Edit tour

Windows Analysis Report
http://esuper.giize.com/track/3nFyeL1856Txfl2mxxurvuzom168QHIOOXHLCCRFKCA68673JUWD278x9

Overview

General Information

Sample URL:	http://esuper.giize.com/track/3nFyeL1856Txfl2mxxurvuzom168QHIOOXHLCCRFKCA68673JUWD278x9
Analysis ID:	1426585
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body contains low number of good links

HTML title does not match URL

None HTTPS page querying sensitive user data (password, username or email)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5556 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://esuper.giize.com/track/3nFyeL1856Txfl2mxxurvuzom168QHIOOXHLCCRFKCA68673JUWD278x9 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6168 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1884,i,4938883170319509560,9085108778856873286,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: http://esuper.giize.com/

HTTP Parser: Number of links: 0

Source: http://esuper.giize.com/

HTTP Parser: Title: Coming Soon - eteqxfq.transformx.io does not match URL

Source: http://esuper.giize.com/

HTTP Parser: Has password / email / username input fields

Source: http://esuper.giize.com/track/3nFyeL1856Txfl2mxxurvuzom168QHIOOXHLCCRFKCA68673JUWD278x9	HTTP Parser: No favicon
Source: http://esuper.giize.com/	HTTP Parser: No favicon
Source: http://esuper.giize.com/	HTTP Parser: No favicon
Source: http://esuper.giize.com/	HTTP Parser: No favicon
Source: http://esuper.giize.com/	HTTP Parser: No favicon
Source: http://esuper.giize.com/news	HTTP Parser: No favicon
Source: http://esuper.giize.com/news	HTTP Parser: No favicon
Source: http://esuper.giize.com/about	HTTP Parser: No favicon

Source: http://esuper.giize.com/	HTTP Parser: No <meta name="author".. found
Source: http://esuper.giize.com/	HTTP Parser: No <meta name="author".. found
Source: http://esuper.giize.com/	HTTP Parser: No <meta name="author".. found
Source: http://esuper.giize.com/	HTTP Parser: No <meta name="author".. found

