2.0
host: assets.msn.com
accept: application/javascript, */*;q=0.8
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.msn.com
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

content-length: 53557
content-md5: YrPejprI4tG+2X4ekLKlAg==
last-modified: Mon, 26 Jul 2021 22:19:35 GMT
etag: 0x8D9508373717114
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: f4ac2ffb-b01e-00b4-3e68-7cb0f2000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
content-encoding: br
date: Sun, 18 Aug 2024 17:09:40 GMT
akamai-request-bc: [a=95.101.143.172,b=43672777,c=g,n=GB_EN_LONDON,o=20940]
server-timing: clientrtt; dur=48, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0
akamai-cache-status: Hit from child
content-type: application/javascript
akamai-server-ip: 95.101.143.172
akamai-request-id: 29a64c9
access-control-allow-credentials: true
access-control-allow-origin: https://www.msn.com
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
cache-control: public, no-transform, max-age=31535892
timing-allow-origin: *
akamai-grn: 0.ac8f655f.1724000980.29a64c9
vary: Origin
GET

https://assets.msn.com/staticsb/statics/latest/oneTrust/1.9/scripttemplates/otSDKStub.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.176:443

Request

GET /staticsb/statics/latest/oneTrust/1.9/scripttemplates/otSDKStub.js HTTP/2.0
host: assets.msn.com
accept: application/javascript, */*;q=0.8
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: USRLOC=; MUID=2ECB9DE19F4A6EF1243489B69EE66F10; _EDGE_V=1; OptanonConsent=isGpcEnabled=0&datestamp=Thu+Apr+04+2024+12%3A47%3A15+GMT%2B0000+(Coordinated+Universal+Time)&version=202310.2.0&isIABGlobal=false; _C_ETH=1; _EDGE_S=SID=2D702DB671EE6C663BBE396970296D37

Response

HTTP/2.0 200

content-length: 33972
content-md5: YzySdh8ykm7KVsyrxDpMLg==
last-modified: Mon, 26 Jul 2021 22:18:52 GMT
etag: 0x8D9508359704919
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 60f35eac-c01e-0047-572d-7168a1000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
content-encoding: br
date: Sun, 18 Aug 2024 17:09:40 GMT
akamai-request-bc: [a=95.101.143.172,b=43672781,c=g,n=GB_EN_LONDON,o=20940]
server-timing: clientrtt; dur=48, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0
akamai-cache-status: Hit from child
content-type: application/javascript
akamai-server-ip: 95.101.143.172
akamai-request-id: 29a64cd
access-control-allow-credentials: true
access-control-allow-origin: https://www.msn.com
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
cache-control: public, no-transform, max-age=31535892
timing-allow-origin: *
akamai-grn: 0.ac8f655f.1724000980.29a64cd
vary: Origin
GET

https://assets.msn.com/bundles/v1/edge/latest/common.5dd7cff85de67632bfd7.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.176:443

Request

GET /bundles/v1/edge/latest/common.5dd7cff85de67632bfd7.js HTTP/2.0
host: assets.msn.com
accept: application/javascript, */*;q=0.8
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.msn.com
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

content-type: application/javascript
content-md5: SrH4iQ0luJkTRyZ3V7l1ZA==
last-modified: Fri, 16 Aug 2024 10:35:20 GMT
etag: 0x8DCBDDF20B8D865
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 3333bf26-701e-0088-4c13-f0bf16000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
content-encoding: gzip
date: Sun, 18 Aug 2024 17:09:40 GMT
content-length: 7369
akamai-request-bc: [a=95.101.143.172,b=43672778,c=g,n=GB_EN_LONDON,o=20940]
server-timing: clientrtt; dur=48, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0
akamai-cache-status: Hit from child
akamai-server-ip: 95.101.143.172
akamai-request-id: 29a64ca
cache-control: public, max-age=1209600
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
timing-allow-origin: *
akamai-grn: 0.ac8f655f.1724000980.29a64ca
vary: Origin
GET

https://assets.msn.com/bundles/v1/edge/latest/microsoft.8aa91a5fe4f5d8517ae1.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.176:443

Request

GET /bundles/v1/edge/latest/microsoft.8aa91a5fe4f5d8517ae1.js HTTP/2.0
host: assets.msn.com
accept: application/javascript, */*;q=0.8
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.msn.com
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

content-length: 161886
content-md5: 4Qqx/5ghQW9cUY3TgpoINQ==
last-modified: Mon, 26 Jul 2021 22:18:30 GMT
etag: 0x8D950834C94BC27
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 39561431-001e-00cf-5ed0-7067e5000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
content-encoding: br
date: Sun, 18 Aug 2024 17:09:40 GMT
akamai-request-bc: [a=95.101.143.172,b=43672779,c=g,n=GB_EN_LONDON,o=20940]
server-timing: clientrtt; dur=48, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0
akamai-cache-status: Hit from child
content-type: application/javascript
akamai-server-ip: 95.101.143.172
akamai-request-id: 29a64cb
access-control-allow-credentials: true
access-control-allow-origin: https://www.msn.com
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
cache-control: public, no-transform, max-age=31535892
timing-allow-origin: *
akamai-grn: 0.ac8f655f.1724000980.29a64cb
vary: Origin
GET

https://assets.msn.com/staticsb/statics/latest/oneTrust/1.9/consent/55a804ab-e5c6-4b97-9319-86263d365d28/55a804ab-e5c6-4b97-9319-86263d365d28.json

MicrosoftEdgeCP.exe

Remote address:

95.101.143.176:443

Request

GET /staticsb/statics/latest/oneTrust/1.9/consent/55a804ab-e5c6-4b97-9319-86263d365d28/55a804ab-e5c6-4b97-9319-86263d365d28.json HTTP/2.0
host: assets.msn.com
accept: */*
origin: https://www.msn.com
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

content-type: application/json
content-md5: tBDiswOqCRnxNKBPFOr30w==
last-modified: Fri, 16 Aug 2024 10:35:49 GMT
etag: 0x8DCBDDF321ED92F
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: d1f397e6-c01e-00ce-3d54-f023e1000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
content-encoding: gzip
date: Sun, 18 Aug 2024 17:09:41 GMT
content-length: 1854
akamai-request-bc: [a=95.101.143.172,b=43672832,c=g,n=GB_EN_LONDON,o=20940]
server-timing: clientrtt; dur=48, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0
akamai-cache-status: Hit from child
akamai-server-ip: 95.101.143.172
akamai-request-id: 29a6500
access-control-allow-credentials: true
access-control-allow-origin: https://www.msn.com
cache-control: public, max-age=1209600
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
timing-allow-origin: *
akamai-grn: 0.ac8f655f.1724000981.29a6500
vary: Origin
GET

https://assets.msn.com/staticsb/statics/latest/oneTrust/1.9/scripttemplates/202310.2.0/otBannerSdk.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.176:443

Request

GET /staticsb/statics/latest/oneTrust/1.9/scripttemplates/202310.2.0/otBannerSdk.js HTTP/2.0
host: assets.msn.com
accept: application/javascript, */*;q=0.8
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: USRLOC=; MUID=2ECB9DE19F4A6EF1243489B69EE66F10; _EDGE_V=1; OptanonConsent=isGpcEnabled=0&datestamp=Thu+Apr+04+2024+12%3A47%3A15+GMT%2B0000+(Coordinated+Universal+Time)&version=202310.2.0&isIABGlobal=false; _C_ETH=1; _EDGE_S=SID=2D702DB671EE6C663BBE396970296D37

Response

HTTP/2.0 200

content-type: application/javascript
content-md5: lAfvoXufoJKI/4M+6xEcxw==
last-modified: Fri, 16 Aug 2024 10:35:46 GMT
etag: 0x8DCBDDF300643F3
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 255491a5-101e-0090-3671-f0c801000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
content-encoding: gzip
date: Sun, 18 Aug 2024 17:09:41 GMT
content-length: 105160
akamai-request-bc: [a=95.101.143.172,b=43672869,c=g,n=GB_EN_LONDON,o=20940]
server-timing: clientrtt; dur=47, clienttt; dur=1, origin; dur=0, cdntime; dur=1, wpo;dur=0,1s;dur=0
akamai-cache-status: Hit from child
akamai-server-ip: 95.101.143.172
akamai-request-id: 29a6525
cache-control: public, max-age=1209600
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
timing-allow-origin: *
akamai-grn: 0.ac8f655f.1724000981.29a6525
vary: Origin
GET

https://assets.msn.com/staticsb/statics/latest/oneTrust/1.9/consent/55a804ab-e5c6-4b97-9319-86263d365d28/e51556d4-5848-4a4b-a5e2-bc98431e1bf7/en-gb.json

MicrosoftEdgeCP.exe

Remote address:

95.101.143.176:443

Request

GET /staticsb/statics/latest/oneTrust/1.9/consent/55a804ab-e5c6-4b97-9319-86263d365d28/e51556d4-5848-4a4b-a5e2-bc98431e1bf7/en-gb.json HTTP/2.0
host: assets.msn.com
accept: */*
origin: https://www.msn.com
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

content-type: application/json
content-md5: Z3GVmx0mQbhR0PePNnG6TQ==
last-modified: Fri, 16 Aug 2024 10:35:32 GMT
etag: 0x8DCBDDF280F7E50
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 0cea1427-901e-00bd-1738-f03260000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
content-encoding: gzip
date: Sun, 18 Aug 2024 17:09:41 GMT
content-length: 20340
akamai-request-bc: [a=95.101.143.172,b=43672886,c=g,n=GB_EN_LONDON,o=20940]
server-timing: clientrtt; dur=49, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0
akamai-cache-status: Hit from child
akamai-server-ip: 95.101.143.172
akamai-request-id: 29a6536
access-control-allow-credentials: true
access-control-allow-origin: https://www.msn.com
cache-control: public, max-age=1209600
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
timing-allow-origin: *
akamai-grn: 0.ac8f655f.1724000981.29a6536
vary: Origin
GET

https://assets.msn.com/staticsb/statics/latest/oneTrust/1.9/consent/55a804ab-e5c6-4b97-9319-86263d365d28/iab2V2Data.json

MicrosoftEdgeCP.exe

Remote address:

95.101.143.176:443

Request

GET /staticsb/statics/latest/oneTrust/1.9/consent/55a804ab-e5c6-4b97-9319-86263d365d28/iab2V2Data.json HTTP/2.0
host: assets.msn.com
accept: */*
origin: https://www.msn.com
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

content-type: application/javascript
content-md5: zMe9/U/sQ7tOLuJUcFr2+Q==
last-modified: Fri, 16 Aug 2024 10:35:56 GMT
etag: 0x8DCBDDF364CAC06
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 5638d976-c01e-00ce-4e27-f023e1000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
content-encoding: gzip
date: Sun, 18 Aug 2024 17:09:41 GMT
content-length: 11711
akamai-request-bc: [a=95.101.143.172,b=43672890,c=g,n=GB_EN_LONDON,o=20940]
server-timing: clientrtt; dur=49, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0
akamai-cache-status: Hit from child
akamai-server-ip: 95.101.143.172
akamai-request-id: 29a653a
cache-control: public, max-age=1209600
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
timing-allow-origin: *
akamai-grn: 0.ac8f655f.1724000981.29a653a
vary: Origin
GET

https://assets.msn.com/staticsb/statics/latest/oneTrust/1.9/scripttemplates/202310.2.0/otTCF.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.176:443

Request

GET /staticsb/statics/latest/oneTrust/1.9/scripttemplates/202310.2.0/otTCF.js HTTP/2.0
host: assets.msn.com
accept: application/javascript, */*;q=0.8
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: USRLOC=; MUID=2ECB9DE19F4A6EF1243489B69EE66F10; _EDGE_V=1; OptanonConsent=isGpcEnabled=0&datestamp=Thu+Apr+04+2024+12%3A47%3A15+GMT%2B0000+(Coordinated+Universal+Time)&version=202310.2.0&isIABGlobal=false; _C_ETH=1; _EDGE_S=SID=2D702DB671EE6C663BBE396970296D37

Response

HTTP/2.0 200

content-type: application/json
content-md5: iB7GIl1dfVgN/rIFCQoYvg==
last-modified: Fri, 16 Aug 2024 10:35:58 GMT
etag: 0x8DCBDDF373AE227
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 930ea5d6-001e-008c-63f3-ef9a61000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
content-encoding: gzip
date: Sun, 18 Aug 2024 17:09:41 GMT
content-length: 67471
akamai-request-bc: [a=95.101.143.172,b=43672889,c=g,n=GB_EN_LONDON,o=20940]
server-timing: clientrtt; dur=49, clienttt; dur=1, origin; dur=0, cdntime; dur=1, wpo;dur=0,1s;dur=0
akamai-cache-status: Hit from child
akamai-server-ip: 95.101.143.172
akamai-request-id: 29a6539
access-control-allow-credentials: true
access-control-allow-origin: https://www.msn.com
cache-control: public, max-age=1209600
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
timing-allow-origin: *
akamai-grn: 0.ac8f655f.1724000981.29a6539
vary: Origin
POST

https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1724000980000&w=0&anoncknm=app_anon

MicrosoftEdgeCP.exe

Remote address:

51.132.193.104:443

Request

POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1724000980000&w=0&anoncknm=app_anon HTTP/2.0
host: browser.events.data.msn.com
origin: https://www.msn.com
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
content-type: text/plain;charset=UTF-8
accept-language: en-US
accept: */*
accept-encoding: gzip, deflate, br
content-length: 3990
cache-control: no-cache
cookie: USRLOC=; MUID=2ECB9DE19F4A6EF1243489B69EE66F10; _EDGE_V=1; OptanonConsent=isGpcEnabled=0&datestamp=Thu+Apr+04+2024+12%3A47%3A15+GMT%2B0000+(Coordinated+Universal+Time)&version=202310.2.0&isIABGlobal=false; _C_ETH=1; _EDGE_S=SID=2D702DB671EE6C663BBE396970296D37

Response

HTTP/2.0 200

content-length: 153
content-type: application/json
server: Microsoft-HTTPAPI/2.0
strict-transport-security: max-age=31536000
p3p: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
set-cookie: MC1=GUID=6a52625e6fe14dcf99a2e035024c3919&HASH=6a52&LV=202408&V=4&LU=1724000980769; Domain=.microsoft.com; Expires=Mon, 18 Aug 2025 17:09:40 GMT; Path=/;Secure; SameSite=None
set-cookie: MS0=c0658e2c710b4a739b3f30ef50c55ac8; Domain=.microsoft.com; Expires=Sun, 18 Aug 2024 17:39:40 GMT; Path=/;Secure; SameSite=None
time-delta-millis: 769
access-control-allow-headers: P3P,Set-Cookie,time-delta-millis
access-control-allow-methods: POST
access-control-allow-credentials: true
access-control-allow-origin: https://www.msn.com
access-control-expose-headers: time-delta-millis
date: Sun, 18 Aug 2024 17:09:40 GMT
POST

https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1724000980000&w=0&anoncknm=app_anon

MicrosoftEdgeCP.exe

Remote address:

51.132.193.104:443

Request

POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1724000980000&w=0&anoncknm=app_anon HTTP/2.0
host: browser.events.data.msn.com
origin: https://www.msn.com
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
content-type: text/plain;charset=UTF-8
accept-language: en-US
accept: */*
accept-encoding: gzip, deflate, br
content-length: 4456
cache-control: no-cache
cookie: USRLOC=; MUID=2ECB9DE19F4A6EF1243489B69EE66F10; _EDGE_V=1; OptanonConsent=isGpcEnabled=0&datestamp=Thu+Apr+04+2024+12%3A47%3A15+GMT%2B0000+(Coordinated+Universal+Time)&version=202310.2.0&isIABGlobal=false; _C_ETH=1; _EDGE_S=SID=2D702DB671EE6C663BBE396970296D37

Response

HTTP/2.0 200

content-length: 153
content-type: application/json
server: Microsoft-HTTPAPI/2.0
strict-transport-security: max-age=31536000
p3p: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
set-cookie: MC1=GUID=cd91076acb694118adc5deebceb580e3&HASH=cd91&LV=202408&V=4&LU=1724000981159; Domain=.microsoft.com; Expires=Mon, 18 Aug 2025 17:09:41 GMT; Path=/;Secure; SameSite=None
set-cookie: MS0=0d284273b2064c45ad86f5bb3ffbf946; Domain=.microsoft.com; Expires=Sun, 18 Aug 2024 17:39:41 GMT; Path=/;Secure; SameSite=None
time-delta-millis: 1159
access-control-allow-headers: P3P,Set-Cookie,time-delta-millis
access-control-allow-methods: POST
access-control-allow-credentials: true
access-control-allow-origin: https://www.msn.com
access-control-expose-headers: time-delta-millis
date: Sun, 18 Aug 2024 17:09:41 GMT
POST

https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1724000980000&w=0&anoncknm=app_anon

MicrosoftEdgeCP.exe

Remote address:

51.132.193.104:443

Request

POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1724000980000&w=0&anoncknm=app_anon HTTP/2.0
host: browser.events.data.msn.com
origin: https://www.msn.com
referer: https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
content-type: text/plain;charset=UTF-8
accept-language: en-US
accept: */*
accept-encoding: gzip, deflate, br
content-length: 3847
cache-control: no-cache
cookie: USRLOC=; MUID=2ECB9DE19F4A6EF1243489B69EE66F10; _EDGE_V=1; OptanonConsent=isGpcEnabled=0&datestamp=Thu+Apr+04+2024+12%3A47%3A15+GMT%2B0000+(Coordinated+Universal+Time)&version=202310.2.0&isIABGlobal=false; _EDGE_S=SID=2D702DB671EE6C663BBE396970296D37

Response

HTTP/2.0 200

content-length: 153
content-type: application/json
server: Microsoft-HTTPAPI/2.0
strict-transport-security: max-age=31536000
p3p: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
set-cookie: MC1=GUID=e037ba6ddc564caa8f2156631db36f4a&HASH=e037&LV=202408&V=4&LU=1724000981300; Domain=.microsoft.com; Expires=Mon, 18 Aug 2025 17:09:41 GMT; Path=/;Secure; SameSite=None
set-cookie: MS0=8d589347bdb94420a560ccc72df5cc09; Domain=.microsoft.com; Expires=Sun, 18 Aug 2024 17:39:41 GMT; Path=/;Secure; SameSite=None
time-delta-millis: 1300
access-control-allow-headers: P3P,Set-Cookie,time-delta-millis
access-control-allow-methods: POST
access-control-allow-credentials: true
access-control-allow-origin: https://www.msn.com
access-control-expose-headers: time-delta-millis
date: Sun, 18 Aug 2024 17:09:41 GMT
DNS

176.143.101.95.in-addr.arpa

Remote address:

8.8.8.8:53

Request

176.143.101.95.in-addr.arpa

IN PTR

Response

176.143.101.95.in-addr.arpa

IN PTR

a95-101-143-176deploystaticakamaitechnologiescom
DNS

104.193.132.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

104.193.132.51.in-addr.arpa

IN PTR

Response
GET

https://www.msn.com/favicon.ico

MicrosoftEdge.exe

Remote address:

204.79.197.203:443

Request

GET /favicon.ico HTTP/2.0
host: www.msn.com
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
dnt: 1

Response

HTTP/2.0 200

cache-control: public, max-age=604800
content-length: 781
content-type: image/x-icon
content-encoding: gzip
content-md5: hMyXfQ6xSBZkgbAdhBjjdQ==
last-modified: Fri, 16 Aug 2024 10:35:06 GMT
etag: 0x8DCBDDF185048EA
vary: Origin
x-ms-request-id: 002f34ef-701e-00cb-5be4-eff13a000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
akamai-request-bc: [a=92.123.26.125,b=139478004,c=g,n=GB_EN_LONDON,o=20940]
server-timing: clientrtt; dur=1, clienttt; dur=1, origin; dur=0, cdntime; dur=1, wpo;dur=0,1s;dur=0
akamai-cache-status: Hit from child
akamai-server-ip: 92.123.26.125
akamai-request-id: 85043f4
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
timing-allow-origin: *
akamai-grn: 0.7d1a7b5c.1724000981.85043f4
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 01C6195BFC4040CCBEC24150BE2CB8D8 Ref B: LON04EDGE0813 Ref C: 2024-08-18T17:09:41Z
date: Sun, 18 Aug 2024 17:09:40 GMT
DNS

161.19.199.152.in-addr.arpa

Remote address:

8.8.8.8:53

Request

161.19.199.152.in-addr.arpa

IN PTR

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
DNS

200.197.79.204.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.197.79.204.in-addr.arpa

IN PTR

Response

200.197.79.204.in-addr.arpa

IN PTR

a-0001a-msedgenet
DNS

57.110.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

57.110.18.2.in-addr.arpa

IN PTR

Response

57.110.18.2.in-addr.arpa

IN PTR

a2-18-110-57deploystaticakamaitechnologiescom
DNS

57.110.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

57.110.18.2.in-addr.arpa

IN PTR
DNS

www.microsoft.com

MicrosoftEdge.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

95.100.245.144
DNS

www.microsoft.com

MicrosoftEdge.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A
GET

https://www.bing.com/cortanaassist/rules?cc=US&version=6

MicrosoftEdge.exe

Remote address:

88.221.135.26:443

Request

GET /cortanaassist/rules?cc=US&version=6 HTTP/2.0
host: www.bing.com
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
dnt: 1