Source: http://esuper.giize.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://esuper.giize.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://esuper.giize.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://esuper.giize.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.5:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49879 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+TF4zdlcB2vgo6W&MD=Xf6eeDZe HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 120X-DeviceID: 01000A4109009A83X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAATYc/7woCqiJ74jbUbd7DFc27PIIpofuDHClOpqQHBxZyk%2BVCp/XJrlKLH/kyx03DD57X0v9kTyPHslM3Q5PGaBPZPOL3q/5gLjpgcsn0ExPhCpi4i7eQQOJ31ErilKDA3W1SLTl2a992iRrS9tXaK25I2PK0%2By24nXvhahNZak5uregNmVuoYu9XO5ICB2O9roSBogvpvr42KtKGbQqmG%2BR/6OoXj2aH7G6uhIiazWlxlTHT95%2BcpAxIcZCWZ5dNNdoCYEazBeXs1EbSpDWMMn9OaPtm/tX8UHMdwyTp2XRTVc5NCRA55RwjKAjOrMPC6DC9t38TmpwhEfRrznJk3oDZgAACK/iO7PmPxxLqAGzaAOudQ1Cbxzd6ctputHj8fjkfX9Tp1iAmG4DiY4Tdtw7gVBzRJe4h/R2R%2B/PxBC%2BUvs%2BDqX9IX1HXHSYtS%2BogsbRSZgaBAfNrGEBdiFMmwjY79w5/kHjqffL6Nxep3jCYRFt80rA6ThRHJktf7fApmbUhFtpZphOxCxxxbNVejJeQuMkgopsAdl0%2BTd38gSR%2B/MSjPmv3KqMJUmuWp3/XCoTBu2Nam60S69LFQS8VTD4VtANqxJE9pjrZrCVvI7UefBpfI74RuG4yLGpCvvMs2AlZFrr0umdc18y/MDUtmJhgAPF6PyvYqUdJEO26AFxIqsUBIYgtcSnTLvGUfMY6Koifg945CtxcfbXtDiTgtAHWva7wlhGfM2MCqTn1l/LJN%2BwNqg4djAox3di%2BhiYhTc3qq70n7qMluQr8zMCqoPxy5DuJ0XL5N2eDMOG4UHIAwHwLdFVjjRB2s%2BhBCx2MBIBLFhc3/UMs0jLHoYuhaRABxQGCBKNPtrkIsAjlg0mD70kNp0Ym2nYDWmGHmjRvLVZhtH/iscOTeXMSzuphfVrktQtSHTU2AE%3D%26p%3DX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1713257079User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: E9F5F21E16984122800FD615923FF4A6X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=3a628620&IPMID=1707317755885; MUID=5047E5942BB2460EA35B53CCF78DDB3D; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /datadog-rum-v4.js HTTP/1.1Host: www.datadoghq-browser-agent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foxnews.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ktag/latest/ktag.min.js?accountId=0c1098d4-e85c-41fd-be56-6189d39234c9 HTTP/1.1Host: www.knotch-cdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foxnews.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v2/0c1098d4-e85c-41fd-be56-6189d39234c9 HTTP/1.1Host: configs.knotch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.foxnews.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.foxnews.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v2/0c1098d4-e85c-41fd-be56-6189d39234c9 HTTP/1.1Host: configs.knotch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ingress?browser_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&root_browser_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&canonical_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&referrer_url=http%3A%2F%2Fesuper.giize.com%2F&account_id=0c1098d4-e85c-41fd-be56-6189d39234c9&cs_render_id=93853205-7fe2-4686-a867-3de4af25f95b&cs_visitor_id=e1c1034e-6cab-499f-8151-91fbf265d378&time_stamp=1713257083659&session_time_stamp=1713257083126&user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&ktag_version=v2.5.0&platform=Win32&language=en-US&color_depth=24&screen_resolution=1280x1024&time_zone=Europe%2FZurich&privacy_mode=false&content_height=10630&content_width=1316&type=page_view&load_data=%257B%2522load_time%2522%253A694.2%252C%2522time_to_page_view%2522%253A530.9%257D&custom_json=%257B%257D&set_cookie=true HTTP/1.1Host: frontdoor.knotch.itConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foxnews.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ingress?browser_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&root_browser_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&canonical_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&referrer_url=http%3A%2F%2Fesuper.giize.com%2F&account_id=0c1098d4-e85c-41fd-be56-6189d39234c9&cs_render_id=93853205-7fe2-4686-a867-3de4af25f95b&cs_visitor_id=e1c1034e-6cab-499f-8151-91fbf265d378&time_stamp=1713257083659&session_time_stamp=1713257083126&user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&ktag_version=v2.5.0&platform=Win32&language=en-US&color_depth=24&screen_resolution=1280x1024&time_zone=Europe%2FZurich&privacy_mode=false&content_height=10630&content_width=1316&type=page_view&load_data=%257B%2522load_time%2522%253A694.2%252C%2522time_to_page_view%2522%253A530.9%257D&custom_json=%257B%257D&set_cookie=true HTTP/1.1Host: frontdoor.knotch.itConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: visitor_id=f9fcdd2c-0bbf-4bc4-89de-3e7001bfc6b1; optout=0
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=17FC406C5357BA6E0A490D4D%40AdobeOrg&d_nsid=0&ts=1713257084991 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: application/x-www-form-urlencodedsec-ch-ua-platform-version: "10.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.foxnews.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.foxnews.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /foxus/v2/uid HTTP/1.1Host: foxus.tagger.opecloud.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.foxnews.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.foxnews.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=17FC406C5357BA6E0A490D4D%40AdobeOrg&d_nsid=0&ts=1713257084991 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: application/x-www-form-urlencodedsec-ch-ua-platform-version: "10.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.foxnews.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.foxnews.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=04029004121583327971373609941773161467
Source: global traffic	HTTP traffic detected: GET /t.png?l=foxnews-pix-fox-news-reach-and-frequency-062d298b-c587-4c31-a1b7-81d0d182403b&t=399133.9966264939 HTTP/1.1Host: pix.pubConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foxnews.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=17FC406C5357BA6E0A490D4D%40AdobeOrg&d_nsid=0&ts=1713257084991 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=04029004121583327971373609941773161467
Source: global traffic	HTTP traffic detected: GET /dest5.html?d_nsid=0 HTTP/1.1Host: foxnews.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.foxnews.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=04029004121583327971373609941773161467
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=17FC406C5357BA6E0A490D4D%40AdobeOrg&mid=04222062522767779081395152050558590770&ts=1713257086084 HTTP/1.1Host: smetrics.foxnews.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: application/x-www-form-urlencodedsec-ch-ua-platform-version: "10.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.foxnews.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.foxnews.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FXN_flk=1; EID=null; xid=d40e081d-7695-4aac-b70f-718f14df3542; AMCVS_17FC406C5357BA6E0A490D4D%40AdobeOrg=1; AMCV_17FC406C5357BA6E0A490D4D%40AdobeOrg=1585540135%7CMCIDTS%7C19830%7CMCMID%7C04222062522767779081395152050558590770%7CMCAAMLH-1713861886%7C7%7CMCAAMB-1713861886%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1713264286s%7CNONE%7CvVersion%7C4.4.0
Source: global traffic	HTTP traffic detected: GET /t.png?l=foxnews-pix-fox-news-reach-and-frequency-062d298b-c587-4c31-a1b7-81d0d182403b&t=399133.9966264939 HTTP/1.1Host: pix.pubConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=17FC406C5357BA6E0A490D4D%40AdobeOrg&mid=04222062522767779081395152050558590770&ts=1713257086084 HTTP/1.1Host: smetrics.foxnews.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FXN_flk=1; EID=null; xid=d40e081d-7695-4aac-b70f-718f14df3542; AMCVS_17FC406C5357BA6E0A490D4D%40AdobeOrg=1; s_ecid=MCMID%7C04222062522767779081395152050558590770; AMCV_17FC406C5357BA6E0A490D4D%40AdobeOrg=1585540135%7CMCIDTS%7C19830%7CMCMID%7C04222062522767779081395152050558590770%7CMCAAMLH-1713861886%7C7%7CMCAAMB-1713861886%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1713264286s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C4.4.0
Source: global traffic	HTTP traffic detected: GET /pyxis/submit HTTP/1.1Host: prod.pyxis.atp.foxConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1/item HTTP/1.1Host: prod.idgraph.dt.foxConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+TF4zdlcB2vgo6W&MD=Xf6eeDZe HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /track/3nFyeL1856Txfl2mxxurvuzom168QHIOOXHLCCRFKCA68673JUWD278x9 HTTP/1.1Host: esuper.giize.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: esuper.giize.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://esuper.giize.com/track/3nFyeL1856Txfl2mxxurvuzom168QHIOOXHLCCRFKCA68673JUWD278x9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/3nFyeL1856Txfl2mxxurvuzom168QHIOOXHLCCRFKCA68673JUWD278x9 HTTP/1.1Host: esuper.giize.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: esuper.giize.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/styles.css HTTP/1.1Host: esuper.giize.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://esuper.giize.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /news HTTP/1.1Host: esuper.giize.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://esuper.giize.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /about HTTP/1.1Host: esuper.giize.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://esuper.giize.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/about_styles.css HTTP/1.1Host: esuper.giize.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://esuper.giize.com/aboutAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: chromecache_123.1.dr	String found in binary or memory: "https://www.facebook.com/FoxNews", equals www.facebook.com (Facebook)
Source: chromecache_123.1.dr	String found in binary or memory: "https://www.linkedin.com/company/fox-news-channel", equals www.linkedin.com (Linkedin)
Source: chromecache_123.1.dr	String found in binary or memory: "https://www.youtube.com/FoxNewsChannel", equals www.youtube.com (Youtube)
Source: chromecache_123.1.dr	String found in binary or memory: </a></li></ul></nav></div></div></div> <div class="footer-lower"><div class="social-icons"><ul><li class="fb"><a href="https://www.facebook.com/FoxNews">Facebook</a></li> <li class="tw"><a href="https://twitter.com/foxnews">Twitter</a></li> <li class="ig"><a href="https://www.instagram.com/foxnews">Instagram</a></li> <li class="yt"><a href="https://www.youtube.com/FoxNewsChannel">Youtube</a></li> <li class="flipboard"><a href="https://flipboard.com/@FoxNews">Flipboard</a></li> <li class="li"><a href="https://www.linkedin.com/company/fox-news-channel/">LinkedIn</a></li> <li class="slack"><a href="https://foxnews.slack.com/apps/A013AUF6VMG-fox-news">Slack</a></li> <li class="rss"><a href="https://www.foxnews.com/story/foxnews-com-rss-feeds">RSS</a></li> <li class="newsletters"><a href="https://www.foxnews.com/newsletters">Newsletters</a></li> <li class="spotify"><a href="https://open.spotify.com/show/7A4YfyFtNOZhqMV7F3kYVu">Spotify</a></li> <li class="ihr"><a href="https://www.iheart.com/podcast/256-the-fox-news-rundown-31090295/">iHeartRadio</a></li></ul></div> <div class="branding"><a href="https://www.foxnews.com" class="logo">Fox News</a></div> <div class="legal"><ul data-fetch-key="3"><li><a href="//www.foxnews.com/terms-of-use" data-omtr-intcmp="footer_legal_new_terms_of_use">New Terms of Use</a></li><li><a href="//www.foxnews.com/privacy-policy" data-omtr-intcmp="footer_legal_new_privacy_policy">New Privacy Policy</a></li><li><a href="http://privacy.foxnews.com/main/web/main" data-omtr-intcmp="footer_legal_your_privacy_choices">Your Privacy Choices</a></li><li><a href="//www.foxnews.com/closed-captioning" data-omtr-intcmp="footer_legal_closed_caption_policy">Closed Caption Policy</a></li><li><a href="https://help.foxnews.com" data-omtr-intcmp="footer_legal_help">Help</a></li><li><a href="//www.foxnews.com/contact" data-omtr-intcmp="footer_legal_contact_us">Contact Us</a></li><li><a href="//www.foxnews.com/accessibility-statement" data-omtr-intcmp="footer_legal_accessibility_statement">Accessibility Statement</a></li></ul> <p class="copyright"> equals www.facebook.com (Facebook)