Response

HTTP/2.0 404

cache-control: private
content-length: 56198
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
p3p: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND"
x-eventid: 66c22b14b9764188b78f3c49748ca806
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-error-page: 404-custom
x-ua-compatible: IE=edge
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8E7EF2C2C24F4DE0A8DC6DF911090F62 Ref B: LON601060104011 Ref C: 2024-08-18T17:10:44Z
date: Sun, 18 Aug 2024 17:10:44 GMT
set-cookie: MUID=389B6E9AC51A68792FD27A45C48569F6; domain=.bing.com; expires=Fri, 12-Sep-2025 17:10:44 GMT; path=/; secure; SameSite=None
set-cookie: MUIDB=389B6E9AC51A68792FD27A45C48569F6; expires=Fri, 12-Sep-2025 17:10:44 GMT; path=/; HttpOnly
set-cookie: _EDGE_S=F=1&SID=357DFA7F393B6A74054FEEA038A46B07&mkt=en-us; domain=.bing.com; path=/; HttpOnly
set-cookie: _EDGE_V=1; domain=.bing.com; expires=Fri, 12-Sep-2025 17:10:44 GMT; path=/; HttpOnly
set-cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Tue, 18-Aug-2026 17:10:44 GMT; path=/
set-cookie: SRCHUID=V=2&GUID=4E955038C24B45A2A6D378429398C0F5&dmnchg=1; domain=.bing.com; expires=Tue, 18-Aug-2026 17:10:44 GMT; path=/
set-cookie: SRCHUSR=DOB=20240818; domain=.bing.com; expires=Tue, 18-Aug-2026 17:10:44 GMT; path=/
set-cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Tue, 18-Aug-2026 17:10:44 GMT; path=/
set-cookie: _SS=SID=357DFA7F393B6A74054FEEA038A46B07; domain=.bing.com; path=/
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.3d367a5c.1724001044.287388c
DNS

34.56.20.217.in-addr.arpa

Remote address:

8.8.8.8:53

Request

34.56.20.217.in-addr.arpa

IN PTR

Response
DNS

26.135.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.135.221.88.in-addr.arpa

IN PTR

Response

26.135.221.88.in-addr.arpa

IN PTR

a88-221-135-26deploystaticakamaitechnologiescom
DNS

144.245.100.95.in-addr.arpa

Remote address:

8.8.8.8:53

Request

144.245.100.95.in-addr.arpa

IN PTR

Response

144.245.100.95.in-addr.arpa

IN PTR

a95-100-245-144deploystaticakamaitechnologiescom
DNS

13.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.227.111.52.in-addr.arpa

IN PTR

Response
GET

https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /AS/API/IEOneBox/V2/Init?setlang=en-US HTTP/2.0
host: www.bing.com
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
x-device-enableregulatorypsm: 0
x-device-enablecpsm: 0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

content-length: 17696
content-type: text/html; charset=utf-8
cache-control: private
content-encoding: gzip
vary: Accept-Encoding
x-eventid: 66c22b3b44c84a569bbc82e97a560fcc
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
p3p: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND"
x-ua-compatible: IE=edge
date: Sun, 18 Aug 2024 17:11:23 GMT
set-cookie: MUID=27C2AB4B0CDB6BCF1683BF940DB76A1C; domain=.bing.com; expires=Fri, 12-Sep-2025 17:11:23 GMT; path=/; secure; SameSite=None
set-cookie: MUIDB=27C2AB4B0CDB6BCF1683BF940DB76A1C; expires=Fri, 12-Sep-2025 17:11:23 GMT; path=/; HttpOnly
set-cookie: _EDGE_S=F=1&SID=0F26103D2EE762FF0A3004E22F8B638B; domain=.bing.com; path=/; HttpOnly
set-cookie: _EDGE_V=1; domain=.bing.com; expires=Fri, 12-Sep-2025 17:11:23 GMT; path=/; HttpOnly
set-cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Fri, 12-Sep-2025 17:11:23 GMT; path=/
set-cookie: SRCHUID=V=2&GUID=9B5358AD1E784BE9AD8B6F7E2DC0CC92&dmnchg=1; domain=.bing.com; expires=Fri, 12-Sep-2025 17:11:23 GMT; path=/
set-cookie: SRCHUSR=DOB=20240818; domain=.bing.com; expires=Fri, 12-Sep-2025 17:11:23 GMT; path=/
set-cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Fri, 12-Sep-2025 17:11:23 GMT; path=/
set-cookie: _SS=SID=0F26103D2EE762FF0A3004E22F8B638B; domain=.bing.com; path=/
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001083.3290ab9
GET

https://www.bing.com/rb/19/cir3,ortl,cc,nc/H7yNdbJxRRAcp5Cd9wD9aQLYG6s.css?bu=C6QJlgOrBIAK5QjPCN4GXV3JBF0

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rb/19/cir3,ortl,cc,nc/H7yNdbJxRRAcp5Cd9wD9aQLYG6s.css?bu=C6QJlgOrBIAK5QjPCN4GXV3JBF0 HTTP/2.0
host: www.bing.com
accept: text/css, */*
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: MUID=27C2AB4B0CDB6BCF1683BF940DB76A1C; _EDGE_S=F=1&SID=0F26103D2EE762FF0A3004E22F8B638B; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=9B5358AD1E784BE9AD8B6F7E2DC0CC92&dmnchg=1; SRCHUSR=DOB=20240818; SRCHHPGUSR=SRCHLANG=en; _SS=SID=0F26103D2EE762FF0A3004E22F8B638B; MUIDB=27C2AB4B0CDB6BCF1683BF940DB76A1C

Response

HTTP/2.0 200

cache-control: public, max-age=432000, no-transform, immutable
content-length: 3140
content-type: text/javascript; charset=utf-8
content-encoding: gzip
content-md5: az+rhZn9p058dpqAVhuB8Q==
last-modified: Tue, 16 Jan 2024 20:09:16 GMT
etag: 0x8DC16CF040314FA
x-ms-request-id: d85727a5-001e-007f-0f91-9b8ab1000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
akamai-amd-bc-debug: [a=95.101.236.181,b=1095094962,c=c,d=1723875472,h=200,k=1,l=0,n=GB_EN_LONDON,o=20940,r=1,p=3140]
date: Sun, 18 Aug 2024 17:11:25 GMT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001085.3291658
GET

https://www.bing.com/rb/19/cir3,ortl,cc,nc/XxqYiyTu9Zkh9t7nVvBNsDKSLlQ.css?bu=BsgCSK0CUl3KAg

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rb/19/cir3,ortl,cc,nc/XxqYiyTu9Zkh9t7nVvBNsDKSLlQ.css?bu=BsgCSK0CUl3KAg HTTP/2.0
host: www.bing.com
accept: text/css, */*
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: MUID=27C2AB4B0CDB6BCF1683BF940DB76A1C; _EDGE_S=F=1&SID=0F26103D2EE762FF0A3004E22F8B638B; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=9B5358AD1E784BE9AD8B6F7E2DC0CC92&dmnchg=1; SRCHUSR=DOB=20240818; SRCHHPGUSR=SRCHLANG=en; _SS=SID=0F26103D2EE762FF0A3004E22F8B638B; MUIDB=27C2AB4B0CDB6BCF1683BF940DB76A1C

Response

HTTP/2.0 200

last-modified: Mon, 01 May 2023 19:03:05 GMT
etag: 0x8DB4A76B1D1C4D5
cache-control: public, no-transform, max-age=393408
expires: Wed, 21 Aug 2024 17:26:18 GMT
akamai-grn: 0.521a1202.1723867770.e36ec94a
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 7056
content-type: text/javascript; charset=utf-8
content-encoding: gzip
content-md5: HULyKB2vmYoLN6zt1rirNQ==
x-ms-request-id: 57b2d03d-f01e-0007-5cb9-b768cf000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
vary: Accept-Encoding
date: Sun, 18 Aug 2024 17:11:25 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001085.329165c
GET

https://www.bing.com/rb/3E/ortl,cc,nc/4-xJy3tX6bM2BGl5zKioiEcQ1TU.css?bu=A4gCjAKPAg

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rb/3E/ortl,cc,nc/4-xJy3tX6bM2BGl5zKioiEcQ1TU.css?bu=A4gCjAKPAg HTTP/2.0
host: www.bing.com
accept: text/css, */*
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: MUID=27C2AB4B0CDB6BCF1683BF940DB76A1C; _EDGE_S=F=1&SID=0F26103D2EE762FF0A3004E22F8B638B; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=9B5358AD1E784BE9AD8B6F7E2DC0CC92&dmnchg=1; SRCHUSR=DOB=20240818; SRCHHPGUSR=SRCHLANG=en; _SS=SID=0F26103D2EE762FF0A3004E22F8B638B; MUIDB=27C2AB4B0CDB6BCF1683BF940DB76A1C

Response

HTTP/2.0 200

content-length: 18378
content-type: application/x-javascript; charset=utf-8
access-control-allow-headers: *
access-control-allow-origin: *
cache-control: public, max-age=432000
content-encoding: br
last-modified: Fri, 16 Aug 2024 00:22:49 GMT
vary: Accept-Encoding
x-eventid: 66bfbfdb73194b688e4aa27b0a6aef7e
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.75}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingrms"}]}
date: Sun, 18 Aug 2024 17:11:25 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001085.329165d
GET

https://www.bing.com/rp/lZfFRIZsGLf3poBW6xAz2KFILkI.gz.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rp/lZfFRIZsGLf3poBW6xAz2KFILkI.gz.js HTTP/2.0
host: www.bing.com
accept: application/javascript, */*;q=0.8
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.bing.com
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

last-modified: Mon, 01 May 2023 19:02:52 GMT
etag: 0x8DB4A76AA10009F
cache-control: public, no-transform, max-age=392444
expires: Mon, 19 Aug 2024 18:20:00 GMT
akamai-grn: 0.92777b5c.1723699156.35a3705
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 13433
content-type: text/javascript; charset=utf-8
content-encoding: gzip
content-md5: 0vIIx74xnsdqiNqpWLtnnQ==
x-ms-request-id: ac275fe3-101e-0030-2d4a-e7ba63000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
vary: Accept-Encoding
date: Sun, 18 Aug 2024 17:11:25 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001085.329165f
GET

https://www.bing.com/rp/6wzJBpbyuAoCS5bfkKiW0Aw2R6o.gz.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rp/6wzJBpbyuAoCS5bfkKiW0Aw2R6o.gz.js HTTP/2.0
host: www.bing.com
accept: application/javascript, */*;q=0.8
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.bing.com
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

last-modified: Mon, 01 May 2023 19:03:32 GMT
etag: 0x8DB4A76C1F875F8
cache-control: public, no-transform, max-age=427824
expires: Wed, 21 Aug 2024 09:25:07 GMT
akamai-grn: 0.ac777b5c.1723804483.19e4f51
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 12040
content-type: text/javascript; charset=utf-8
content-encoding: gzip
content-md5: yGKm/4jn78W7vO8Nkej9uA==
x-ms-request-id: 10c998a2-c01e-00b5-2788-c997be000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
vary: Accept-Encoding
date: Sun, 18 Aug 2024 17:11:25 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001085.3291660
GET

https://www.bing.com/rp/DicRs1X5x7sMwnmwcxBuO2kpGeI.gz.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rp/DicRs1X5x7sMwnmwcxBuO2kpGeI.gz.js HTTP/2.0
host: www.bing.com
accept: application/javascript, */*;q=0.8
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.bing.com
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

last-modified: Mon, 01 May 2023 19:03:01 GMT
etag: 0x8DB4A76AF96D917
cache-control: public, no-transform, max-age=432000
expires: Mon, 19 Aug 2024 05:19:20 GMT
akamai-grn: 0.b5777b5c.1723612760.345d277
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 632
content-type: text/javascript; charset=utf-8
content-encoding: gzip
content-md5: vN/bJ41atswBaXroy1h7EA==
x-ms-request-id: aaa455e0-101e-000f-56e9-e972c0000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
vary: Accept-Encoding
date: Sun, 18 Aug 2024 17:11:25 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001085.329165b
GET

https://www.bing.com/rp/L3qgZ2pA6whKnPPHkQnZ2_d8WVo.gz.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rp/L3qgZ2pA6whKnPPHkQnZ2_d8WVo.gz.js HTTP/2.0
host: www.bing.com
accept: application/javascript, */*;q=0.8
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.bing.com
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

cache-control: public, max-age=432000, no-transform, immutable
content-length: 30744
content-type: text/javascript; charset=utf-8
content-encoding: gzip
content-md5: ckQMIJkxhKmvUzx6lypM+w==
last-modified: Mon, 01 May 2023 19:03:00 GMT
etag: 0x8DB4A76AEAF78B0
x-ms-request-id: 58bf1de9-801e-0067-0f8b-26f0ad000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
akamai-amd-bc-debug: [a=2.16.128.76,b=79035196,c=c,d=1723965729,h=200,k=0,l=0,n=GB_EN_LONDON,o=20940,r=1,p=30744]
date: Sun, 18 Aug 2024 17:11:25 GMT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001085.329165a
GET

https://www.bing.com/rp/IOwhK4uDW4Sh2EVXk1BBw5OkHPY.gz.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rp/IOwhK4uDW4Sh2EVXk1BBw5OkHPY.gz.js HTTP/2.0
host: www.bing.com
accept: application/javascript, */*;q=0.8
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.bing.com
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

content-length: 4898
content-type: text/css; charset=utf-8
access-control-allow-headers: *
access-control-allow-origin: *
cache-control: public, max-age=432000
content-encoding: br
last-modified: Mon, 27 Sep 2010 21:57:23 GMT
vary: Accept-Encoding
x-eventid: 66bfa9706f394f08950c60db0a59daba
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.75}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingrms"}]}
date: Sun, 18 Aug 2024 17:11:25 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001085.3291655
GET

https://www.bing.com/rb/4N/jnc,nj/oD_VAxa789XdcG8Fl8GtB-FCB-Y.js?bu=D7Us9Sr8AYYriSuMK44rsyu9LIYspCr8EZ4spCjlKw

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rb/4N/jnc,nj/oD_VAxa789XdcG8Fl8GtB-FCB-Y.js?bu=D7Us9Sr8AYYriSuMK44rsyu9LIYspCr8EZ4spCjlKw HTTP/2.0
host: www.bing.com
accept: application/javascript, */*;q=0.8
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.bing.com
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

content-length: 1246
content-type: text/css; charset=utf-8
access-control-allow-headers: *
access-control-allow-origin: *
cache-control: public, max-age=432000
content-encoding: br
last-modified: Sat, 28 Aug 2010 13:26:17 GMT
vary: Accept-Encoding
x-eventid: 66c088911a7548e3a3ab1020bd1701c0
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.75}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingrms"}]}
date: Sun, 18 Aug 2024 17:11:25 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001085.3291656
GET

https://www.bing.com/rp/dcb-PwRbjINh_Wg-9pEP8tD_qO4.gz.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rp/dcb-PwRbjINh_Wg-9pEP8tD_qO4.gz.js HTTP/2.0
host: www.bing.com
accept: application/javascript, */*;q=0.8
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.bing.com
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

content-length: 3509
content-type: text/css; charset=utf-8
access-control-allow-headers: *
access-control-allow-origin: *
cache-control: public, max-age=432000
content-encoding: br
last-modified: Thu, 28 Oct 2010 04:13:30 GMT
vary: Accept-Encoding
x-eventid: 66bdec9c13f84ccb91d39de5efbb6a6d
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.75}
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingrms"}]}
date: Sun, 18 Aug 2024 17:11:25 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001085.3291657
GET

https://www.bing.com/rp/7DRnJ-ywpuG7tVaukb2LDibhBUg.gz.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rp/7DRnJ-ywpuG7tVaukb2LDibhBUg.gz.js HTTP/2.0
host: www.bing.com
accept: application/javascript, */*;q=0.8
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.bing.com
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

last-modified: Mon, 01 May 2023 19:03:28 GMT
etag: 0x8DB4A76BFB74FD8
cache-control: public, no-transform, max-age=396149
expires: Thu, 22 Aug 2024 05:19:22 GMT
akamai-grn: 0.60ba1302.1723907813.11f49e4
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 56177
content-type: text/javascript; charset=utf-8
content-encoding: gzip
content-md5: nfKKYcA5I3caM/oIeNO/Fg==
x-ms-request-id: 8064870b-f01e-0038-5add-e8a06c000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
vary: Accept-Encoding
date: Sun, 18 Aug 2024 17:11:25 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001085.329165e
GET

https://www.bing.com/rp/t4xaeuTBmu-Lp_KEbPyZVrfX8yw.gz.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rp/t4xaeuTBmu-Lp_KEbPyZVrfX8yw.gz.js HTTP/2.0
host: www.bing.com
accept: application/javascript, */*;q=0.8
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.bing.com
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

cache-control: public, max-age=432000, no-transform, immutable
content-length: 2740
content-type: text/javascript; charset=utf-8
content-encoding: gzip
content-md5: Iiqeb0LJKqyR2JzDblFzqg==
last-modified: Mon, 01 May 2023 19:02:49 GMT
etag: 0x8DB4A76A84F60BD
x-ms-request-id: 8bd5f29e-a01e-0078-6fc6-a2a754000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
akamai-amd-bc-debug: [a=2.17.209.38,b=159020790,c=c,d=1723997803,h=200,k=29,l=0,n=GB_EN_LONDON,o=20940,r=29,p=2740]
date: Sun, 18 Aug 2024 17:11:25 GMT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001085.3291659
GET

https://www.bing.com/rp/ss3d0sJoMnwEPabtwPxYd3-17LU.gz.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rp/ss3d0sJoMnwEPabtwPxYd3-17LU.gz.js HTTP/2.0
host: www.bing.com
accept: application/javascript, */*;q=0.8
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.bing.com
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

last-modified: Mon, 01 May 2023 19:03:33 GMT
etag: 0x8DB4A76C293B96D
cache-control: public, no-transform, max-age=431507
expires: Thu, 22 Aug 2024 17:11:30 GMT
akamai-grn: 0.a1777b5c.1723915182.26f9484
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 3782
content-type: text/javascript; charset=utf-8
content-encoding: gzip
content-md5: KDfeRVwk5HSPaHRNeOVNSA==
x-ms-request-id: 70f9c7ae-a01e-0025-78ee-e8add0000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
vary: Accept-Encoding
date: Sun, 18 Aug 2024 17:11:25 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001085.3291661
GET

https://www.bing.com/manifest/IEOneBox_V2.appcache?setlang=en-US

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /manifest/IEOneBox_V2.appcache?setlang=en-US HTTP/2.0
host: www.bing.com
accept: */*
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://www.bing.com
accept-encoding: gzip, deflate, br
cookie: MUID=27C2AB4B0CDB6BCF1683BF940DB76A1C; _EDGE_S=F=1&SID=0F26103D2EE762FF0A3004E22F8B638B; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=9B5358AD1E784BE9AD8B6F7E2DC0CC92&dmnchg=1; SRCHUSR=DOB=20240818; SRCHHPGUSR=SRCHLANG=en; _SS=SID=0F26103D2EE762FF0A3004E22F8B638B&CPID=1724001084708&AC=0&CPH=b75a24f7; MUIDB=27C2AB4B0CDB6BCF1683BF940DB76A1C

Response

HTTP/2.0 200

cache-control: public, max-age=432000, no-transform, immutable
content-length: 2468
content-type: text/javascript; charset=utf-8
content-encoding: gzip
content-md5: rgJVnW0GiNR97uW2JqdO9A==
last-modified: Sat, 20 Jul 2024 02:59:43 GMT
etag: 0x8DCA8680142F52D
x-ms-request-id: 8f8f18c3-d01e-0000-0f0f-f004ac000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
akamai-amd-bc-debug: [a=95.101.236.178,b=160579912,c=c,d=1723986374,h=200,k=1,l=0,n=GB_EN_LONDON,o=20940,r=1,p=2468]
date: Sun, 18 Aug 2024 17:11:34 GMT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001094.32952bd
GET

https://www.bing.com/rp/3AuqmR1rGd-9n8jGdRiAunNFAZA.gz.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rp/3AuqmR1rGd-9n8jGdRiAunNFAZA.gz.js HTTP/2.0
host: www.bing.com
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: MUID=27C2AB4B0CDB6BCF1683BF940DB76A1C; _EDGE_S=F=1&SID=0F26103D2EE762FF0A3004E22F8B638B; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=9B5358AD1E784BE9AD8B6F7E2DC0CC92&dmnchg=1; SRCHUSR=DOB=20240818; SRCHHPGUSR=SRCHLANG=en; _SS=SID=0F26103D2EE762FF0A3004E22F8B638B&CPID=1724001084708&AC=0&CPH=b75a24f7; MUIDB=27C2AB4B0CDB6BCF1683BF940DB76A1C