Source: chromecache_123.1.dr	String found in binary or memory: </a></li></ul></nav></div></div></div> <div class="footer-lower"><div class="social-icons"><ul><li class="fb"><a href="https://www.facebook.com/FoxNews">Facebook</a></li> <li class="tw"><a href="https://twitter.com/foxnews">Twitter</a></li> <li class="ig"><a href="https://www.instagram.com/foxnews">Instagram</a></li> <li class="yt"><a href="https://www.youtube.com/FoxNewsChannel">Youtube</a></li> <li class="flipboard"><a href="https://flipboard.com/@FoxNews">Flipboard</a></li> <li class="li"><a href="https://www.linkedin.com/company/fox-news-channel/">LinkedIn</a></li> <li class="slack"><a href="https://foxnews.slack.com/apps/A013AUF6VMG-fox-news">Slack</a></li> <li class="rss"><a href="https://www.foxnews.com/story/foxnews-com-rss-feeds">RSS</a></li> <li class="newsletters"><a href="https://www.foxnews.com/newsletters">Newsletters</a></li> <li class="spotify"><a href="https://open.spotify.com/show/7A4YfyFtNOZhqMV7F3kYVu">Spotify</a></li> <li class="ihr"><a href="https://www.iheart.com/podcast/256-the-fox-news-rundown-31090295/">iHeartRadio</a></li></ul></div> <div class="branding"><a href="https://www.foxnews.com" class="logo">Fox News</a></div> <div class="legal"><ul data-fetch-key="3"><li><a href="//www.foxnews.com/terms-of-use" data-omtr-intcmp="footer_legal_new_terms_of_use">New Terms of Use</a></li><li><a href="//www.foxnews.com/privacy-policy" data-omtr-intcmp="footer_legal_new_privacy_policy">New Privacy Policy</a></li><li><a href="http://privacy.foxnews.com/main/web/main" data-omtr-intcmp="footer_legal_your_privacy_choices">Your Privacy Choices</a></li><li><a href="//www.foxnews.com/closed-captioning" data-omtr-intcmp="footer_legal_closed_caption_policy">Closed Caption Policy</a></li><li><a href="https://help.foxnews.com" data-omtr-intcmp="footer_legal_help">Help</a></li><li><a href="//www.foxnews.com/contact" data-omtr-intcmp="footer_legal_contact_us">Contact Us</a></li><li><a href="//www.foxnews.com/accessibility-statement" data-omtr-intcmp="footer_legal_accessibility_statement">Accessibility Statement</a></li></ul> <p class="copyright"> equals www.linkedin.com (Linkedin)
Source: chromecache_123.1.dr	String found in binary or memory: </a></li></ul></nav></div></div></div> <div class="footer-lower"><div class="social-icons"><ul><li class="fb"><a href="https://www.facebook.com/FoxNews">Facebook</a></li> <li class="tw"><a href="https://twitter.com/foxnews">Twitter</a></li> <li class="ig"><a href="https://www.instagram.com/foxnews">Instagram</a></li> <li class="yt"><a href="https://www.youtube.com/FoxNewsChannel">Youtube</a></li> <li class="flipboard"><a href="https://flipboard.com/@FoxNews">Flipboard</a></li> <li class="li"><a href="https://www.linkedin.com/company/fox-news-channel/">LinkedIn</a></li> <li class="slack"><a href="https://foxnews.slack.com/apps/A013AUF6VMG-fox-news">Slack</a></li> <li class="rss"><a href="https://www.foxnews.com/story/foxnews-com-rss-feeds">RSS</a></li> <li class="newsletters"><a href="https://www.foxnews.com/newsletters">Newsletters</a></li> <li class="spotify"><a href="https://open.spotify.com/show/7A4YfyFtNOZhqMV7F3kYVu">Spotify</a></li> <li class="ihr"><a href="https://www.iheart.com/podcast/256-the-fox-news-rundown-31090295/">iHeartRadio</a></li></ul></div> <div class="branding"><a href="https://www.foxnews.com" class="logo">Fox News</a></div> <div class="legal"><ul data-fetch-key="3"><li><a href="//www.foxnews.com/terms-of-use" data-omtr-intcmp="footer_legal_new_terms_of_use">New Terms of Use</a></li><li><a href="//www.foxnews.com/privacy-policy" data-omtr-intcmp="footer_legal_new_privacy_policy">New Privacy Policy</a></li><li><a href="http://privacy.foxnews.com/main/web/main" data-omtr-intcmp="footer_legal_your_privacy_choices">Your Privacy Choices</a></li><li><a href="//www.foxnews.com/closed-captioning" data-omtr-intcmp="footer_legal_closed_caption_policy">Closed Caption Policy</a></li><li><a href="https://help.foxnews.com" data-omtr-intcmp="footer_legal_help">Help</a></li><li><a href="//www.foxnews.com/contact" data-omtr-intcmp="footer_legal_contact_us">Contact Us</a></li><li><a href="//www.foxnews.com/accessibility-statement" data-omtr-intcmp="footer_legal_accessibility_statement">Accessibility Statement</a></li></ul> <p class="copyright"> equals www.twitter.com (Twitter)
Source: chromecache_123.1.dr	String found in binary or memory: </a></li></ul></nav></div></div></div> <div class="footer-lower"><div class="social-icons"><ul><li class="fb"><a href="https://www.facebook.com/FoxNews">Facebook</a></li> <li class="tw"><a href="https://twitter.com/foxnews">Twitter</a></li> <li class="ig"><a href="https://www.instagram.com/foxnews">Instagram</a></li> <li class="yt"><a href="https://www.youtube.com/FoxNewsChannel">Youtube</a></li> <li class="flipboard"><a href="https://flipboard.com/@FoxNews">Flipboard</a></li> <li class="li"><a href="https://www.linkedin.com/company/fox-news-channel/">LinkedIn</a></li> <li class="slack"><a href="https://foxnews.slack.com/apps/A013AUF6VMG-fox-news">Slack</a></li> <li class="rss"><a href="https://www.foxnews.com/story/foxnews-com-rss-feeds">RSS</a></li> <li class="newsletters"><a href="https://www.foxnews.com/newsletters">Newsletters</a></li> <li class="spotify"><a href="https://open.spotify.com/show/7A4YfyFtNOZhqMV7F3kYVu">Spotify</a></li> <li class="ihr"><a href="https://www.iheart.com/podcast/256-the-fox-news-rundown-31090295/">iHeartRadio</a></li></ul></div> <div class="branding"><a href="https://www.foxnews.com" class="logo">Fox News</a></div> <div class="legal"><ul data-fetch-key="3"><li><a href="//www.foxnews.com/terms-of-use" data-omtr-intcmp="footer_legal_new_terms_of_use">New Terms of Use</a></li><li><a href="//www.foxnews.com/privacy-policy" data-omtr-intcmp="footer_legal_new_privacy_policy">New Privacy Policy</a></li><li><a href="http://privacy.foxnews.com/main/web/main" data-omtr-intcmp="footer_legal_your_privacy_choices">Your Privacy Choices</a></li><li><a href="//www.foxnews.com/closed-captioning" data-omtr-intcmp="footer_legal_closed_caption_policy">Closed Caption Policy</a></li><li><a href="https://help.foxnews.com" data-omtr-intcmp="footer_legal_help">Help</a></li><li><a href="//www.foxnews.com/contact" data-omtr-intcmp="footer_legal_contact_us">Contact Us</a></li><li><a href="//www.foxnews.com/accessibility-statement" data-omtr-intcmp="footer_legal_accessibility_statement">Accessibility Statement</a></li></ul> <p class="copyright"> equals www.youtube.com (Youtube)
Source: chromecache_123.1.dr	String found in binary or memory: </p></div> <div class="social-icons"><ul><li class="fb"><a href="https://www.facebook.com/FoxNews">Facebook</a></li> <li class="tw"><a href="https://twitter.com/foxnews">Twitter</a></li> <li class="ig"><a href="https://www.instagram.com/foxnews">Instagram</a></li> <li class="rss"><a href="https://www.foxnews.com/story/foxnews-com-rss-feeds">RSS</a></li> <li class="email"><a href="https://www.foxnews.com/newsletters">Email</a></li></ul></div></div></div></div></header> <div class="page"><div class="pre-content"><div class="ad-container desktop ad-h-66 ad-w-728"><div data-iu="lb1" class="ad gam"></div> <!----> <!----></div><div class="ad-container tablet ad-h-50 ad-w-300"><div data-iu="lb1" class="ad gam"></div> <!----> <!----></div></div></div> <div class="page-content"><div class="row full"><main class="main-content"><article class="article-wrap has-video"><!----> <!----> <header organizationUrl="https://www.foxnews.com" class="article-header"><div class="article-meta article-meta-upper"><span class="eyebrow"><a href="https://www.foxnews.com/category/world/conflicts/iran">Iran</a></span> <h1 class="headline speakable">Iran's attack on Israel shines spotlight on Tehran's advancing nuclear weapons program</h1> <h2 class="sub-headline speakable">Iran's illicit program has progressed since Biden has come into office</h2></div> <!----> <div class="author-byline"><!----> <span> equals www.facebook.com (Facebook)
Source: chromecache_123.1.dr	String found in binary or memory: </p></div> <div class="social-icons"><ul><li class="fb"><a href="https://www.facebook.com/FoxNews">Facebook</a></li> <li class="tw"><a href="https://twitter.com/foxnews">Twitter</a></li> <li class="ig"><a href="https://www.instagram.com/foxnews">Instagram</a></li> <li class="rss"><a href="https://www.foxnews.com/story/foxnews-com-rss-feeds">RSS</a></li> <li class="email"><a href="https://www.foxnews.com/newsletters">Email</a></li></ul></div></div></div></div></header> <div class="page"><div class="pre-content"><div class="ad-container desktop ad-h-66 ad-w-728"><div data-iu="lb1" class="ad gam"></div> <!----> <!----></div><div class="ad-container tablet ad-h-50 ad-w-300"><div data-iu="lb1" class="ad gam"></div> <!----> <!----></div></div></div> <div class="page-content"><div class="row full"><main class="main-content"><article class="article-wrap has-video"><!----> <!----> <header organizationUrl="https://www.foxnews.com" class="article-header"><div class="article-meta article-meta-upper"><span class="eyebrow"><a href="https://www.foxnews.com/category/world/conflicts/iran">Iran</a></span> <h1 class="headline speakable">Iran's attack on Israel shines spotlight on Tehran's advancing nuclear weapons program</h1> <h2 class="sub-headline speakable">Iran's illicit program has progressed since Biden has come into office</h2></div> <!----> <div class="author-byline"><!----> <span> equals www.twitter.com (Twitter)
Source: chromecache_158.1.dr, chromecache_188.1.dr	String found in binary or memory: <rss xmlns:media="http://search.yahoo.com/mrss/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"> equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: esuper.giize.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Address: gin_throttle_mw_7200000000_81.181.57.52X-Ratelimit-Limit: 500X-Ratelimit-Remaining: 498X-Ratelimit-Reset: 1713260646Date: Tue, 16 Apr 2024 08:44:06 GMTContent-Length: 0

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://esuper.giize.com/track/3nFyeL1856Txfl2mxxurvuzom168QHIOOXHLCCRFKCA68673JUWD278x9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1884,i,4938883170319509560,9085108778856873286,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1884,i,4938883170319509560,9085108778856873286,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Link
https://prod.pyxis.atp.fox/pyxis/submit	0%	Virustotal	Browse
https://www.knotch-cdn.com/ktag/latest/ktag.min.js?accountId=0c1098d4-e85c-41fd-be56-6189d39234c9	0%	Virustotal	Browse
https://www.outkick.com	0%	Virustotal	Browse
https://lipperalpha.refinitiv.com/	0%	Virustotal	Browse