Response

HTTP/2.0 200

cache-control: public, max-age=432000, no-transform, immutable
content-length: 197
content-type: text/javascript; charset=utf-8
content-encoding: gzip
content-md5: vDXcSV+KdbhtCq4Z6ChaXg==
last-modified: Mon, 01 May 2023 19:03:17 GMT
etag: 0x8DB4A76B9220C70
x-ms-request-id: 31d59ace-801e-0050-641d-b0c6fc000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
akamai-amd-bc-debug: [a=2.16.128.15,b=75513919,c=c,d=1723968343,h=200,k=0,l=1,n=GB_EN_LONDON,o=20940,r=1,p=197]
date: Sun, 18 Aug 2024 17:11:34 GMT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001094.32952be
GET

https://www.bing.com/rp/WAAHGo-kP0xCDM16LGm9-alzHb8.gz.js

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /rp/WAAHGo-kP0xCDM16LGm9-alzHb8.gz.js HTTP/2.0
host: www.bing.com
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: MUID=27C2AB4B0CDB6BCF1683BF940DB76A1C; _EDGE_S=F=1&SID=0F26103D2EE762FF0A3004E22F8B638B; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=9B5358AD1E784BE9AD8B6F7E2DC0CC92&dmnchg=1; SRCHUSR=DOB=20240818; SRCHHPGUSR=SRCHLANG=en; _SS=SID=0F26103D2EE762FF0A3004E22F8B638B&CPID=1724001084708&AC=0&CPH=b75a24f7; MUIDB=27C2AB4B0CDB6BCF1683BF940DB76A1C

Response

HTTP/2.0 404

content-length: 46
content-type: text/html; charset=utf-8
cache-control: private
content-encoding: gzip
vary: Accept-Encoding
x-eventid: 66c22b4664a24edb937c872a24bc9aef
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
p3p: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND"
x-error-page: 404-custom
date: Sun, 18 Aug 2024 17:11:34 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001094.32952bf
POST

https://www.bing.com/AS/IEOneBox/xls.aspx

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

POST /AS/IEOneBox/xls.aspx HTTP/2.0
host: www.bing.com
accept: */*
origin: https://www.bing.com
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
content-type: text/xml
x-msedge-externalexptype: JointCoord
x-msedge-externalexp: null
accept-encoding: gzip, deflate, br
content-length: 445
cache-control: no-cache
cookie: MUID=27C2AB4B0CDB6BCF1683BF940DB76A1C; _EDGE_S=F=1&SID=0F26103D2EE762FF0A3004E22F8B638B; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=9B5358AD1E784BE9AD8B6F7E2DC0CC92&dmnchg=1; SRCHUSR=DOB=20240818; SRCHHPGUSR=SRCHLANG=en; _SS=SID=0F26103D2EE762FF0A3004E22F8B638B&CPID=1724001084708&AC=0&CPH=b75a24f7; MUIDB=27C2AB4B0CDB6BCF1683BF940DB76A1C

Response

HTTP/2.0 200

content-length: 541
content-type: text/cache-manifest; charset=utf-8
cache-control: private
content-encoding: gzip
vary: Accept-Encoding
x-eventid: 66c22b464bd04462b60d684edfd0ef0d
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
p3p: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND"
date: Sun, 18 Aug 2024 17:11:34 GMT
set-cookie: SRCHHPGUSR=SRCHLANG=en&IPMH=86adc6fa&IPMID=1724001084708; domain=.bing.com; expires=Fri, 12-Sep-2025 17:11:34 GMT; path=/
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001094.32952bc
GET

https://www.bing.com/AS/API/IEOneBox/V2/Suggestions?qry=d&cc=US&setlang=en-US&cp=1&cvid=68968dcbc8d046c491abf86461ba34a9&ig=fe5ab090afad46c8a62719e9e844917b

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /AS/API/IEOneBox/V2/Suggestions?qry=d&cc=US&setlang=en-US&cp=1&cvid=68968dcbc8d046c491abf86461ba34a9&ig=fe5ab090afad46c8a62719e9e844917b HTTP/2.0
host: www.bing.com
accept: */*
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
x-device-isoptin: false
x-search-cortanaavailablecapabilities: SpeechLanguage
x-autosuggest-contentwidth: 296
x-search-rpstoken: NA
authorization: Bearer NA
x-bm-clientfeatures: SmallerAnswers
accept-encoding: gzip, deflate, br
cookie: MUID=27C2AB4B0CDB6BCF1683BF940DB76A1C; _EDGE_S=F=1&SID=0F26103D2EE762FF0A3004E22F8B638B; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=9B5358AD1E784BE9AD8B6F7E2DC0CC92&dmnchg=1; SRCHUSR=DOB=20240818; SRCHHPGUSR=SRCHLANG=en&IPMH=86adc6fa&IPMID=1724001084708; _SS=SID=0F26103D2EE762FF0A3004E22F8B638B&CPID=1724001084708&AC=0&CPH=b75a24f7; MUIDB=27C2AB4B0CDB6BCF1683BF940DB76A1C

Response

HTTP/2.0 404

content-length: 17657
content-type: text/html; charset=utf-8
cache-control: private
content-encoding: gzip
vary: Accept-Encoding
x-eventid: 66c22b4653bd41479eb6e1b973b689b5
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
p3p: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND"
x-ua-compatible: IE=edge
date: Sun, 18 Aug 2024 17:11:34 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001094.32953ce
GET

https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /AS/API/IEOneBox/V2/Init?setlang=en-US HTTP/2.0
host: www.bing.com
accept: */*
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br
cookie: MUID=27C2AB4B0CDB6BCF1683BF940DB76A1C; _EDGE_S=F=1&SID=0F26103D2EE762FF0A3004E22F8B638B; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=9B5358AD1E784BE9AD8B6F7E2DC0CC92&dmnchg=1; SRCHUSR=DOB=20240818; SRCHHPGUSR=SRCHLANG=en&IPMH=86adc6fa&IPMID=1724001084708; _SS=SID=0F26103D2EE762FF0A3004E22F8B638B&CPID=1724001084708&AC=0&CPH=b75a24f7; MUIDB=27C2AB4B0CDB6BCF1683BF940DB76A1C

Response

HTTP/2.0 200

content-length: 846
content-type: application/json; charset=utf-8
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
expires: -1
pragma: no-cache
vary: Accept-Encoding
x-eventid: 66c22b46ad9642f096149ba6dce0ef12
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
p3p: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND"
date: Sun, 18 Aug 2024 17:11:34 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001094.32953c2
POST

https://www.bing.com/AS/IEOneBox/xls.aspx

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

POST /AS/IEOneBox/xls.aspx HTTP/2.0
host: www.bing.com
accept: */*
origin: https://www.bing.com
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
content-type: text/xml
x-msedge-externalexptype: JointCoord
x-msedge-externalexp: null
accept-encoding: gzip, deflate, br
content-length: 1094
cache-control: no-cache
cookie: MUID=27C2AB4B0CDB6BCF1683BF940DB76A1C; _EDGE_S=F=1&SID=0F26103D2EE762FF0A3004E22F8B638B; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=9B5358AD1E784BE9AD8B6F7E2DC0CC92&dmnchg=1; SRCHUSR=DOB=20240818; SRCHHPGUSR=SRCHLANG=en&IPMH=86adc6fa&IPMID=1724001084708; _SS=SID=0F26103D2EE762FF0A3004E22F8B638B&CPID=1724001093379&AC=0&CPH=b75a24f7; MUIDB=27C2AB4B0CDB6BCF1683BF940DB76A1C

Response

HTTP/2.0 404

content-length: 46
content-type: text/html; charset=utf-8
cache-control: private
content-encoding: gzip
vary: Accept-Encoding
x-eventid: 66c22b4b97684b44b5d774312145b269
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
p3p: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND"
x-error-page: 404-custom
date: Sun, 18 Aug 2024 17:11:39 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001099.3297694
POST

https://www.bing.com/AS/IEOneBox/xls.aspx

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

POST /AS/IEOneBox/xls.aspx HTTP/2.0
host: www.bing.com
accept: */*
origin: https://www.bing.com
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
content-type: text/xml
x-msedge-externalexptype: JointCoord
x-msedge-externalexp: null
accept-encoding: gzip, deflate, br
content-length: 405
cache-control: no-cache
cookie: MUID=27C2AB4B0CDB6BCF1683BF940DB76A1C; _EDGE_S=F=1&SID=0F26103D2EE762FF0A3004E22F8B638B; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=9B5358AD1E784BE9AD8B6F7E2DC0CC92&dmnchg=1; SRCHUSR=DOB=20240818; SRCHHPGUSR=SRCHLANG=en&IPMH=86adc6fa&IPMID=1724001084708; _SS=SID=0F26103D2EE762FF0A3004E22F8B638B&CPID=1724001093379&AC=0&CPH=b75a24f7; MUIDB=27C2AB4B0CDB6BCF1683BF940DB76A1C

Response

HTTP/2.0 404

content-length: 46
content-type: text/html; charset=utf-8
cache-control: private
content-encoding: gzip
vary: Accept-Encoding
x-eventid: 66c22b4ccb2b4413b60bfc9b92c885e3
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
p3p: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND"
x-error-page: 404-custom
date: Sun, 18 Aug 2024 17:11:40 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001100.3297f13
POST

https://www.bing.com/AS/IEOneBox/xls.aspx

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

POST /AS/IEOneBox/xls.aspx HTTP/2.0
host: www.bing.com
accept: */*
origin: https://www.bing.com
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
content-type: text/xml
x-msedge-externalexptype: JointCoord
x-msedge-externalexp: null
accept-encoding: gzip, deflate, br
content-length: 512
cache-control: no-cache
cookie: MUID=27C2AB4B0CDB6BCF1683BF940DB76A1C; _EDGE_S=F=1&SID=0F26103D2EE762FF0A3004E22F8B638B; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=9B5358AD1E784BE9AD8B6F7E2DC0CC92&dmnchg=1; SRCHUSR=DOB=20240818; SRCHHPGUSR=SRCHLANG=en&IPMH=86adc6fa&IPMID=1724001084708; _SS=SID=0F26103D2EE762FF0A3004E22F8B638B&CPID=1724001093379&AC=0&CPH=b75a24f7; MUIDB=27C2AB4B0CDB6BCF1683BF940DB76A1C

Response

HTTP/2.0 404

content-length: 46
content-type: text/html; charset=utf-8
cache-control: private
content-encoding: gzip
vary: Accept-Encoding
x-eventid: 66c22b4d97c2454a9c545329e1dc24a6
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
p3p: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND"
x-error-page: 404-custom
date: Sun, 18 Aug 2024 17:11:41 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001101.3298905
POST

https://www.bing.com/AS/IEOneBox/xls.aspx

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

POST /AS/IEOneBox/xls.aspx HTTP/2.0
host: www.bing.com
accept: */*
origin: https://www.bing.com
referer: https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ServiceUI 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
content-type: text/xml
x-msedge-externalexptype: JointCoord
x-msedge-externalexp: null
accept-encoding: gzip, deflate, br
content-length: 651
cache-control: no-cache
cookie: MUID=27C2AB4B0CDB6BCF1683BF940DB76A1C; _EDGE_S=F=1&SID=0F26103D2EE762FF0A3004E22F8B638B; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=9B5358AD1E784BE9AD8B6F7E2DC0CC92&dmnchg=1; SRCHUSR=DOB=20240818; SRCHHPGUSR=SRCHLANG=en&IPMH=86adc6fa&IPMID=1724001084708; _SS=SID=0F26103D2EE762FF0A3004E22F8B638B&CPID=1724001093379&AC=0&CPH=b75a24f7; MUIDB=27C2AB4B0CDB6BCF1683BF940DB76A1C

Response

HTTP/2.0 404

content-length: 46
content-type: text/html; charset=utf-8
cache-control: private
content-encoding: gzip
vary: Accept-Encoding
x-eventid: 66c22b51eb3e443f925875564ec8e5b5
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
p3p: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND"
x-error-page: 404-custom
date: Sun, 18 Aug 2024 17:11:45 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c68f655f.1724001105.329a77c
GET

https://www.bing.com/partner/warmup.gif

MicrosoftEdgeCP.exe

Remote address:

95.101.143.195:443

Request

GET /partner/warmup.gif HTTP/2.0
host: www.bing.com
accept: */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

cache-control: no-cache
pragma: no-cache
content-length: 43
content-type: image/gif
expires: -1
x-eventid: 66c22b32945a4e998ac2ec4b08a99c78
useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FC89E906E21C432AB3D030C12CE658DF Ref B: LON601060103042 Ref C: 2024-08-18T17:11:14Z
date: Sun, 18 Aug 2024 17:11:14 GMT
set-cookie: MUID=3BB7D42D808265722495C0F2811D64D3; domain=.bing.com; expires=Fri, 12-Sep-2025 17:11:14 GMT; path=/; secure; SameSite=None
set-cookie: MUIDB=3BB7D42D808265722495C0F2811D64D3; expires=Fri, 12-Sep-2025 17:11:14 GMT; path=/; HttpOnly
set-cookie: _EDGE_S=F=1&SID=287D8DCB04916F6D32439914050E6E37; domain=.bing.com; path=/; HttpOnly
set-cookie: _EDGE_V=1; domain=.bing.com; expires=Fri, 12-Sep-2025 17:11:14 GMT; path=/; HttpOnly
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.bf8f655f.1724001074.41dc13c
DNS

195.143.101.95.in-addr.arpa

Remote address:

8.8.8.8:53

Request

195.143.101.95.in-addr.arpa

IN PTR

Response

195.143.101.95.in-addr.arpa

IN PTR

a95-101-143-195deploystaticakamaitechnologiescom
DNS

13.179.89.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.179.89.13.in-addr.arpa

IN PTR

Response
DNS

gofile.io

MicrosoftEdge.exe

Remote address:

8.8.8.8:53

Request

gofile.io

IN A

Response

gofile.io

IN A

51.38.43.18

gofile.io

IN A

45.112.123.126
GET

http://gofile.io/d/9bbffC

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:80

Request

GET /d/9bbffC HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
Accept-Encoding: gzip, deflate
Host: gofile.io
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: https://gofile.io/d/9bbffC
Server: Caddy
Date: Sun, 18 Aug 2024 17:12:01 GMT
Content-Length: 0
GET

https://gofile.io/d/9bbffC

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /d/9bbffC HTTP/2.0
host: gofile.io
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: text/html; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"27a7-19012278f35"
expect-ct: max-age=0
last-modified: Thu, 13 Jun 2024 15:11:40 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 10151
GET

https://gofile.io/dist/css/bootstrap.min.css

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/css/bootstrap.min.css HTTP/2.0
host: gofile.io
accept: text/css, */*
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: text/css; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"17579-1857d39aa87"
expect-ct: max-age=0
last-modified: Wed, 04 Jan 2023 14:40:09 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 95609
GET

https://gofile.io/dist/css/bootstrap-icons.css

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/css/bootstrap-icons.css HTTP/2.0
host: gofile.io
accept: text/css, */*
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: text/css; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"c869-1857d39aa87"
expect-ct: max-age=0
last-modified: Wed, 04 Jan 2023 14:40:09 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 51305
GET

https://gofile.io/dist/css/bootstrap-nightfall.css

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/css/bootstrap-nightfall.css HTTP/2.0
host: gofile.io
accept: text/css, */*
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: text/css; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"85ae-18592ec961b"
expect-ct: max-age=0
last-modified: Sun, 08 Jan 2023 19:47:36 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 34222
GET

https://gofile.io/dist/css/plyr.css

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/css/plyr.css HTTP/2.0
host: gofile.io
accept: text/css, */*
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: text/css; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"2fbaa-1857d39aa87"
expect-ct: max-age=0
last-modified: Wed, 04 Jan 2023 14:40:09 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 195498
GET

https://gofile.io/dist/css/allcss.css

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/css/allcss.css HTTP/2.0
host: gofile.io
accept: text/css, */*
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: text/css; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"758-18d43219e7e"
expect-ct: max-age=0
last-modified: Fri, 26 Jan 2024 00:18:13 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 1880
GET

https://gofile.io/dist/img/logo-small-70.png

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/img/logo-small-70.png HTTP/2.0
host: gofile.io
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: image/png
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"93f-1857d39aa87"
expect-ct: max-age=0
last-modified: Wed, 04 Jan 2023 14:40:09 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 2367
GET

https://gofile.io/dist/js/bootstrap.bundle.min.js

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/js/bootstrap.bundle.min.js HTTP/2.0
host: gofile.io
accept: application/javascript, */*;q=0.8
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: application/javascript; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"13a49-1857d39aa87"
expect-ct: max-age=0
last-modified: Wed, 04 Jan 2023 14:40:09 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 80457
GET

https://gofile.io/dist/js/sha256.min.js

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/js/sha256.min.js HTTP/2.0
host: gofile.io
accept: application/javascript, */*;q=0.8
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: application/javascript; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"2339-1857d39aa8b"
expect-ct: max-age=0
last-modified: Wed, 04 Jan 2023 14:40:09 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 9017
GET

https://gofile.io/dist/js/qrcode.min.js

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/js/qrcode.min.js HTTP/2.0
host: gofile.io
accept: application/javascript, */*;q=0.8
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: application/javascript; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"4dda-1857d39aa8b"
expect-ct: max-age=0
last-modified: Wed, 04 Jan 2023 14:40:09 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 19930
GET

https://gofile.io/dist/js/dayjs.min.js

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/js/dayjs.min.js HTTP/2.0
host: gofile.io
accept: application/javascript, */*;q=0.8
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: application/javascript; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"1a0e-1857d39aa8b"
expect-ct: max-age=0
last-modified: Wed, 04 Jan 2023 14:40:09 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 6670
GET

https://gofile.io/dist/js/customParseFormat.js

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/js/customParseFormat.js HTTP/2.0
host: gofile.io
accept: application/javascript, */*;q=0.8
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: application/javascript; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"ea2-1857d39aa8b"
expect-ct: max-age=0
last-modified: Wed, 04 Jan 2023 14:40:09 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 3746
GET

https://gofile.io/dist/js/marked.min.js

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/js/marked.min.js HTTP/2.0
host: gofile.io
accept: application/javascript, */*;q=0.8
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: application/javascript; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"aca2-1857d39aa8b"
expect-ct: max-age=0
last-modified: Wed, 04 Jan 2023 14:40:09 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 44194
GET

https://gofile.io/dist/js/plyr.js

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/js/plyr.js HTTP/2.0
host: gofile.io
accept: application/javascript, */*;q=0.8
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: application/javascript; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"1b1b2-18592ec961b"
expect-ct: max-age=0
last-modified: Sun, 08 Jan 2023 19:47:36 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 111026
GET

https://gofile.io/dist/js/chart.umd.min.js

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/js/chart.umd.min.js HTTP/2.0
host: gofile.io
accept: application/javascript, */*;q=0.8
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: application/javascript; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"3094c-186c296a29e"
expect-ct: max-age=0
last-modified: Wed, 08 Mar 2023 18:58:17 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 198988
GET

https://gofile.io/dist/js/alljs.js

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/js/alljs.js HTTP/2.0
host: gofile.io
accept: application/javascript, */*;q=0.8
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: application/javascript; charset=UTF-8
date: Sun, 18 Aug 2024 17:12:01 GMT
etag: W/"38e8b-191280c5799"
expect-ct: max-age=0
last-modified: Tue, 06 Aug 2024 14:16:23 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 233099
GET

https://gofile.io/dist/css/fonts/bootstrap-icons.woff2?24e3eb84d0bcaf83d77f904c78ac1f47

MicrosoftEdgeCP.exe

Remote address:

51.38.43.18:443

Request

GET /dist/css/fonts/bootstrap-icons.woff2?24e3eb84d0bcaf83d77f904c78ac1f47 HTTP/2.0
host: gofile.io
accept: */*
referer: https://gofile.io/d/9bbffC
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
origin: https://gofile.io
accept-encoding: gzip, deflate, br

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: font/woff2
date: Sun, 18 Aug 2024 17:12:03 GMT
etag: W/"1d9d0-1857d39aa87"
expect-ct: max-age=0
last-modified: Wed, 04 Jan 2023 14:40:09 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 121296
DNS

18.43.38.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.43.38.51.in-addr.arpa

IN PTR

Response

18.43.38.51.in-addr.arpa

IN PTR

ns3120834ip-51-38-43eu
DNS

168.245.100.95.in-addr.arpa

Remote address:

8.8.8.8:53

Request

168.245.100.95.in-addr.arpa

IN PTR

Response

168.245.100.95.in-addr.arpa

IN PTR

a95-100-245-168deploystaticakamaitechnologiescom
GET

https://gofile.io/dist/img/favicon16.png

MicrosoftEdge.exe

Remote address:

51.38.43.18:443

Request

GET /dist/img/favicon16.png HTTP/2.0
host: gofile.io
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
dnt: 1

Response

HTTP/2.0 200

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0
content-type: image/png
date: Sun, 18 Aug 2024 17:12:03 GMT
etag: W/"1f7-1857d39aa87"
expect-ct: max-age=0
last-modified: Wed, 04 Jan 2023 14:40:09 GMT
origin-agent-cluster: ?1
referrer-policy: origin
server: Caddy
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-length: 503

216.58.214.174:443

www.youtube.com

tls, http2

MicrosoftEdgeCP.exe

1.2kB
7.4kB
18
12
216.58.214.174:443

https://www.youtube.com/img/desktop/supported_browsers/firefox.png

tls, http2

MicrosoftEdgeCP.exe

6.7kB
110.6kB
108
98

HTTP Request

GET https://www.youtube.com/watch?v=FRHZ1HMP_SU

HTTP Response

302

HTTP Request

GET https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DFRHZ1HMP_SU

HTTP Response

200

HTTP Request

GET https://www.youtube.com/img/desktop/supported_browsers/yt_logo_rgb_light.png

HTTP Request

GET https://www.youtube.com/img/desktop/supported_browsers/dinosaur.png

HTTP Request

GET https://www.youtube.com/img/desktop/supported_browsers/opera.png

HTTP Request

GET https://www.youtube.com/img/desktop/supported_browsers/edgium.png

HTTP Request

GET https://www.youtube.com/img/desktop/supported_browsers/chrome.png

HTTP Request

GET https://www.youtube.com/img/desktop/supported_browsers/firefox.png

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200
216.58.214.67:80

http://c.pki.goog/r/r1.crl

http

MicrosoftEdgeCP.exe

395 B
1.8kB
6
5

HTTP Request

GET http://c.pki.goog/r/r1.crl

HTTP Response

200
216.58.214.67:80

http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDAezvzBOn2FxIghPLaMkP6

http

MicrosoftEdgeCP.exe

1.2kB
2.4kB
10
6

HTTP Request

GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEHGN%2BKTRSIp4CcztJxB9gYQ%3D