Name	IP	Active	Malicious	Reputation
as-sec.casalemedia.com	172.64.151.101	true	false	high
gob-pairb-nje1.pubmnet.com	207.65.37.179	true	false	unknown
securepubads46.g.doubleclick.net	108.177.122.156	true	false	high
dt-idgraph-api-986515573.us-west-2.elb.amazonaws.com	54.189.41.18	true	false	high
foxnews-d.openx.net	35.244.159.8	true	false	high
d20qwf0wrdtevy.cloudfront.net	3.161.188.78	true	false	high
d1ykf07e75w7ss.cloudfront.net	54.230.252.87	true	false	high
foxnews.com.ssl.d1.sc.omtrdc.net	63.140.38.132	true	false	unknown
bidder.us5.vip.prod.criteo.com	74.119.117.6	true	false	high
dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	34.204.28.10	true	false	high
d3aqntjehoyiyc.cloudfront.net	18.165.116.101	true	false	high
configs.knotch.com	18.244.202.10	true	false	unknown
www.datadoghq-browser-agent.com	18.244.194.101	true	false	unknown
pix.pub	3.163.80.125	true	false	unknown
frontdoor.knotch.it	54.243.79.56	true	false	unknown
esuper.giize.com	146.190.154.97	true	false	unknown
www.google.com	142.250.105.99	true	false	high
foxus.tagger.opecloud.com	34.199.65.11	true	false	unknown
amprtc.media.net	34.107.148.139	true	false	high
d1twhgh32r3q6q.cloudfront.net	3.161.136.119	true	false	high
ad-tech-pyxis-2124195674.us-west-2.elb.amazonaws.com	52.40.49.171	true	false	high
ib.anycast.adnxs.com	68.67.160.137	true	false	high
edge.gycpi.b.yahoodns.net	209.73.179.247	true	false	unknown
securepubads.g.doubleclick.net	unknown	unknown	false	high
foxnews.demdex.net	unknown	unknown	false	high
hbopenbid.pubmatic.com	unknown	unknown	false	high
sofia.trustx.org	unknown	unknown	false	unknown
cm.everesttech.net	unknown	unknown	false	high
fastlane.rubiconproject.com	unknown	unknown	false	high
feeds.foxnews.com	unknown	unknown	false	high
www.knotch-cdn.com	unknown	unknown	false	unknown
smetrics.foxnews.com	unknown	unknown	false	high
www.foxnews.com	unknown	unknown	false	high
dpm.demdex.net	unknown	unknown	false	high
aa.agkn.com	unknown	unknown	false	high
global.fncstatic.com	unknown	unknown	false	high
prod.idgraph.dt.fox	unknown	unknown	false	unknown
bidder.criteo.com	unknown	unknown	false	high
c.amazon-adsystem.com	unknown	unknown	false	high
moxie.foxnews.com	unknown	unknown	false	high
static.foxnews.com	unknown	unknown	false	high
s.yimg.com	unknown	unknown	false	high
prod.fennec.atp.fox	unknown	unknown	false	unknown
prod.pyxis.atp.fox	unknown	unknown	false	unknown
a57.foxnews.com	unknown	unknown	false	high
ib.adnxs.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://frontdoor.knotch.it/ingress?browser_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&root_browser_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&canonical_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&referrer_url=http%3A%2F%2Fesuper.giize.com%2F&account_id=0c1098d4-e85c-41fd-be56-6189d39234c9&cs_render_id=93853205-7fe2-4686-a867-3de4af25f95b&cs_visitor_id=e1c1034e-6cab-499f-8151-91fbf265d378&time_stamp=1713257083659&session_time_stamp=1713257083126&user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&ktag_version=v2.5.0&platform=Win32&language=en-US&color_depth=24&screen_resolution=1280x1024&time_zone=Europe%2FZurich&privacy_mode=false&content_height=10630&content_width=1316&type=page_view&load_data=%257B%2522load_time%2522%253A694.2%252C%2522time_to_page_view%2522%253A530.9%257D&custom_json=%257B%257D&set_cookie=true	false		unknown
https://prod.pyxis.atp.fox/pyxis/submit	false	0%, Virustotal, Browse	unknown
http://esuper.giize.com/track/3nFyeL1856Txfl2mxxurvuzom168QHIOOXHLCCRFKCA68673JUWD278x9	false		unknown
http://esuper.giize.com/favicon.ico	false		unknown
http://esuper.giize.com/assets/styles.css	false		unknown
https://www.knotch-cdn.com/ktag/latest/ktag.min.js?accountId=0c1098d4-e85c-41fd-be56-6189d39234c9	false	0%, Virustotal, Browse	unknown
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=17FC406C5357BA6E0A490D4D%40AdobeOrg&d_nsid=0&ts=1713257084991	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.foxnews.com/world/security-council-revives-palestinian-authoritys-un-hopes-us-says-not-y	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2024/04/931/523/Hong-Kong-Chi	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://static.foxnews.com/static/strike/ver/foxnews/app/articles.v157.js	chromecache_107.1.dr	false		high
https://www.factset.com/privacy	chromecache_123.1.dr	false		high
https://www.foxnews.com/live-news/israel-on-alert-as-iran-launches-drones-toward-jewish-state	chromecache_123.1.dr	false		high
http://www.foxnews.com/on-air/fox-friends/index.html	chromecache_195.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2023/05/1440/810/GettyImages-	chromecache_123.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2024/04/931/523/511b5da5-Iran	chromecache_123.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2023/05/931/523/GettyImages-9	chromecache_123.1.dr	false		high
https://www.foxnews.com/world/world-leaders-collectively-condemn-irans-reckless-attack-against-israe	chromecache_158.1.dr, chromecache_188.1.dr, chromecache_123.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2024/04/343/192/GettyImages-1	chromecache_123.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2023/06/686/384/GettyImages-1	chromecache_123.1.dr	false		high
https://www.foxnews.com/world/how-can-israel-respond-to-irans-brazen-attack	chromecache_123.1.dr	false		high
https://www.foxnews.com/world/blinken-assures-us-support-black-sea-allies-ukraine-urges-military-aid	chromecache_188.1.dr	false		high
https://www.foxnews.com/health/rare-human-case-highly-contagious-bird-flu-confirmed-texas"	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxnews.com/category/health/infectious-disease"	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.abc.net.au/news/2024-04-15/nsw-man-custody-four-injured-stabbing-incident-church-wakeley	chromecache_158.1.dr, chromecache_188.1.dr	false		unknown
https://www.foxnews.com/world/irans-failed-attack-israel-pretty-telling-tehrans-capabilities-dod	chromecache_188.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2023/06/672/378/Iran-Ayatolla	chromecache_123.1.dr	false		high
https://www.foxbusiness.com/watchlist	chromecache_123.1.dr	false		high
https://www.foxnews.com/category/us/crime/police-and-law-enforcement"	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxnews.com/politics/america-first-policy-institute-rolls-out-abortion-life-agenda-empow	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxnews.com/politics/trump-says-abortion-should-be-decided-the-states-will-the-people&qu	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2024/03/931/523/Pakistan-Map.	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxnews.com/shows/tucker-carlson-tonight	chromecache_195.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2023/06/672/378/GettyImages-1	chromecache_123.1.dr	false		high
http://apps.foxnews.com/schedule_new/img/uploads/show.mediabuzz.feature.1591998085.png	chromecache_195.1.dr	false		high
https://static.foxnews.com/static/isa/core-app.js?v=v216	chromecache_156.1.dr	false		high
https://www.outkick.com	chromecache_123.1.dr	false	0%, Virustotal, Browse	unknown
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2024/04/931/523/GettyImages-1	chromecache_123.1.dr	false		high
https://www.foxnews.com/category/world/world-regions/france"	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://press.foxnews.com/media-contacts	chromecache_123.1.dr	false		high
https://www.foxnews.com/world/farmers-flood-bulgarias-capital-protesting-eu-regulations-high-energy-	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxnews.com/world/saudi-foreign-minister-arrives-pakistan-discuss-help-countrys-economic	chromecache_188.1.dr	false		high
https://www.foxnews.com/shows/fox-and-friends	chromecache_195.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2024/04/931/523/Germany-March	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxbusiness.com/shows/the-evening-edit	chromecache_195.1.dr	false		high
https://www.foxbusiness.com/shows/the-claman-countdown	chromecache_195.1.dr	false		high
https://www.foxnews.com/world/irans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons	chromecache_123.1.dr	false		high
http://apps.foxnews.com/schedule_new/img/uploads/show.the-evening-edit.feature.1527103430.png	chromecache_195.1.dr	false		high
https://www.foxnews.com/politics/month-long-macedonian-election-season-begins"	chromecache_158.1.dr, chromecache_188.1.dr	false		high
http://apps.foxnews.com/schedule_new/img/uploads/show.countdown-to-the-closing-bell.main.1562609620.	chromecache_195.1.dr	false		high
https://www.foxnews.com/world/israel-defense-minister-says-hamas-has-ceased-function-military-organi	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxnews.com/category/sports"	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxnews.com/category/world/conflicts/syria	chromecache_123.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2023/05/1440/810/Biden-and-Kh	chromecache_123.1.dr	false		high
https://tags.tiqcdn.com/utag/foxcorp/outkick-web/qa/utag.js	chromecache_179.1.dr	false		high
http://apps.foxnews.com/schedule_new/img/uploads/show.making-money-with-charles-payne.feature.150974	chromecache_195.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2023/06/686/384/Iran-Ayatolla	chromecache_123.1.dr	false		high
https://www.foxnews.com/world/witnesses-describe-enormous-courage-hero-cop-stopped-australia-stabbin	chromecache_158.1.dr, chromecache_188.1.dr	false		high
http://apps.foxnews.com/schedule_new/img/uploads/show.hannity.main.1520969541.jpg	chromecache_195.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2024/04/1440/810/GettyImages-	chromecache_123.1.dr	false		high
http://apps.foxnews.com/schedule_new/img/uploads/show.mediabuzz.main.1591998110.png	chromecache_195.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2024/04/720/405/511b5da5-Iran	chromecache_123.1.dr	false		high
https://lipperalpha.refinitiv.com/	chromecache_123.1.dr	false	0%, Virustotal, Browse	unknown
https://www.wikidata.org/wiki/Q186068	chromecache_123.1.dr	false		high
https://www.foxnews.com/world/abortion-germany-decriminalized-pregnancys-first-12-weeks-commission-s	chromecache_188.1.dr	false		high
http://apps.foxnews.com/schedule_new/img/uploads/show.fox-news-sunday-with-chris-wallace.main.163952	chromecache_195.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2023/05/343/192/GettyImages-9	chromecache_123.1.dr	false		high
https://static.foxnews.com/static/orion/styles/img/fox-news/amp/fox-news-logo.png	chromecache_123.1.dr	false		high
https://www.foxnews.com/politics/watchdog-report-paints-picture-bureau-prisons-crisis"	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxnews.com/media/exiled-crown-prince-iran-demands-regime-change-israel-attack-isnt-war-	chromecache_158.1.dr, chromecache_188.1.dr	false		high
http://foxnews.onelink.me/xLDS?pid=AppArticleLink&af_dp=foxnewsaf%3A%2F%2F&af_web_dp=https%3	chromecache_123.1.dr	false		high
https://www.foxnews.com/world/palestinian-islamic-jihad-spokesman-reveals-groups-gaza-propaganda-pla	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxnews.com/shows/fox-friends-first	chromecache_195.1.dr	false		high
https://www.foxnews.com/world/uae-other-countries-removed-international-money-laundering-watchlist&q	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxnews.com/category/sports/olympics"	chromecache_158.1.dr, chromecache_188.1.dr	false		high
http://apps.foxnews.com/schedule_new/img/uploads/show.tucker-carlson-tonight.feature.1627506292.png	chromecache_195.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2023/11/931/523/Blinken-G7.jp	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxnews.com/world/world-bank-ringing-alarm-bells-income-gap-between-riches-poorest-count	chromecache_188.1.dr	false		high
http://apps.foxnews.com/schedule_new/img/uploads/show.sunday-night-in-america-with-trey-gowdy.main.1	chromecache_195.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2024/04/931/523/Ukraine-Repai	chromecache_158.1.dr, chromecache_188.1.dr	false		high
http://apps.foxnews.com/schedule_new/img/default/american-gold-the-legend-of-bear-gulch.jpg	chromecache_195.1.dr	false		high
http://apps.foxnews.com/schedule_new/img/talent/the-pursuit-with-john-rich.png	chromecache_195.1.dr	false		high
http://apps.foxnews.com/schedule_new/img/uploads/show.outnumbered.main.1509052552.png	chromecache_195.1.dr	false		high
http://apps.foxnews.com/schedule_new/img/uploads/show.wall-street-week.main.1520969689.png	chromecache_195.1.dr	false		high
https://static.foxnews.com/foxnews.com/content/uploads/2024/04/Colombia-Reservoir.gif	chromecache_158.1.dr, chromecache_188.1.dr	false		high
http://search.yahoo.com/mrss/	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxnews.com/category/world/world-regions/europe"	chromecache_188.1.dr	false		high
https://www.foxnews.com/category/world/world-regions/israel"	chromecache_188.1.dr	false		high
http://www.foxnews.com/on-air/media-buzz/index.html	chromecache_195.1.dr	false		high
https://www.foxnews.com/category/world/world-regions/africa"	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxnews.com/health/bird-flu-pandemic-future-eu-warns-potential-spread-humans-due-lack-im	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxbusiness.com/shows/american-built	chromecache_195.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2023/05/931/523/Biden-and-Kha	chromecache_123.1.dr	false		high
https://www.foxnews.com/world/paris-prepares-100-day-countdown-olympics-aiming-reignite-passion-game	chromecache_188.1.dr	false		high
https://www.foxnews.com/world/notorious-meat-market-indonesia-ends-brutal-dog-cat-meat-trade"	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://www.foxnews.com/world/wwiii-could-start-philippines-dispute-south-china-sea-china-not-respec	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2024/04/1344/756/GettyImages-	chromecache_123.1.dr	false		high
http://apps.foxnews.com/schedule_new/img/uploads/show.fox-friends.feature.1509052294.png	chromecache_195.1.dr	false		high
https://www.foxnews.com/world/brazils-amazon-rainforest-faces-severe-drought-affecting-food-water-su	chromecache_158.1.dr, chromecache_188.1.dr	false		high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2023/05/1862/1046/GettyImages	chromecache_123.1.dr	false		high
https://www.foxnews.com/world/sending-european-troops-ukraine-remains-option-says-french-president-e	chromecache_158.1.dr, chromecache_188.1.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
3.161.136.119	d1twhgh32r3q6q.cloudfront.net	United States	16509	AMAZON-02US	false
52.202.174.146	unknown	United States	14618	AMAZON-AESUS	false
172.64.151.101	as-sec.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
18.244.202.10	configs.knotch.com	United States	16509	AMAZON-02US	false
54.152.110.30	unknown	United States	14618	AMAZON-AESUS	false
18.244.194.101	www.datadoghq-browser-agent.com	United States	16509	AMAZON-02US	false
35.244.159.8	foxnews-d.openx.net	United States	15169	GOOGLEUS	false
54.189.41.18	dt-idgraph-api-986515573.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
52.40.49.171	ad-tech-pyxis-2124195674.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
209.73.179.247	edge.gycpi.b.yahoodns.net	United States	36752	YAHOO-SP1US	false
146.190.154.97	esuper.giize.com	United States	702	UUNETUS	false
108.177.122.156	securepubads46.g.doubleclick.net	United States	15169	GOOGLEUS	false
54.230.252.87	d1ykf07e75w7ss.cloudfront.net	United States	16509	AMAZON-02US	false
34.199.65.11	foxus.tagger.opecloud.com	United States	14618	AMAZON-AESUS	false
68.67.160.137	ib.anycast.adnxs.com	United States	29990	ASN-APPNEXUS	false
63.140.38.132	foxnews.com.ssl.d1.sc.omtrdc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
3.161.188.78	d20qwf0wrdtevy.cloudfront.net	United States	16509	AMAZON-02US	false
54.243.79.56	frontdoor.knotch.it	United States	14618	AMAZON-AESUS	false
3.163.80.125	pix.pub	United States	16509	AMAZON-02US	false
142.250.105.99	www.google.com	United States	15169	GOOGLEUS	false
207.65.37.179	gob-pairb-nje1.pubmnet.com	United States	6203	ISDN-NETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
63.140.39.82	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
74.119.117.6	bidder.us5.vip.prod.criteo.com	United States	19750	AS-CRITEOUS	false
3.163.80.33	unknown	United States	16509	AMAZON-02US	false
34.204.28.10	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
54.234.235.96	unknown	United States	14618	AMAZON-AESUS	false
52.40.172.0	unknown	United States	16509	AMAZON-02US	false
34.107.148.139	amprtc.media.net	United States	15169	GOOGLEUS	false
18.165.116.101	d3aqntjehoyiyc.cloudfront.net	United States	3	MIT-GATEWAYSUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1426585
Start date and time:	2024-04-16 10:43:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://esuper.giize.com/track/3nFyeL1856Txfl2mxxurvuzom168QHIOOXHLCCRFKCA68673JUWD278x9
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@18/219@93/31
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 07:44:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.988524270894421
Encrypted:	false
SSDEEP:	48:8hdYTc8cHPidAKZdA1FehwiZUklqeh1y+3:80fwey
MD5:	9AEF7C5C5EF328FCB58E5BA9DA9A79A4
SHA1:	818D8DF251E40028484E5FF9106E53C10F63E5E8
SHA-256:	C50EC90898F5E4D697B26933DF7D832BAAFF7FCD98D4509E5B22BD6F3CE792AC
SHA-512:	30CCFD1575C3B025F5B6C86A711F0C8AD46691ADACE6F87CD8599E88FDF8D58FD18768BBA77AFA36DEA279E8534F96007DC41AC3F203726BF33F4A5341105B95
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....V.>...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.XzE....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.E....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.E....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.E..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........v......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 07:44:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.005902940139188
Encrypted:	false
SSDEEP:	48:8ZdYTc8cHPidAKZdA1seh/iZUkAQkqehOy+2:8Mfm9QLy
MD5:	096155E209FAD0AD8212D5544D689848
SHA1:	A30CBFFE8B705887976BDB983799E5D38969D152
SHA-256:	1F62884B25D3B6E12651448820FD9E6CF9EF9CB78A9EE69CAB937B7317983C0A
SHA-512:	4B07C39EED0F3DE720C19A5EFC1A54D8BF013BEB76BDF643E6ED4A91E63D5217BCB0F71B5270F6249DFECE2403565B85D28DF79FBDFE93679663475C6B98C951
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......>...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.XzE....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.E....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.E....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.E..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........v......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0102649327744455
Encrypted:	false
SSDEEP:	48:85dYTc8AHPidAKZdA14meh7sFiZUkmgqeh7sky+BX:8sfGnCy
MD5:	1DB991D4B9B3231256BF1076D7B7F44C
SHA1:	6EB50F98D455F1E339AA9ED4C1AFE44D513F6D1D
SHA-256:	C57A9FFC41001860D812CA6C638F44ABEC6A7E72BA89CA2CB512FADA9ACE1948
SHA-512:	08251EA9EA7BBE08C975CE839D0A5522986D75C39BC544CC560F8F9A4192025AF4A3CA4C1B775E6B4487BC2C6C9B5029F9EBB18D47DD064971B0345220AD4283
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.XzE....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.E....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.E....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.E..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........v......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 16, 2024 10:44:05.579123020 CEST	61989	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:05.580519915 CEST	61763	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:05.678812027 CEST	53	59546	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:05.724908113 CEST	53	61989	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:05.738104105 CEST	53	53118	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:05.762161970 CEST	53	61763	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:06.326081991 CEST	53	59013	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:10.343950033 CEST	53917	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:10.344118118 CEST	54972	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:10.448288918 CEST	53	53917	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:10.448311090 CEST	53	54972	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:23.249248028 CEST	53	55262	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:26.448147058 CEST	59251	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:26.448533058 CEST	52059	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:26.570681095 CEST	53	59251	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:26.625494957 CEST	53	52059	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:28.447520971 CEST	53	63311	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:37.405253887 CEST	57292	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:37.405617952 CEST	64713	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:37.558063984 CEST	53	64713	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:37.956680059 CEST	60757	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:37.956799984 CEST	65512	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:39.054640055 CEST	57697	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:39.054950953 CEST	53245	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:40.179864883 CEST	55687	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:40.179929972 CEST	54401	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:40.937645912 CEST	62236	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:40.937813997 CEST	58460	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.042347908 CEST	53	58460	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:41.498939037 CEST	63475	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.499098063 CEST	52801	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.499622107 CEST	53934	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.499993086 CEST	49725	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.602210999 CEST	53	53818	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:41.605669975 CEST	64744	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.605782032 CEST	50933	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.606528044 CEST	53	51303	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:41.608411074 CEST	54018	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.608541012 CEST	64354	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.610551119 CEST	63729	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.610685110 CEST	64321	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.710274935 CEST	53	64744	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:41.710391998 CEST	53	50933	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:41.712052107 CEST	56812	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.712182045 CEST	61589	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.714402914 CEST	53	64354	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:41.715204954 CEST	53	64321	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:41.715430021 CEST	53	63729	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:41.716358900 CEST	56926	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.816572905 CEST	53	61589	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:41.818320036 CEST	61090	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.818459988 CEST	50365	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.821407080 CEST	53	56926	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:41.822423935 CEST	60692	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.822582960 CEST	55402	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.922790051 CEST	53	61090	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:41.922805071 CEST	53	50365	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:41.924396992 CEST	56110	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.924575090 CEST	53448	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.926562071 CEST	53	60692	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:41.927263021 CEST	53	55402	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:41.928880930 CEST	58925	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:41.928998947 CEST	64642	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:42.031476974 CEST	53	53448	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:42.031503916 CEST	53	56110	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:42.033854008 CEST	60336	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:42.033998966 CEST	60841	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:42.035892963 CEST	53	58925	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:42.035912991 CEST	53	64642	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:42.038009882 CEST	49879	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:42.038153887 CEST	58100	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:42.098182917 CEST	53	56522	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:42.141069889 CEST	53	60336	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:42.141108990 CEST	53	60841	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:42.144609928 CEST	53	49879	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:42.144634962 CEST	53	58100	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:42.145572901 CEST	62410	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:42.145790100 CEST	59488	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:42.148041964 CEST	52391	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:42.148175001 CEST	52497	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:42.182122946 CEST	64742	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:42.182251930 CEST	55876	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:42.249823093 CEST	53	62410	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:42.250783920 CEST	53	59488	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:42.251915932 CEST	53	52391	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:42.252662897 CEST	53	52497	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:42.287050962 CEST	53	55876	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:43.375401020 CEST	51440	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:43.375587940 CEST	52669	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:43.479809999 CEST	53	52669	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:43.480103016 CEST	53	51440	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:43.524585009 CEST	56428	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:43.524779081 CEST	53537	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:43.629266024 CEST	53	53537	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:43.629880905 CEST	53	56428	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:43.800508976 CEST	61097	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:43.800698996 CEST	56761	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:44.229903936 CEST	60511	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:44.230221987 CEST	63170	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:44.334233999 CEST	53	60511	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:44.334760904 CEST	53	63170	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:44.508955956 CEST	63117	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:44.509247065 CEST	51716	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:44.761082888 CEST	50316	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:44.761244059 CEST	49194	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:44.763381004 CEST	60034	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:44.763520002 CEST	59426	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:44.865765095 CEST	53	50316	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:44.866067886 CEST	53	49194	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:44.867925882 CEST	53	60034	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:44.867983103 CEST	53	59426	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:45.370573997 CEST	58123	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:45.370711088 CEST	54702	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:45.474925041 CEST	53	54702	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:45.475004911 CEST	53	58123	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:46.036223888 CEST	51813	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:46.036401987 CEST	55864	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:46.037108898 CEST	64938	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:46.037256002 CEST	50373	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:46.091763020 CEST	63833	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:46.091907978 CEST	56810	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:46.140805006 CEST	53	51813	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:46.141244888 CEST	53	55864	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:46.142038107 CEST	53	50373	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:46.142123938 CEST	53	64938	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:46.195765018 CEST	53	63833	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:46.195945978 CEST	53	56810	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:46.203720093 CEST	53	52045	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:46.447556019 CEST	55344	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:46.447693110 CEST	53862	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:46.551963091 CEST	53	55344	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:46.552397966 CEST	53	53862	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:46.810967922 CEST	56424	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:46.811104059 CEST	58875	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:46.915163994 CEST	53	58875	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:46.915354967 CEST	53	56424	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.176398993 CEST	60238	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.176543951 CEST	56438	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.185692072 CEST	52758	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.185880899 CEST	49411	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.186971903 CEST	50266	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.187305927 CEST	54592	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.191688061 CEST	50355	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.191876888 CEST	54521	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.280898094 CEST	53	60238	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.280924082 CEST	53	56438	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.291137934 CEST	53	49411	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.291997910 CEST	53	52758	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.292800903 CEST	53	54592	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.292814970 CEST	53	50266	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.296700954 CEST	53	54521	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.345777035 CEST	64891	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.345928907 CEST	62395	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.449944973 CEST	53	62395	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.449964046 CEST	53	64891	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.564572096 CEST	50518	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.564755917 CEST	57862	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.565423012 CEST	64697	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.565547943 CEST	62262	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.669317961 CEST	53	50518	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.669356108 CEST	53	57862	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.670372963 CEST	60476	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.670509100 CEST	58378	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.670773029 CEST	53	64697	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.682147980 CEST	53	62262	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.775054932 CEST	53	58378	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.775516033 CEST	53	60476	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.810728073 CEST	52056	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.810770035 CEST	54935	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.828810930 CEST	55074	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.828964949 CEST	52498	53	192.168.2.16	1.1.1.1
Apr 16, 2024 10:44:47.914917946 CEST	53	54935	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.915230989 CEST	53	52056	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.933341980 CEST	53	55074	1.1.1.1	192.168.2.16
Apr 16, 2024 10:44:47.947881937 CEST	53	52498	1.1.1.1	192.168.2.16
Apr 16, 2024 10:45:04.783375978 CEST	53	64823	1.1.1.1	192.168.2.16
Apr 16, 2024 10:45:05.648401022 CEST	53	57676	1.1.1.1	192.168.2.16
Apr 16, 2024 10:45:17.326272964 CEST	138	138	192.168.2.16	192.168.2.255
Apr 16, 2024 10:45:31.921746969 CEST	53	61357	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 16, 2024 10:44:26.625606060 CEST	192.168.2.16	1.1.1.1	c1f2	(Port unreachable)	Destination Unreachable
Apr 16, 2024 10:44:37.558150053 CEST	192.168.2.16	1.1.1.1	c252	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:19 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-16 08:44:19 UTC	468	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=166769 Date: Tue, 16 Apr 2024 08:44:19 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:20 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-16 08:44:20 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=166767 Date: Tue, 16 Apr 2024 08:44:20 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-16 08:44:20 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+TF4zdlcB2vgo6W&MD=Xf6eeDZe HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-16 08:44:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 83a918a4-40a0-4d02-a0bc-60297d82aa5d MS-RequestId: 5135d33f-3067-4c76-b5fa-cb1fceeab387 MS-CV: dNYiJRyzLEip9ax/.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 16 Apr 2024 08:44:19 GMT Connection: close Content-Length: 24490
2024-04-16 08:44:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-16 08:44:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:24 UTC	613	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 08:44:24 UTC	1703	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 08:44:24 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce--n05mp2igJlm_OtsHNURiw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-16 08:44:24 UTC	767	IN	Data Raw: 32 66 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 61 6d 65 72 69 63 61 6e 20 69 64 6f 6c 20 32 30 32 34 20 63 6f 6e 74 65 73 74 61 6e 74 73 22 2c 22 73 74 61 72 62 75 63 6b 73 20 73 70 69 63 79 20 6c 65 6d 6f 6e 61 64 65 20 72 65 66 72 65 73 68 65 72 73 22 2c 22 61 70 70 6c 65 20 69 70 68 6f 6e 65 20 31 36 22 2c 22 72 65 64 20 73 6f 78 20 6f 75 74 66 69 65 6c 64 20 63 6f 6c 6c 69 73 69 6f 6e 22 2c 22 73 65 76 65 72 65 20 77 65 61 74 68 65 72 20 74 6f 72 6e 61 64 6f 65 73 22 2c 22 6e 61 73 63 61 72 20 72 61 63 65 20 74 65 78 61 73 22 2c 22 64 6f 77 20 6a 6f 6e 65 73 20 73 74 6f 63 6b 73 22 2c 22 66 61 6c 6c 6f 75 74 20 75 70 64 61 74 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a Data Ascii: 2f8)]}'["",["american idol 2024 contestants","starbucks spicy lemonade refreshers","apple iphone 16","red sox outfield collision","severe weather tornadoes","nascar race texas","dow jones stocks","fallout update"],["","","","","","","",""],[],{"google:
2024-04-16 08:44:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-16 08:44:40 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-16 08:44:41 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 16 Apr 2024 08:43:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 3f6693e2-46d9-442d-8839-555c9f989fd3 PPServer: PPV: 30 H: SN1PEPF0002F138 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 16 Apr 2024 08:44:40 GMT Connection: close Content-Length: 11390
2024-04-16 08:44:41 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:42 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4788 Host: login.live.com
2024-04-16 08:44:42 UTC	4788	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-16 08:44:42 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 16 Apr 2024 08:43:42 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: f6700a53-ed12-4bc3-a3f0-c4af670a8407 PPServer: PPV: 30 H: SN1PEPF0002F950 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 16 Apr 2024 08:44:41 GMT Connection: close Content-Length: 11153
2024-04-16 08:44:42 UTC	11153	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:43 UTC	2674	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: 120 X-DeviceID: 01000A4109009A83 X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75 X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAATYc/7woCqiJ74jbUbd7DFc27PIIpofuDHClOpqQHBxZyk%2BVCp/XJrlKLH/kyx03DD57X0v9kTyPHslM3Q5PGaBPZPOL3q/5gLjpgcsn0ExPhCpi4i7eQQOJ31ErilKDA3W1SLTl2a992iRrS9tXaK25I2PK0%2By24nXvhahNZak5uregNmVuoYu9XO5ICB2O9roSBogvpvr42KtKGbQqmG%2BR/6OoXj2aH7G6uhIiazWlxlTHT95%2BcpAxIcZCWZ5dNNdoCYEazBeXs1EbSpDWMMn9OaPtm/tX8UHMdwyTp2XRTVc5NCRA55RwjKAjOrMPC6DC9t38TmpwhEfRrznJk3oDZgAACK/iO7PmPxxLqAGzaAOudQ1Cbxzd6ctputHj8fjkfX9Tp1iAmG4DiY4Tdtw7gVBzRJe4h/R2R%2B/PxBC%2BUvs%2BDqX9IX1HXHSYtS%2BogsbRSZgaBAfNrGEBdiFMmwjY79w5/kHjqffL6Nxep3jCYRFt80rA6ThRHJktf7fApmbUhFtpZphOxCxxxbNVejJeQuMkgopsAdl0%2BTd38gSR%2B/MSjPmv3KqMJUmuWp3/XCoTBu2Nam60S69LFQS8VTD4VtANqxJE9pjrZrCVvI7UefBpfI74RuG4yLGpCvvMs2AlZFrr0umdc18y/MDUtmJhgAPF6PyvYqUdJEO26AFxIqsUBIYgtcSnTLvGUfMY6Koifg945CtxcfbXtDiTgtAHWva7wlhGfM2MCqTn1l/LJN%2BwNqg4djAox3di%2BhiYhTc3qq70n7qMluQr8zMCqoPxy5DuJ0XL5N2eDMOG4UHIAwHwLdFVjjRB2s%2BhBCx2MBIBLFhc3/UMs0jLHoYuhaRABxQGCBKNPtrkIsAjlg0mD70kNp0Ym2nYDWmGHmjRvLVZhtH/iscOTeXMSzuphfVrktQtSHTU2AE%3D%26p%3D X-Agent-DeviceId: 01000A4109009A83 X-BM-CBT: 1713257079 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: E9F5F21E16984122800FD615923FF4A6 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=3a628620&IPMID=1707317755885; MUID=5047E5942BB2460EA35B53CCF78DDB3D; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-04-16 08:44:43 UTC	1635	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 2215 Content-Type: application/json; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: _EDGE_S=SID=0EA0219E09BA624E2E4435FD08AD633A&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: MUIDB=5047E5942BB2460EA35B53CCF78DDB3D; expires=Sun, 11-May-2025 08:44:43 GMT; path=/; HttpOnly Set-Cookie: SRCHHPGUSR=SRCHLANG=en&HV=1707317784&IPMH=3a628620&IPMID=1707317755885; domain=.bing.com; expires=Sun, 11-May-2025 08:44:43 GMT; path=/; secure; SameSite=None Set-Cookie: ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; domain=.bing.com; expires=Sun, 11-May-2025 08:44:43 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=0EA0219E09BA624E2E4435FD08AD633A; domain=.bing.com; path=/; secure; SameSite=None X-EventID: 661e3a7baac04f589dc16117e7dcd2ea UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 49E0AAD8A33145B08F5AC5504D2B593E Ref B: ATL331000103037 Ref C: 2024-04-16T08:44:43Z Date: Tue, 16 Apr 2024 08:44:43 GMT Connection: close
2024-04-16 08:44:43 UTC	1868	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value
2024-04-16 08:44:43 UTC	347	IN	Data Raw: 6e 57 69 64 74 68 54 68 72 65 73 68 6f 6c 64 22 3a 7b 22 76 61 6c 75 65 22 3a 39 36 30 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 57 69 64 74 68 22 3a 7b 22 76 61 6c 75 65 22 3a 32 38 38 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 57 69 64 65 57 69 64 74 68 22 3a 7b 22 76 61 6c 75 65 22 3a 32 38 38 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 54 65 78 74 22 3a 7b 22 76 61 6c 75 65 22 3a 22 54 79 70 65 20 68 65 72 65 20 74 6f 20 73 65 61 72 63 68 22 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 75 62 6d 69 74 42 75 74 74 6f 6e 47 6c 79 70 68 22 3a 7b 22 76 61 6c 75 65 22 3a 22 22 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 75 62 6d 69 74 42 75 74 74 6f Data Ascii: nWidthThreshold":{"value":960,"feature":""},"SearchBoxWidth":{"value":288,"feature":""},"SearchBoxWideWidth":{"value":288,"feature":""},"SearchBoxText":{"value":"Type here to search","feature":""},"SubmitButtonGlyph":{"value":"","feature":""},"SubmitButto