HTTP Response

200

HTTP Request

GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCjHbN8Q48ByBJsBZfEZOeO

HTTP Response

200

HTTP Request

GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDAezvzBOn2FxIghPLaMkP6

HTTP Response

200
216.58.214.174:443

www.youtube.com

tls, http2

MicrosoftEdge.exe

1.2kB
7.4kB
17
12
216.58.214.174:443

https://www.youtube.com/favicon.ico

tls, http2

MicrosoftEdge.exe

1.6kB
8.4kB
22
18

HTTP Request

GET https://www.youtube.com/favicon.ico

HTTP Response

200
216.58.214.67:80

http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D

http

MicrosoftEdge.exe

607 B
1.9kB
8
6

HTTP Request

GET http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D

HTTP Response

200
216.58.214.67:80

http://c.pki.goog/r/r1.crl

http

MicrosoftEdge.exe

533 B
1.8kB
9
6

HTTP Request

GET http://c.pki.goog/r/r1.crl

HTTP Response

200
216.58.214.67:80

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEHGN%2BKTRSIp4CcztJxB9gYQ%3D

http

MicrosoftEdge.exe

513 B
884 B
6
4

HTTP Request

GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEHGN%2BKTRSIp4CcztJxB9gYQ%3D

HTTP Response

200
204.79.197.203:443

https://www.msn.com/bundles/v1/edge/latest/manifest.appcache?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default

tls, http2

MicrosoftEdgeCP.exe

9.4kB
151.0kB
152
150

HTTP Request

GET https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default

HTTP Response

200

HTTP Request

GET https://www.msn.com/bundles/v1/edge/latest/manifest.appcache?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default

HTTP Response

200

HTTP Request

GET https://www.msn.com/spartan/ntp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default

HTTP Response

200

HTTP Request

GET https://www.msn.com/bundles/v1/edge/latest/manifest.appcache?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=default

HTTP Response

200
204.79.197.203:443

www.msn.com

tls, http2

MicrosoftEdgeCP.exe

1.2kB
7.0kB
16
15
95.101.143.176:443

https://assets.msn.com/staticsb/statics/latest/oneTrust/1.9/scripttemplates/202310.2.0/otTCF.js

tls, http2

MicrosoftEdgeCP.exe

19.2kB
491.4kB
377
367

HTTP Request

GET https://assets.msn.com/bundles/v1/edge/latest/vendors.c47bf4f4981f23895ddb.js

HTTP Request

GET https://assets.msn.com/staticsb/statics/latest/oneTrust/1.9/scripttemplates/otSDKStub.js

HTTP Request

GET https://assets.msn.com/bundles/v1/edge/latest/common.5dd7cff85de67632bfd7.js

HTTP Request

GET https://assets.msn.com/bundles/v1/edge/latest/microsoft.8aa91a5fe4f5d8517ae1.js

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://assets.msn.com/staticsb/statics/latest/oneTrust/1.9/consent/55a804ab-e5c6-4b97-9319-86263d365d28/55a804ab-e5c6-4b97-9319-86263d365d28.json

HTTP Response

200

HTTP Request

GET https://assets.msn.com/staticsb/statics/latest/oneTrust/1.9/scripttemplates/202310.2.0/otBannerSdk.js

HTTP Response

200

HTTP Request

GET https://assets.msn.com/staticsb/statics/latest/oneTrust/1.9/consent/55a804ab-e5c6-4b97-9319-86263d365d28/e51556d4-5848-4a4b-a5e2-bc98431e1bf7/en-gb.json

HTTP Request

GET https://assets.msn.com/staticsb/statics/latest/oneTrust/1.9/consent/55a804ab-e5c6-4b97-9319-86263d365d28/iab2V2Data.json

HTTP Request

GET https://assets.msn.com/staticsb/statics/latest/oneTrust/1.9/scripttemplates/202310.2.0/otTCF.js

HTTP Response

200

HTTP Response

200

HTTP Response

200
95.101.143.176:443

assets.msn.com

tls, http2

MicrosoftEdgeCP.exe

1.1kB
4.6kB
15
14
95.101.143.176:443

assets.msn.com

tls, http2

MicrosoftEdgeCP.exe

1.1kB
4.6kB
15
13
95.101.143.176:443

assets.msn.com

tls, http2

MicrosoftEdgeCP.exe

1.1kB
4.6kB
15
14
51.132.193.104:443

https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1724000980000&w=0&anoncknm=app_anon

tls, http2

MicrosoftEdgeCP.exe

15.5kB
9.0kB
34
22

HTTP Request

POST https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1724000980000&w=0&anoncknm=app_anon

HTTP Response

200

HTTP Request

POST https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1724000980000&w=0&anoncknm=app_anon

HTTP Response

200

HTTP Request

POST https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1724000980000&w=0&anoncknm=app_anon

HTTP Response

200
51.132.193.104:443

browser.events.data.msn.com

tls, http2

MicrosoftEdgeCP.exe

1.2kB
6.9kB
16
12
204.79.197.203:443

www.msn.com

tls, http2

MicrosoftEdge.exe

1.5kB
7.0kB
18
15
204.79.197.203:443

https://www.msn.com/favicon.ico

tls, http2

MicrosoftEdge.exe

1.8kB
8.8kB
21
16

HTTP Request

GET https://www.msn.com/favicon.ico

HTTP Response

200
204.79.197.200:443

ieonline.microsoft.com

tls, http2

MicrosoftEdge.exe

1.6kB
9.6kB
18
15
88.221.135.26:443

www.bing.com

tls, http2

MicrosoftEdge.exe

1.1kB
4.7kB
14
10
88.221.135.26:443

https://www.bing.com/cortanaassist/rules?cc=US&version=6

tls, http2

MicrosoftEdge.exe

3.3kB
64.1kB
56
50

HTTP Request

GET https://www.bing.com/cortanaassist/rules?cc=US&version=6

HTTP Response

404
95.101.143.195:443

https://www.bing.com/AS/IEOneBox/xls.aspx

tls, http2

MicrosoftEdgeCP.exe

25.8kB
227.2kB
230
200

HTTP Request

GET https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US

HTTP Response

200

HTTP Request

GET https://www.bing.com/rb/19/cir3,ortl,cc,nc/H7yNdbJxRRAcp5Cd9wD9aQLYG6s.css?bu=C6QJlgOrBIAK5QjPCN4GXV3JBF0

HTTP Request

GET https://www.bing.com/rb/19/cir3,ortl,cc,nc/XxqYiyTu9Zkh9t7nVvBNsDKSLlQ.css?bu=BsgCSK0CUl3KAg

HTTP Request

GET https://www.bing.com/rb/3E/ortl,cc,nc/4-xJy3tX6bM2BGl5zKioiEcQ1TU.css?bu=A4gCjAKPAg

HTTP Request

GET https://www.bing.com/rp/lZfFRIZsGLf3poBW6xAz2KFILkI.gz.js

HTTP Request

GET https://www.bing.com/rp/6wzJBpbyuAoCS5bfkKiW0Aw2R6o.gz.js

HTTP Request

GET https://www.bing.com/rp/DicRs1X5x7sMwnmwcxBuO2kpGeI.gz.js

HTTP Request

GET https://www.bing.com/rp/L3qgZ2pA6whKnPPHkQnZ2_d8WVo.gz.js

HTTP Request

GET https://www.bing.com/rp/IOwhK4uDW4Sh2EVXk1BBw5OkHPY.gz.js

HTTP Request

GET https://www.bing.com/rb/4N/jnc,nj/oD_VAxa789XdcG8Fl8GtB-FCB-Y.js?bu=D7Us9Sr8AYYriSuMK44rsyu9LIYspCr8EZ4spCjlKw

HTTP Request

GET https://www.bing.com/rp/dcb-PwRbjINh_Wg-9pEP8tD_qO4.gz.js

HTTP Request

GET https://www.bing.com/rp/7DRnJ-ywpuG7tVaukb2LDibhBUg.gz.js

HTTP Request

GET https://www.bing.com/rp/t4xaeuTBmu-Lp_KEbPyZVrfX8yw.gz.js

HTTP Request

GET https://www.bing.com/rp/ss3d0sJoMnwEPabtwPxYd3-17LU.gz.js

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://www.bing.com/manifest/IEOneBox_V2.appcache?setlang=en-US

HTTP Request

GET https://www.bing.com/rp/3AuqmR1rGd-9n8jGdRiAunNFAZA.gz.js

HTTP Request

GET https://www.bing.com/rp/WAAHGo-kP0xCDM16LGm9-alzHb8.gz.js

HTTP Request

POST https://www.bing.com/AS/IEOneBox/xls.aspx

HTTP Response

200

HTTP Response

200

HTTP Response

404

HTTP Response

200

HTTP Request

GET https://www.bing.com/AS/API/IEOneBox/V2/Suggestions?qry=d&cc=US&setlang=en-US&cp=1&cvid=68968dcbc8d046c491abf86461ba34a9&ig=fe5ab090afad46c8a62719e9e844917b

HTTP Request

GET https://www.bing.com/AS/API/IEOneBox/V2/Init?setlang=en-US

HTTP Response

404

HTTP Response

200

HTTP Request

POST https://www.bing.com/AS/IEOneBox/xls.aspx

HTTP Response

404

HTTP Request

POST https://www.bing.com/AS/IEOneBox/xls.aspx

HTTP Response

404

HTTP Request

POST https://www.bing.com/AS/IEOneBox/xls.aspx

HTTP Response

404

HTTP Request

POST https://www.bing.com/AS/IEOneBox/xls.aspx

HTTP Response

404
95.101.143.195:443

www.bing.com

tls, http2

MicrosoftEdgeCP.exe

1.8kB
13.3kB
20
14
95.101.143.195:443

https://www.bing.com/partner/warmup.gif

tls, http2

MicrosoftEdgeCP.exe

1.8kB
5.8kB
16
12

HTTP Request

GET https://www.bing.com/partner/warmup.gif

HTTP Response

200
95.101.143.195:443

www.bing.com

tls, http2

MicrosoftEdgeCP.exe

1.4kB
4.7kB
16
12
51.38.43.18:80

http://gofile.io/d/9bbffC

http

MicrosoftEdgeCP.exe

508 B
263 B
4
3

HTTP Request

GET http://gofile.io/d/9bbffC

HTTP Response

302
51.38.43.18:80

gofile.io

MicrosoftEdgeCP.exe

98 B
52 B
2
1
51.38.43.18:443

https://gofile.io/dist/css/fonts/bootstrap-icons.woff2?24e3eb84d0bcaf83d77f904c78ac1f47

tls, http2

MicrosoftEdgeCP.exe

54.9kB
1.3MB
994
988

HTTP Request

GET https://gofile.io/d/9bbffC

HTTP Response

200

HTTP Request

GET https://gofile.io/dist/css/bootstrap.min.css

HTTP Request

GET https://gofile.io/dist/css/bootstrap-icons.css

HTTP Request

GET https://gofile.io/dist/css/bootstrap-nightfall.css

HTTP Request

GET https://gofile.io/dist/css/plyr.css

HTTP Request

GET https://gofile.io/dist/css/allcss.css

HTTP Request

GET https://gofile.io/dist/img/logo-small-70.png

HTTP Request

GET https://gofile.io/dist/js/bootstrap.bundle.min.js

HTTP Request

GET https://gofile.io/dist/js/sha256.min.js

HTTP Request

GET https://gofile.io/dist/js/qrcode.min.js

HTTP Request

GET https://gofile.io/dist/js/dayjs.min.js

HTTP Request

GET https://gofile.io/dist/js/customParseFormat.js

HTTP Request

GET https://gofile.io/dist/js/marked.min.js

HTTP Request

GET https://gofile.io/dist/js/plyr.js

HTTP Request

GET https://gofile.io/dist/js/chart.umd.min.js

HTTP Request

GET https://gofile.io/dist/js/alljs.js

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://gofile.io/dist/css/fonts/bootstrap-icons.woff2?24e3eb84d0bcaf83d77f904c78ac1f47

HTTP Response

200
51.38.43.18:443

https://gofile.io/dist/img/favicon16.png

tls, http2

MicrosoftEdge.exe

1.3kB
5.8kB
15
14

HTTP Request

GET https://gofile.io/dist/img/favicon16.png

HTTP Response

200
51.38.43.18:443

gofile.io

tls, http2

MicrosoftEdge.exe

898 B
4.7kB
11
10

8.8.8.8:53

www.youtube.com

dns

MicrosoftEdge.exe

61 B
271 B
1
1

DNS Request

www.youtube.com

DNS Response

216.58.214.174

142.250.179.78

142.250.75.238

172.217.20.206

142.250.178.142

142.250.74.238

142.250.179.110

142.250.201.174

172.217.20.174

216.58.214.78

216.58.215.46
8.8.8.8:53

174.214.58.216.in-addr.arpa

dns

73 B
173 B
1
1

DNS Request

174.214.58.216.in-addr.arpa
8.8.8.8:53

c.pki.goog

dns

MicrosoftEdge.exe

56 B
107 B
1
1

DNS Request

c.pki.goog

DNS Response

216.58.214.67
8.8.8.8:53

o.pki.goog

dns

MicrosoftEdge.exe

56 B
107 B
1
1

DNS Request

o.pki.goog

DNS Response

216.58.214.67
8.8.8.8:53

25.140.123.92.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

25.140.123.92.in-addr.arpa
8.8.8.8:53

67.214.58.216.in-addr.arpa

dns

72 B
169 B
1
1

DNS Request

67.214.58.216.in-addr.arpa
8.8.8.8:53

234.75.250.142.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

234.75.250.142.in-addr.arpa
8.8.8.8:53

67.179.250.142.in-addr.arpa

dns

73 B
111 B
1
1

DNS Request

67.179.250.142.in-addr.arpa
8.8.8.8:53

www.msn.com

dns

MicrosoftEdge.exe

57 B
132 B
1
1

DNS Request

www.msn.com

DNS Response

204.79.197.203
8.8.8.8:53

assets.msn.com

dns

MicrosoftEdgeCP.exe

60 B
246 B
1
1

DNS Request

assets.msn.com

DNS Response

95.101.143.176

95.101.143.122

95.101.143.105

95.101.143.128

95.101.143.155

95.101.143.104

95.101.143.121
8.8.8.8:53

browser.events.data.msn.com

dns

MicrosoftEdgeCP.exe

73 B
201 B
1
1

DNS Request

browser.events.data.msn.com

DNS Response

51.132.193.104
8.8.8.8:53

176.143.101.95.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

176.143.101.95.in-addr.arpa
8.8.8.8:53

104.193.132.51.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

104.193.132.51.in-addr.arpa
8.8.8.8:53

161.19.199.152.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

161.19.199.152.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

200.197.79.204.in-addr.arpa

dns

73 B
106 B
1
1

DNS Request

200.197.79.204.in-addr.arpa
8.8.8.8:53

57.110.18.2.in-addr.arpa

dns

140 B
133 B
2
1

DNS Request

57.110.18.2.in-addr.arpa

DNS Request

57.110.18.2.in-addr.arpa
8.8.8.8:53

www.microsoft.com

dns

MicrosoftEdge.exe

126 B
230 B
2
1

DNS Request

www.microsoft.com

DNS Request

www.microsoft.com

DNS Response

95.100.245.144
8.8.8.8:53

34.56.20.217.in-addr.arpa

dns

71 B
131 B
1
1

DNS Request

34.56.20.217.in-addr.arpa
8.8.8.8:53

26.135.221.88.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

26.135.221.88.in-addr.arpa
8.8.8.8:53

144.245.100.95.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

144.245.100.95.in-addr.arpa
8.8.8.8:53

13.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

13.227.111.52.in-addr.arpa
8.8.8.8:53

195.143.101.95.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

195.143.101.95.in-addr.arpa
8.8.8.8:53

13.179.89.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

13.179.89.13.in-addr.arpa
8.8.8.8:53

gofile.io

dns

MicrosoftEdge.exe

55 B
87 B
1
1

DNS Request

gofile.io

DNS Response

51.38.43.18

45.112.123.126
8.8.8.8:53

18.43.38.51.in-addr.arpa

dns

70 B
108 B
1
1

DNS Request

18.43.38.51.in-addr.arpa
8.8.8.8:53

168.245.100.95.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

168.245.100.95.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L5P12AEX\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\3R5DZRET\www.bing[1].xml

Filesize
97B

MD5
478af8178a3b02ae6132eb38cd48a353

SHA1
a7d135ad4d88c84ad5e0dac6d9f5574623cafcb0

SHA256
9aff1a93b39c86f9c7274fc50dea5832b657aa22458096cc6da65c2202860d39

SHA512
09aaa5eb152e683862e8e58ceceb783b765bf5b4ec21d2945e62c73dd4bc24de429812b3022d74f0770588eccec9b1889555f78dc164e583cb0a2f62961a0cdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\C7ND021V\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\TABYYGGX\favicon[1].ico

Filesize
1KB

MD5
f2a495d85735b9a0ac65deb19c129985

SHA1
f2e22853e5da3e1017d5e1e319eeefe4f622e8c8

SHA256
8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d

SHA512
6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\YA6IY7J6\favicon16[1].png

Filesize
503B

MD5
ad98355e85075a8ebc15a01f875e1aab

SHA1
de8398fdfeb3bbd48a58a8b12453e1fee61e5f2d

SHA256
6a437098dcbb8a0354ae28a5f7825685f471c13cecb83186cc950844df7c76c4

SHA512
1b5d5402256ec3ccc20f1b1b635a9ea16131c2aec49c94105c8b7d3e32c9bfd45e937bde8af35ced6b22f39526de2672ba145ec43f49aba4d7a66da79e13819a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\YA6IY7J6\favicon[1].ico

Filesize
758B

MD5
84cc977d0eb148166481b01d8418e375

SHA1
00e2461bcd67d7ba511db230415000aefbd30d2d

SHA256
bbf8da37d92138cc08ffeec8e3379c334988d5ae99f4415579999bfbbb57a66c

SHA512
f47a507077f9173fb07ec200c2677ba5f783d645be100f12efe71f701a74272a98e853c4fab63740d685853935d545730992d0004c9d2fe8e1965445cab509c3

Download Submit
memory/1356-45-0x000002DE78280000-0x000002DE78380000-memory.dmp

Filesize
1024KB

Download
memory/2240-441-0x000001EF45300000-0x000001EF45400000-memory.dmp

Filesize
1024KB

Download
memory/2644-89-0x000001B066140000-0x000001B066142000-memory.dmp

Filesize
8KB

Download
memory/2644-95-0x000001B066190000-0x000001B066192000-memory.dmp

Filesize
8KB

Download
memory/2644-93-0x000001B066180000-0x000001B066182000-memory.dmp

Filesize
8KB

Download
memory/2644-91-0x000001B066160000-0x000001B066162000-memory.dmp

Filesize
8KB

Download
memory/2644-97-0x000001B0661B0000-0x000001B0661B2000-memory.dmp

Filesize
8KB

Download
memory/2644-65-0x000001B0552B0000-0x000001B0552B2000-memory.dmp

Filesize
8KB

Download
memory/2644-68-0x000001B0552E0000-0x000001B0552E2000-memory.dmp

Filesize
8KB

Download
memory/2644-70-0x000001B0657A0000-0x000001B0657A2000-memory.dmp

Filesize
8KB

Download
memory/2644-64-0x000001B055500000-0x000001B055600000-memory.dmp

Filesize
1024KB

Download
memory/4592-182-0x0000020E9ED80000-0x0000020E9EDA0000-memory.dmp

Filesize
128KB

Download
memory/4592-164-0x0000020E9E400000-0x0000020E9E500000-memory.dmp

Filesize
1024KB

Download
memory/4592-177-0x0000020E9ECA0000-0x0000020E9ECC0000-memory.dmp

Filesize
128KB

Download
memory/4592-161-0x0000020E9DEC0000-0x0000020E9DEE0000-memory.dmp

Filesize
128KB

Download
memory/4592-153-0x0000020E9DEE0000-0x0000020E9DF00000-memory.dmp

Filesize
128KB

Download
memory/4592-330-0x0000020E9FB40000-0x0000020E9FB60000-memory.dmp

Filesize
128KB

Download
memory/4592-335-0x0000020EB05F0000-0x0000020EB0610000-memory.dmp

Filesize
128KB

Download
memory/4648-0-0x0000016F88320000-0x0000016F88330000-memory.dmp

Filesize
64KB

Download
memory/4648-123-0x0000016F8E860000-0x0000016F8E861000-memory.dmp

Filesize
4KB

Download
memory/4648-122-0x0000016F8E850000-0x0000016F8E851000-memory.dmp

Filesize
4KB

Download
memory/4648-35-0x0000016F874E0000-0x0000016F874E2000-memory.dmp

Filesize
8KB

Download
memory/4648-16-0x0000016F88420000-0x0000016F88430000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request