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:43 UTC	654	OUT	GET /datadog-rum-v4.js HTTP/1.1 Host: www.datadoghq-browser-agent.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.foxnews.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 08:44:43 UTC	596	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 153156 Connection: close Last-Modified: Mon, 09 Oct 2023 11:26:13 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Tue, 16 Apr 2024 08:44:44 GMT Cache-Control: max-age=14400, s-maxage=60 ETag: "2630b3d7ad4a41fac67742216e506d83" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 0af4da684361b0f60fc7d7e1b6ce917c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P4 X-Amz-Cf-Id: iVnJ6ewYTdpOJCWDaXPT2ZXIe1gdi_fi2_kJLjRwt6u2z4ht4G7zgQ== Timing-Allow-Origin: *
2024-04-16 08:44:43 UTC	15788	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 7b 6c 6f 67 3a 22 6c 6f 67 22 2c 64 65 62 75 67 3a 22 64 65 62 75 67 22 2c 69 6e 66 6f 3a 22 69 6e 66 6f 22 2c 77 61 72 6e 3a 22 77 61 72 6e 22 2c 65 72 72 6f 72 3a 22 65 72 72 6f 72 22 7d 2c 65 3d 63 6f 6e 73 6f 6c 65 2c 6e 3d 7b 7d 3b 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6e 5b 74 5d 3d 65 5b 74 5d 7d 29 29 3b 76 61 72 20 72 3d 22 44 61 74 61 64 6f 67 20 42 72 6f 77 73 65 72 20 53 44 4b 3a 22 2c 69 3d 7b 64 65 62 75 67 3a 6e 2e 64 65 62 75 67 2e 62 69 6e 64 28 65 2c 72 29 2c 6c 6f 67 3a 6e 2e 6c 6f 67 2e 62 69 6e 64 28 65 2c 72 29 2c 69 6e 66 6f 3a 6e 2e 69 6e 66 6f 2e 62 69 6e 64 28 65 2c 72 Data Ascii: !function(){"use strict";var t={log:"log",debug:"debug",info:"info",warn:"warn",error:"error"},e=console,n={};Object.keys(t).forEach((function(t){n[t]=e[t]}));var r="Datadog Browser SDK:",i={debug:n.debug.bind(e,r),log:n.log.bind(e,r),info:n.info.bind(e,r
2024-04-16 08:44:44 UTC	16384	IN	Data Raw: 2e 75 73 65 43 72 6f 73 73 53 69 74 65 53 65 73 73 69 6f 6e 43 6f 6f 6b 69 65 2c 74 2e 74 72 61 63 6b 53 65 73 73 69 6f 6e 41 63 72 6f 73 73 53 75 62 64 6f 6d 61 69 6e 73 26 26 28 65 2e 64 6f 6d 61 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 6f 74 29 7b 66 6f 72 28 76 61 72 20 74 3d 22 64 64 5f 73 69 74 65 5f 74 65 73 74 5f 22 2e 63 6f 6e 63 61 74 28 53 74 28 29 29 2c 65 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2e 73 70 6c 69 74 28 22 2e 22 29 2c 6e 3d 65 2e 70 6f 70 28 29 3b 65 2e 6c 65 6e 67 74 68 26 26 21 78 74 28 74 29 3b 29 6e 3d 22 22 2e 63 6f 6e 63 61 74 28 65 2e 70 6f 70 28 29 2c 22 2e 22 29 2e 63 6f 6e 63 61 74 28 6e 29 2c 6b 74 28 74 2c 22 74 65 73 74 22 2c 61 74 2c 7b 64 6f 6d Data Ascii: .useCrossSiteSessionCookie,t.trackSessionAcrossSubdomains&&(e.domain=function(){if(void 0===ot){for(var t="dd_site_test_".concat(St()),e=window.location.hostname.split("."),n=e.pop();e.length&&!xt(t);)n="".concat(e.pop(),".").concat(n),kt(t,"test",at,{dom
2024-04-16 08:44:44 UTC	16384	IN	Data Raw: 69 6d 67 22 2c 22 69 63 6f 6e 22 5d 2c 74 29 7c 7c 6e 75 6c 6c 21 3d 3d 2f 5c 2e 28 67 69 66 7c 6a 70 67 7c 6a 70 65 67 7c 74 69 66 66 7c 70 6e 67 7c 73 76 67 7c 69 63 6f 29 24 2f 69 2e 65 78 65 63 28 65 29 7d 5d 2c 5b 22 66 6f 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 2f 5c 2e 28 77 6f 66 66 7c 65 6f 74 7c 77 6f 66 66 32 7c 74 74 66 29 24 2f 69 2e 65 78 65 63 28 65 29 7d 5d 2c 5b 22 6d 65 64 69 61 22 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 70 28 5b 22 61 75 64 69 6f 22 2c 22 76 69 64 65 6f 22 5d 2c 74 29 7c 7c 6e 75 6c 6c 21 3d 3d 2f 5c 2e 28 6d 70 33 7c 6d 70 34 29 24 2f 69 2e 65 78 65 63 28 65 29 7d 5d 5d 3b 66 75 6e 63 74 69 6f 6e 20 7a 6e 28 74 29 7b 76 61 72 20 65 3d 74 Data Ascii: img","icon"],t)\|\|null!==/\.(gif\|jpg\|jpeg\|tiff\|png\|svg\|ico)$/i.exec(e)}],["font",function(t,e){return null!==/\.(woff\|eot\|woff2\|ttf)$/i.exec(e)}],["media",function(t,e){return p(["audio","video"],t)\|\|null!==/\.(mp3\|mp4)$/i.exec(e)}]];function zn(t){var e=t
2024-04-16 08:44:44 UTC	16384	IN	Data Raw: 74 79 3a 21 30 2c 65 6e 64 3a 76 74 28 29 7d 29 7d 29 29 2c 6e 29 3a 76 6f 69 64 20 30 2c 73 3d 74 2e 73 75 62 73 63 72 69 62 65 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2e 69 73 42 75 73 79 3b 41 28 6f 29 2c 41 28 72 29 3b 76 61 72 20 6e 3d 76 74 28 29 3b 65 7c 7c 28 72 3d 43 28 6c 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 28 7b 68 61 64 41 63 74 69 76 69 74 79 3a 21 30 2c 65 6e 64 3a 6e 7d 29 7d 29 29 2c 56 72 29 29 7d 29 29 2c 75 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 3d 21 30 2c 41 28 6f 29 2c 41 28 72 29 2c 41 28 61 29 2c 73 2e 75 6e 73 75 62 73 63 72 69 62 65 28 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 28 74 29 7b 69 7c 7c 28 75 28 29 2c 65 28 74 29 29 7d 72 65 74 75 72 6e 7b 73 74 6f 70 3a 75 7d 7d 28 6f 2c Data Ascii: ty:!0,end:vt()})})),n):void 0,s=t.subscribe((function(t){var e=t.isBusy;A(o),A(r);var n=vt();e\|\|(r=C(l((function(){return c({hadActivity:!0,end:n})})),Vr))})),u=function(){i=!0,A(o),A(r),A(a),s.unsubscribe()};function c(t){i\|\|(u(),e(t))}return{stop:u}}(o,
2024-04-16 08:44:44 UTC	16384	IN	Data Raw: 72 20 69 3d 74 5b 72 5d 2c 6f 3d 74 5b 72 2b 31 5d 3b 69 66 28 22 61 63 74 69 76 65 22 3d 3d 3d 69 2e 73 74 61 74 65 29 7b 76 61 72 20 61 3d 69 2e 73 74 61 72 74 3e 3d 30 3f 69 2e 73 74 61 72 74 3a 30 2c 73 3d 6f 3f 6f 2e 73 74 61 72 74 3a 66 74 28 65 29 3b 6e 2e 70 75 73 68 28 7b 73 74 61 72 74 3a 61 2c 64 75 72 61 74 69 6f 6e 3a 73 2d 61 7d 29 7d 7d 72 65 74 75 72 6e 20 6e 7d 76 61 72 20 5a 69 3d 31 30 2a 73 74 3b 76 61 72 20 4b 69 2c 57 69 3d 31 30 2a 73 74 3b 66 75 6e 63 74 69 6f 6e 20 58 69 28 74 2c 65 2c 6e 2c 72 29 7b 76 61 72 20 69 2c 6f 2c 61 2c 73 3d 7b 7d 2c 75 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 7b 73 74 6f 70 3a 74 2e 73 75 62 73 63 72 69 62 65 28 30 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 Data Ascii: r i=t[r],o=t[r+1];if("active"===i.state){var a=i.start>=0?i.start:0,s=o?o.start:ft(e);n.push({start:a,duration:s-a})}}return n}var Zi=10st;var Ki,Wi=10st;function Xi(t,e,n,r){var i,o,a,s={},u=function(t,e){return{stop:t.subscribe(0,(function(t){for(var
2024-04-16 08:44:44 UTC	16384	IN	Data Raw: 3d 33 2a 54 2c 49 6f 3d 73 74 2c 4f 6f 3d 61 74 3b 66 75 6e 63 74 69 6f 6e 20 4e 6f 28 74 2c 65 2c 6e 2c 72 2c 69 29 7b 30 3d 3d 3d 65 2e 74 72 61 6e 73 70 6f 72 74 53 74 61 74 75 73 26 26 30 3d 3d 3d 65 2e 71 75 65 75 65 64 50 61 79 6c 6f 61 64 73 2e 73 69 7a 65 28 29 26 26 65 2e 62 61 6e 64 77 69 64 74 68 4d 6f 6e 69 74 6f 72 2e 63 61 6e 48 61 6e 64 6c 65 28 74 29 3f 4d 6f 28 74 2c 65 2c 6e 2c 7b 6f 6e 53 75 63 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 55 6f 28 30 2c 65 2c 6e 2c 72 2c 69 29 7d 2c 6f 6e 46 61 69 6c 75 72 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 71 75 65 75 65 64 50 61 79 6c 6f 61 64 73 2e 65 6e 71 75 65 75 65 28 74 29 2c 4c 6f 28 65 2c 6e 2c 72 2c 69 29 7d 7d 29 3a 65 2e 71 75 65 75 65 64 50 61 79 6c 6f 61 Data Ascii: =3*T,Io=st,Oo=at;function No(t,e,n,r,i){0===e.transportStatus&&0===e.queuedPayloads.size()&&e.bandwidthMonitor.canHandle(t)?Mo(t,e,n,{onSuccess:function(){return Uo(0,e,n,r,i)},onFailure:function(){e.queuedPayloads.enqueue(t),Lo(e,n,r,i)}}):e.queuedPayloa
2024-04-16 08:44:44 UTC	16384	IN	Data Raw: 69 73 54 72 75 73 74 65 64 26 26 43 6e 28 22 6d 6f 75 73 65 2f 74 6f 75 63 68 20 65 76 65 6e 74 20 77 69 74 68 6f 75 74 20 78 2f 79 22 29 7d 76 61 72 20 6f 73 2c 61 73 3d 31 30 30 3b 76 61 72 20 73 73 3d 28 28 6f 73 3d 7b 7d 29 2e 70 6f 69 6e 74 65 72 75 70 3d 6c 61 2e 4d 6f 75 73 65 55 70 2c 6f 73 2e 6d 6f 75 73 65 64 6f 77 6e 3d 6c 61 2e 4d 6f 75 73 65 44 6f 77 6e 2c 6f 73 2e 63 6c 69 63 6b 3d 6c 61 2e 43 6c 69 63 6b 2c 6f 73 2e 63 6f 6e 74 65 78 74 6d 65 6e 75 3d 6c 61 2e 43 6f 6e 74 65 78 74 4d 65 6e 75 2c 6f 73 2e 64 62 6c 63 6c 69 63 6b 3d 6c 61 2e 44 62 6c 43 6c 69 63 6b 2c 6f 73 2e 66 6f 63 75 73 3d 6c 61 2e 46 6f 63 75 73 2c 6f 73 2e 62 6c 75 72 3d 6c 61 2e 42 6c 75 72 2c 6f 73 2e 74 6f 75 63 68 73 74 61 72 74 3d 6c 61 2e 54 6f 75 63 68 53 74 61 Data Ascii: isTrusted&&Cn("mouse/touch event without x/y")}var os,as=100;var ss=((os={}).pointerup=la.MouseUp,os.mousedown=la.MouseDown,os.click=la.Click,os.contextmenu=la.ContextMenu,os.dblclick=la.DblClick,os.focus=la.Focus,os.blur=la.Blur,os.touchstart=la.TouchSta
2024-04-16 08:44:44 UTC	16384	IN	Data Raw: 76 61 6c 69 64 2b 3d 61 29 7d 2c 78 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 61 29 7b 7a 28 74 2c 61 5b 32 2a 65 5d 2c 61 5b 32 2a 65 2b 31 5d 29 7d 2c 41 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 61 3d 30 3b 64 6f 7b 61 7c 3d 31 26 74 2c 74 3e 3e 3e 3d 31 2c 61 3c 3c 3d 31 7d 77 68 69 6c 65 28 2d 2d 65 3e 30 29 3b 72 65 74 75 72 6e 20 61 3e 3e 3e 31 7d 2c 45 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 61 29 7b 76 61 72 20 6e 2c 72 2c 73 3d 6e 65 77 20 41 72 72 61 79 28 31 36 29 2c 5f 3d 30 3b 66 6f 72 28 6e 3d 31 3b 6e 3c 3d 69 3b 6e 2b 2b 29 73 5b 6e 5d 3d 5f 3d 5f 2b 61 5b 6e 2d 31 5d 3c 3c 31 3b 66 6f 72 28 72 3d 30 3b 72 3c 3d 65 3b 72 2b 2b 29 7b 76 61 72 20 68 3d 74 5b 32 2a 72 2b 31 5d 3b 30 21 3d 3d 68 26 26 28 74 5b 32 2a 72 5d 3d Data Ascii: valid+=a)},x=function(t,e,a){z(t,a[2e],a[2e+1])},A=function(t,e){var a=0;do{a\|=1&t,t>>>=1,a<<=1}while(--e>0);return a>>>1},E=function(t,e,a){var n,r,s=new Array(16),_=0;for(n=1;n<=i;n++)s[n]=_=_+a[n-1]<<1;for(r=0;r<=e;r++){var h=t[2r+1];0!==h&&(t[2r]=
2024-04-16 08:44:44 UTC	16384	IN	Data Raw: 61 64 2e 68 63 72 63 26 26 72 2e 70 65 6e 64 69 6e 67 3e 61 26 26 28 74 2e 61 64 6c 65 72 3d 4d 28 74 2e 61 64 6c 65 72 2c 72 2e 70 65 6e 64 69 6e 67 5f 62 75 66 2c 72 2e 70 65 6e 64 69 6e 67 2d 61 2c 61 29 29 2c 6b 74 28 74 29 2c 61 3d 72 2e 70 65 6e 64 69 6e 67 2c 72 2e 70 65 6e 64 69 6e 67 21 3d 3d 72 2e 70 65 6e 64 69 6e 67 5f 62 75 66 5f 73 69 7a 65 29 29 3b 29 78 74 28 72 2c 32 35 35 26 72 2e 67 7a 68 65 61 64 2e 65 78 74 72 61 5b 72 2e 67 7a 69 6e 64 65 78 5d 29 2c 72 2e 67 7a 69 6e 64 65 78 2b 2b 3b 72 2e 67 7a 68 65 61 64 2e 68 63 72 63 26 26 72 2e 70 65 6e 64 69 6e 67 3e 61 26 26 28 74 2e 61 64 6c 65 72 3d 4d 28 74 2e 61 64 6c 65 72 2c 72 2e 70 65 6e 64 69 6e 67 5f 62 75 66 2c 72 2e 70 65 6e 64 69 6e 67 2d 61 2c 61 29 29 2c 72 2e 67 7a 69 6e 64 Data Ascii: ad.hcrc&&r.pending>a&&(t.adler=M(t.adler,r.pending_buf,r.pending-a,a)),kt(t),a=r.pending,r.pending!==r.pending_buf_size));)xt(r,255&r.gzhead.extra[r.gzindex]),r.gzindex++;r.gzhead.hcrc&&r.pending>a&&(t.adler=M(t.adler,r.pending_buf,r.pending-a,a)),r.gzind
2024-04-16 08:44:44 UTC	6296	IN	Data Raw: 44 45 4e 7d 29 3a 22 66 72 65 65 7a 65 22 3d 3d 3d 74 2e 74 79 70 65 26 26 65 2e 6e 6f 74 69 66 79 28 7b 72 65 61 73 6f 6e 3a 4f 6e 2e 46 52 4f 5a 45 4e 7d 29 7d 29 2c 7b 63 61 70 74 75 72 65 3a 21 30 7d 29 2e 73 74 6f 70 2c 69 3d 4e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 69 3d 4d 74 28 74 2c 77 69 6e 64 6f 77 2c 22 62 65 66 6f 72 65 75 6e 6c 6f 61 64 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 6e 6f 74 69 66 79 28 7b 72 65 61 73 6f 6e 3a 4f 6e 2e 55 4e 4c 4f 41 44 49 4e 47 7d 29 7d 29 29 2e 73 74 6f 70 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 28 29 2c 69 28 29 7d 7d 29 29 3b 72 65 74 75 72 6e 20 65 7d 28 65 29 2c 76 3d 66 2e 73 75 62 73 63 72 69 62 65 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 73 2e 6e 6f 74 69 66 79 28 39 2c 74 29 7d 29 29 3b 61 2e 70 Data Ascii: DEN}):"freeze"===t.type&&e.notify({reason:On.FROZEN})}),{capture:!0}).stop,i=N;return n\|\|(i=Mt(t,window,"beforeunload",(function(){e.notify({reason:On.UNLOADING})})).stop),function(){r(),i()}}));return e}(e),v=f.subscribe((function(t){s.notify(9,t)}));a.p

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://esuper.giize.com/track/3nFyeL1856Txfl2mxxurvuzom168QHIOOXHLCCRFKCA68673JUWD278x9

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Windows Analysis Report
http://esuper.giize.com/track/3nFyeL1856Txfl2mxxurvuzom168QHIOOXHLCCRFKCA68673JUWD278x9

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:43 UTC	694	OUT	GET /ktag/latest/ktag.min.js?accountId=0c1098d4-e85c-41fd-be56-6189d39234c9 HTTP/1.1 Host: www.knotch-cdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.foxnews.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 08:44:44 UTC	685	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 89331 Connection: close Date: Mon, 15 Apr 2024 12:50:18 GMT Last-Modified: Thu, 11 Apr 2024 15:14:10 GMT ETag: "8897f8f1275a543aea65bf0223925c58" x-amz-server-side-encryption: AES256 Cache-Control: max-age=86400 Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 67c6abcf8cdeba1c4ea7415581d9656e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P6 X-Amz-Cf-Id: 10w2evXVjNyrKlr2P3kngQilRtR-Oq7y-WT19KPSWGvE0XRvMkWzBg== Age: 71667 X-XSS-Protection: 1 Referrer-Policy: same-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000
2024-04-16 08:44:44 UTC	16384	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 72 3d 72 2e 66 69 6c 74 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 74 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 72 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e Data Ascii: !function(){"use strict";function e(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function
2024-04-16 08:44:44 UTC	16384	IN	Data Raw: 2c 69 3d 65 2e 68 65 61 64 65 72 73 2c 61 3d 65 2e 72 65 73 70 6f 6e 73 65 54 65 78 74 3b 34 30 33 3d 3d 3d 6e 26 26 6b 28 7b 6e 61 6d 65 3a 22 5b 62 6c 61 63 6b 20 6c 69 73 74 5d 20 63 6f 6e 66 69 67 20 75 72 6c 20 77 61 73 20 66 6f 72 62 69 64 64 65 6e 22 2c 75 72 6c 3a 74 2c 73 74 61 74 75 73 3a 6e 2c 73 74 61 74 75 73 54 65 78 74 3a 72 2c 68 65 61 64 65 72 73 3a 69 2c 72 65 73 70 6f 6e 73 65 54 65 78 74 3a 61 7d 29 2c 34 30 34 3d 3d 3d 6e 26 26 6b 28 7b 6e 61 6d 65 3a 22 5b 62 6c 61 63 6b 20 6c 69 73 74 5d 20 63 6f 6e 66 69 67 20 75 72 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 22 2c 75 72 6c 3a 74 2c 73 74 61 74 75 73 3a 6e 2c 73 74 61 74 75 73 54 65 78 74 3a 72 2c 68 65 61 64 65 72 73 3a 69 2c 72 65 73 70 6f 6e 73 65 54 65 78 74 3a 61 7d 29 2c 77 Data Ascii: ,i=e.headers,a=e.responseText;403===n&&k({name:"[black list] config url was forbidden",url:t,status:n,statusText:r,headers:i,responseText:a}),404===n&&k({name:"[black list] config url was not found",url:t,status:n,statusText:r,headers:i,responseText:a}),w
2024-04-16 08:44:44 UTC	16384	IN	Data Raw: 29 7d 7d 2c 65 7d 28 29 2c 5a 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 66 69 6c 65 3a 65 2e 66 69 6c 65 4e 61 6d 65 2c 6d 65 74 68 6f 64 3a 51 28 65 2e 66 75 6e 63 74 69 6f 6e 4e 61 6d 65 29 2c 6c 69 6e 65 4e 75 6d 62 65 72 3a 65 2e 6c 69 6e 65 4e 75 6d 62 65 72 2c 63 6f 6c 75 6d 6e 4e 75 6d 62 65 72 3a 65 2e 63 6f 6c 75 6d 6e 4e 75 6d 62 65 72 2c 63 6f 64 65 3a 76 6f 69 64 20 30 2c 69 6e 50 72 6f 6a 65 63 74 3a 76 6f 69 64 20 30 7d 3b 72 65 74 75 72 6e 20 74 2e 6c 69 6e 65 4e 75 6d 62 65 72 3e 2d 31 26 26 21 74 2e 66 69 6c 65 26 26 21 74 2e 6d 65 74 68 6f 64 26 26 28 74 2e 66 69 6c 65 3d 22 67 6c 6f 62 61 6c 20 63 6f 64 65 22 29 2c 74 7d 2c 51 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 2f 5e 67 6c 6f 62 61 6c 20 63 6f 64 Data Ascii: )}},e}(),Z=function(e){var t={file:e.fileName,method:Q(e.functionName),lineNumber:e.lineNumber,columnNumber:e.columnNumber,code:void 0,inProject:void 0};return t.lineNumber>-1&&!t.file&&!t.method&&(t.file="global code"),t},Q=function(e){return/^global cod
2024-04-16 08:44:44 UTC	16384	IN	Data Raw: 5d 22 3d 3d 3d 72 29 74 72 79 7b 72 3d 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 7d 63 61 74 63 68 28 65 29 7b 7d 72 65 74 75 72 6e 20 65 5b 22 5b 22 2b 6e 2b 22 5d 22 5d 3d 72 2c 65 7d 29 2c 7b 73 65 76 65 72 69 74 79 3a 30 3d 3d 3d 6e 2e 69 6e 64 65 78 4f 66 28 22 67 72 6f 75 70 22 29 3f 22 6c 6f 67 22 3a 6e 7d 29 2c 22 6c 6f 67 22 29 2c 72 2e 61 70 70 6c 79 28 63 6f 6e 73 6f 6c 65 2c 61 29 7d 2c 63 6f 6e 73 6f 6c 65 5b 6e 5d 2e 5f 72 65 73 74 6f 72 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 6f 6c 65 5b 6e 5d 3d 72 7d 7d 29 29 7d 7d 2c 70 74 3d 6e 28 5b 22 6c 6f 67 22 2c 22 64 65 62 75 67 22 2c 22 69 6e 66 6f 22 2c 22 77 61 72 6e 22 2c 22 65 72 72 6f 72 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 Data Ascii: ]"===r)try{r=JSON.stringify(t)}catch(e){}return e["["+n+"]"]=r,e}),{severity:0===n.indexOf("group")?"log":n}),"log"),r.apply(console,a)},console[n]._restore=function(){console[n]=r}}))}},pt=n(["log","debug","info","warn","error"],(function(e){return"undef
2024-04-16 08:44:44 UTC	16384	IN	Data Raw: 6e 3d 77 69 6e 64 6f 77 2e 6b 74 61 67 26 26 77 69 6e 64 6f 77 2e 6b 74 61 67 2e 62 6c 61 63 6b 4c 69 73 74 43 6f 6e 66 69 67 3b 69 66 28 21 6e 29 72 65 74 75 72 6e 20 6b 28 7b 6e 61 6d 65 3a 22 5b 69 6e 74 65 72 61 63 74 69 6f 6e 20 77 68 69 74 65 2f 62 6c 61 63 6b 20 6c 69 73 74 5d 20 6e 6f 20 62 6c 61 63 6b 6c 69 73 74 20 63 6f 6e 66 69 67 22 7d 29 2c 6e 65 77 20 45 72 72 6f 72 28 22 4d 69 73 73 69 6e 67 20 62 6c 61 63 6b 6c 69 73 74 20 63 6f 6e 66 69 67 22 29 3b 66 6f 72 28 76 61 72 20 72 3d 6e 2e 68 74 6d 6c 5f 62 6c 61 63 6b 6c 69 73 74 2c 69 3d 76 6f 69 64 20 30 3d 3d 3d 72 3f 5b 5d 3a 72 2c 61 3d 6e 2e 68 74 6d 6c 5f 70 72 69 76 61 74 65 5f 77 68 69 74 65 6c 69 73 74 2c 6f 3d 21 31 2c 73 3d 22 62 6c 61 63 6b 6c 69 73 74 22 3d 3d 3d 74 3f 69 3a 76 Data Ascii: n=window.ktag&&window.ktag.blackListConfig;if(!n)return k({name:"[interaction white/black list] no blacklist config"}),new Error("Missing blacklist config");for(var r=n.html_blacklist,i=void 0===r?[]:r,a=n.html_private_whitelist,o=!1,s="blacklist"===t?i:v
2024-04-16 08:44:44 UTC	7411	IN	Data Raw: 73 3a 22 68 74 74 70 73 3a 2f 2f 66 72 6f 6e 74 64 6f 6f 72 2e 6b 6e 6f 74 63 68 2e 69 74 2f 69 6e 67 72 65 73 73 22 2c 61 63 63 6f 75 6e 74 43 6f 6e 66 69 67 3a 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 73 2e 6b 6e 6f 74 63 68 2e 69 74 2f 6b 74 61 67 2d 63 6f 6e 66 69 67 22 2c 76 65 72 73 69 6f 6e 3a 22 76 32 2e 35 2e 30 22 2c 6d 65 61 73 75 72 65 6d 65 6e 74 43 61 72 64 3a 22 6d 65 61 73 75 72 65 6d 65 6e 74 43 61 72 64 2e 6d 69 6e 2e 6a 73 22 2c 74 68 65 6d 65 3a 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 73 2e 6b 6e 6f 74 63 68 2e 69 74 2f 74 68 65 6d 65 73 22 2c 64 65 6c 69 76 65 72 79 45 6e 67 69 6e 65 3a 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 6b 6e 6f 74 63 68 2e 69 74 2f 22 2c 70 72 6f 46 45 3a 22 68 74 74 70 73 3a 2f 2f 6e 65 78 74 67 65 Data Ascii: s:"https://frontdoor.knotch.it/ingress",accountConfig:"https://units.knotch.it/ktag-config",version:"v2.5.0",measurementCard:"measurementCard.min.js",theme:"https://units.knotch.it/themes",deliveryEngine:"https://delivery.knotch.it/",proFE:"https://nextge

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:44 UTC	692	OUT	GET /v2/0c1098d4-e85c-41fd-be56-6189d39234c9 HTTP/1.1 Host: configs.knotch.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.foxnews.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.foxnews.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 08:44:44 UTC	614	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 1973 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD Access-Control-Expose-Headers: ETag Access-Control-Max-Age: 3000 Last-Modified: Wed, 03 Apr 2024 15:57:47 GMT Server: AmazonS3 Date: Mon, 15 Apr 2024 09:10:41 GMT ETag: "e9aac51cd2e9d56866d04b980c2b29e5" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 30e680d51817854d1418152dc862dcfe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P4 X-Amz-Cf-Id: MpN3627LrL3alqJxT9O1RGsV8BYRSQyZDhzFBJhuWpOZGQITA4NzoQ== Age: 85813
2024-04-16 08:44:44 UTC	1973	IN	Data Raw: 7b 22 61 63 63 65 70 74 22 3a 5b 22 6e 61 74 69 6f 6e 2e 66 6f 78 6e 65 77 73 2e 63 6f 6d 22 2c 22 66 6f 78 73 70 6f 72 74 73 2e 63 6f 6d 22 2c 22 74 75 62 69 74 76 2e 63 6f 6d 22 2c 22 66 6f 78 6e 65 77 73 2e 63 6f 6d 22 2c 22 63 72 65 64 69 62 6c 65 2e 63 6f 6d 22 2c 22 66 6f 78 62 75 73 69 6e 65 73 73 2e 63 6f 6d 22 5d 2c 22 62 6f 6f 6c 65 61 6e 5f 66 6c 61 67 73 22 3a 5b 22 66 72 6f 6e 74 5f 64 6f 6f 72 5f 65 6e 61 62 6c 65 64 22 5d 2c 22 68 74 6d 6c 5f 62 6c 61 63 6b 6c 69 73 74 22 3a 5b 5d 2c 22 68 74 6d 6c 5f 70 72 69 76 61 74 65 5f 77 68 69 74 65 6c 69 73 74 22 3a 5b 5d 2c 22 6d 6f 64 75 6c 65 73 22 3a 5b 5d 2c 22 70 72 69 76 61 74 65 22 3a 5b 5d 2c 22 72 65 6a 65 63 74 22 3a 5b 22 2e 71 61 2e 63 72 65 64 69 62 6c 65 2e 63 6f 6d 22 2c 22 63 72 65 Data Ascii: {"accept":["nation.foxnews.com","foxsports.com","tubitv.com","foxnews.com","credible.com","foxbusiness.com"],"boolean_flags":["front_door_enabled"],"html_blacklist":[],"html_private_whitelist":[],"modules":[],"private":[],"reject":[".qa.credible.com","cre

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:45 UTC	381	OUT	GET /v2/0c1098d4-e85c-41fd-be56-6189d39234c9 HTTP/1.1 Host: configs.knotch.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 08:44:45 UTC	614	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 1973 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD Access-Control-Expose-Headers: ETag Access-Control-Max-Age: 3000 Last-Modified: Wed, 03 Apr 2024 15:57:47 GMT Server: AmazonS3 Date: Mon, 15 Apr 2024 08:54:32 GMT ETag: "e9aac51cd2e9d56866d04b980c2b29e5" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 013a3e024d5f63ca782ac0e589b4fd7e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P4 X-Amz-Cf-Id: Y7m4geojU_46v0Y6fpYuHWYWpI9J6lAowQ1Xy9TOzdDicBd5_3kd0A== Age: 85814
2024-04-16 08:44:45 UTC	1973	IN	Data Raw: 7b 22 61 63 63 65 70 74 22 3a 5b 22 6e 61 74 69 6f 6e 2e 66 6f 78 6e 65 77 73 2e 63 6f 6d 22 2c 22 66 6f 78 73 70 6f 72 74 73 2e 63 6f 6d 22 2c 22 74 75 62 69 74 76 2e 63 6f 6d 22 2c 22 66 6f 78 6e 65 77 73 2e 63 6f 6d 22 2c 22 63 72 65 64 69 62 6c 65 2e 63 6f 6d 22 2c 22 66 6f 78 62 75 73 69 6e 65 73 73 2e 63 6f 6d 22 5d 2c 22 62 6f 6f 6c 65 61 6e 5f 66 6c 61 67 73 22 3a 5b 22 66 72 6f 6e 74 5f 64 6f 6f 72 5f 65 6e 61 62 6c 65 64 22 5d 2c 22 68 74 6d 6c 5f 62 6c 61 63 6b 6c 69 73 74 22 3a 5b 5d 2c 22 68 74 6d 6c 5f 70 72 69 76 61 74 65 5f 77 68 69 74 65 6c 69 73 74 22 3a 5b 5d 2c 22 6d 6f 64 75 6c 65 73 22 3a 5b 5d 2c 22 70 72 69 76 61 74 65 22 3a 5b 5d 2c 22 72 65 6a 65 63 74 22 3a 5b 22 2e 71 61 2e 63 72 65 64 69 62 6c 65 2e 63 6f 6d 22 2c 22 63 72 65 Data Ascii: {"accept":["nation.foxnews.com","foxsports.com","tubitv.com","foxnews.com","credible.com","foxbusiness.com"],"boolean_flags":["front_door_enabled"],"html_blacklist":[],"html_private_whitelist":[],"modules":[],"private":[],"reject":[".qa.credible.com","cre

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:45 UTC	1828	OUT	GET /ingress?browser_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&root_browser_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&canonical_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&referrer_url=http%3A%2F%2Fesuper.giize.com%2F&account_id=0c1098d4-e85c-41fd-be56-6189d39234c9&cs_render_id=93853205-7fe2-4686-a867-3de4af25f95b&cs_visitor_id=e1c1034e-6cab-499f-8151-91fbf265d378&time_stamp=1713257083659&session_time_stamp=1713257083126&user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&ktag_version=v2.5.0&platform=Win32&language=en-US&color_depth=24&screen_resolution=1280x1024&time_zone=Europe%2FZurich&privacy_mode=false&content_height=10630&content_width=1316&type=page_view&load_data=%257B%2522load_time%2522%253A694.2%252C%2522time_to_page_view%2522%253A530.9%257D&custom_json=%257B%257D&set_cookie=true HTTP/1.1 Host: frontdoor.knotch.it Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.foxnews.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 08:44:45 UTC	376	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 08:44:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 170 Connection: close Set-Cookie: visitor_id=f9fcdd2c-0bbf-4bc4-89de-3e7001bfc6b1; max-age=31536000; domain=.knotch.it; path=/; HttpOnly; secure; SameSite=None Set-Cookie: optout=0; max-age=31536000; domain=.knotch.it; path=/; HttpOnly; secure; SameSite=None
2024-04-16 08:44:45 UTC	170	IN	Data Raw: 7b 22 62 6f 64 79 22 3a 22 52 30 6c 47 4f 44 6c 68 41 51 41 42 41 50 41 41 41 41 41 41 41 41 41 41 41 43 48 35 42 41 45 41 41 41 41 41 4c 41 41 41 41 41 41 42 41 41 45 41 41 41 49 43 52 41 45 41 4f 77 3d 3d 22 2c 22 68 65 61 64 65 72 73 22 3a 22 7b 5c 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 5c 22 3a 5c 22 5b 5c 5c 5c 22 69 6d 61 67 65 2f 67 69 66 5c 5c 5c 22 5d 5c 22 7d 22 2c 22 69 73 42 61 73 65 36 34 45 6e 63 6f 64 65 64 22 3a 22 54 72 75 65 22 2c 22 73 74 61 74 75 73 43 6f 64 65 22 3a 22 32 30 30 22 7d Data Ascii: {"body":"R0lGODlhAQABAPAAAAAAAAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==","headers":"{\"Content-Type\":\"[\\\"image/gif\\\"]\"}","isBase64Encoded":"True","statusCode":"200"}

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:45 UTC	1553	OUT	GET /ingress?browser_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&root_browser_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&canonical_url=https%3A%2F%2Fwww.foxnews.com%2Fworld%2Firans-attack-israel-shines-spotlight-tehrans-advancing-nuclear-weapons-program&referrer_url=http%3A%2F%2Fesuper.giize.com%2F&account_id=0c1098d4-e85c-41fd-be56-6189d39234c9&cs_render_id=93853205-7fe2-4686-a867-3de4af25f95b&cs_visitor_id=e1c1034e-6cab-499f-8151-91fbf265d378&time_stamp=1713257083659&session_time_stamp=1713257083126&user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&ktag_version=v2.5.0&platform=Win32&language=en-US&color_depth=24&screen_resolution=1280x1024&time_zone=Europe%2FZurich&privacy_mode=false&content_height=10630&content_width=1316&type=page_view&load_data=%257B%2522load_time%2522%253A694.2%252C%2522time_to_page_view%2522%253A530.9%257D&custom_json=%257B%257D&set_cookie=true HTTP/1.1 Host: frontdoor.knotch.it Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: visitor_id=f9fcdd2c-0bbf-4bc4-89de-3e7001bfc6b1; optout=0
2024-04-16 08:44:45 UTC	376	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 08:44:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 170 Connection: close Set-Cookie: visitor_id=f9fcdd2c-0bbf-4bc4-89de-3e7001bfc6b1; max-age=31536000; domain=.knotch.it; path=/; HttpOnly; secure; SameSite=None Set-Cookie: optout=0; max-age=31536000; domain=.knotch.it; path=/; HttpOnly; secure; SameSite=None
2024-04-16 08:44:45 UTC	170	IN	Data Raw: 7b 22 62 6f 64 79 22 3a 22 52 30 6c 47 4f 44 6c 68 41 51 41 42 41 50 41 41 41 41 41 41 41 41 41 41 41 43 48 35 42 41 45 41 41 41 41 41 4c 41 41 41 41 41 41 42 41 41 45 41 41 41 49 43 52 41 45 41 4f 77 3d 3d 22 2c 22 68 65 61 64 65 72 73 22 3a 22 7b 5c 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 5c 22 3a 5c 22 5b 5c 5c 5c 22 69 6d 61 67 65 2f 67 69 66 5c 5c 5c 22 5d 5c 22 7d 22 2c 22 69 73 42 61 73 65 36 34 45 6e 63 6f 64 65 64 22 3a 22 54 72 75 65 22 2c 22 73 74 61 74 75 73 43 6f 64 65 22 3a 22 32 30 30 22 7d Data Ascii: {"body":"R0lGODlhAQABAPAAAAAAAAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==","headers":"{\"Content-Type\":\"[\\\"image/gif\\\"]\"}","isBase64Encoded":"True","statusCode":"200"}

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:46 UTC	835	OUT	GET /id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=17FC406C5357BA6E0A490D4D%40AdobeOrg&d_nsid=0&ts=1713257084991 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.foxnews.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.foxnews.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 08:44:46 UTC	948	IN	HTTP/1.1 302 Found Date: Tue, 16 Apr 2024 08:44:46 GMT Content-Length: 0 Connection: close X-TID: WOcM7COhS90= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.foxnews.com Vary: Origin Access-Control-Allow-Credentials: true Location: https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=17FC406C5357BA6E0A490D4D%40AdobeOrg&d_nsid=0&ts=1713257084991 DCS: dcs-prod-va6-2-v059-0f1c979d1.edge-va6.demdex.com 0 ms set-cookie: demdex=04029004121583327971373609941773161467; Max-Age=15552000; Expires=Sun, 13 Oct 2024 08:44:46 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:46 UTC	515	OUT	OPTIONS /api/v1/item HTTP/1.1 Host: prod.idgraph.dt.fox Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: https://www.foxnews.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://www.foxnews.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 08:44:46 UTC	346	IN	HTTP/1.1 200 OK Server: awselb/2.0 Date: Tue, 16 Apr 2024 08:44:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close access-control-allow-headers: Accept, Accept-Language, Content-Language, Content-Type access-control-max-age: 86400 access-control-allow-methods: GET, POST access-control-allow-origin: *
2024-04-16 08:44:46 UTC	2	IN	Data Raw: 4f 4b Data Ascii: OK

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:46 UTC	515	OUT	OPTIONS /pyxis/submit HTTP/1.1 Host: prod.pyxis.atp.fox Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: https://www.foxnews.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://www.foxnews.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 08:44:46 UTC	335	IN	HTTP/1.1 204 No Content Date: Tue, 16 Apr 2024 08:44:46 GMT Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Length, Content-Type, Accept-Encoding Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: https://www.foxnews.com Access-Control-Max-Age: 86400

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:46 UTC	672	OUT	GET /foxus/v2/uid HTTP/1.1 Host: foxus.tagger.opecloud.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.foxnews.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.foxnews.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 08:44:47 UTC	243	IN	HTTP/1.1 204 No Content Date: Tue, 16 Apr 2024 08:44:46 GMT Connection: close Vary: Origin Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Origin: https://www.foxnews.com Access-Control-Allow-Credentials: true

Timestamp	Bytes transferred	Direction	Data
2024-04-16 08:44:46 UTC	893	OUT	GET /id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=17FC406C5357BA6E0A490D4D%40AdobeOrg&d_nsid=0&ts=1713257084991 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.foxnews.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.foxnews.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=04029004121583327971373609941773161467
2024-04-16 08:44:47 UTC	820	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 08:44:47 GMT Content-Type: application/json;charset=utf-8 Content-Length: 4605 Connection: close X-TID: 1wCMI+UASKA= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.foxnews.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-va6-2-v059-0ce5556f7.edge-va6.demdex.com 15 ms set-cookie: demdex=04029004121583327971373609941773161467; Max-Age=15552000; Expires=Sun, 13 Oct 2024 08:44:47 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-04-16 08:44:47 UTC	4605	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 30 34 32 32 32 30 36 32 35 32 32 37 36 37 37 37 39 30 38 31 33 39 35 31 35 32 30 35 30 35 35 38 35 39 30 37 37 30 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 52 4b 68 70 52 7a 38 6b 72 67 32 74 4c 4f 36 70 67 75 58 57 70 35 6f 6c 6b 41 63 55 6e 69 51 59 50 48 61 4d 57 57 67 64 4a 33 78 7a 50 57 51 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 37 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 32 31 22 2c 22 74 74 6c 22 3a 31 34 34 30 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 30 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 30 2c 22 75 72 6c 22 3a 5b 22 2f 2f 61 61 2e 61 67 6b 6e 2e Data Ascii: {"d_mid":"04222062522767779081395152050558590770","id_sync_ttl":604800,"d_blob":"RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y","dcs_region":7,"d_ottl":7200,"ibs":[{"id":"21","ttl":14400,"tag":"img","fireURLSync":0,"syncOnPage":0,"url":["//aa.agkn.