| Source: | Binary string: ad_prod.pdb\36C00AF489401A26639ABBA698DE76062* source: curcuma.exe, 00000025.00000003.1706127726.0000012CDEE4F000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\Local State source: curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: WINLOA~1.PDBwinload_prod.pdb source: curcuma.exe, 00000025.00000003.1914137812.0000012CDEE83000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1665087028.0000012CDEE65000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: K\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\Local State source: curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdbB source: curcuma.exe, 00000025.00000003.1665355347.0000012CDEE54000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\Local State source: curcuma.exe, 00000025.00000003.1704640245.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1705370093.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: curcuma.exe, 00000025.00000003.1665355347.0000012CDEE54000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\Local State source: curcuma.exe, 00000025.00000003.1665355347.0000012CDEE54000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\Local Statees source: curcuma.exe, 00000025.00000003.1704640245.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1705370093.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: FC:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\crobat\DCG source: curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: RegAsm.pdb source: RegAsm.exe, 0000001A.00000000.1139585263.0000000000502000.00000002.00000001.01000000.0000000B.sdmp |
| Source: | Binary string: ntdll.pdbUGP source: curcuma.exe, 00000025.00000002.2067051232.0000012CE02AE000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2062028723.0000012CDF0B2000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2067503246.0000012CE04AA000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2070281440.0000012CE10A9000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2064043968.0000012CDF6BA000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2063400094.0000012CDF4B9000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2068870239.0000012CE0AAC000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2070779946.0000012CE12A5000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2067953052.0000012CE06A4000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2062689732.0000012CDF2B2000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2071810365.0000012CE16A1000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2069313603.0000012CE0CA6000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2066142942.0000012CDFEA6000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2068427148.0000012CE08AD000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2072299199.0000012CE18A5000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2069784689.0000012CE0EA7000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2065673413.0000012CDFCAF000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2071296730.0000012CE14A1000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2065176277.0000012CDFAB0000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2064620170.0000012CDF8B3000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2066598163.0000012CE00A2000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\Local StateB source: curcuma.exe, 00000025.00000003.1704640245.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1705370093.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: m\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\Local Statev source: curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\Local State source: curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\ source: curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: a\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062State source: curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: winload_prod.pdb source: curcuma.exe, 00000025.00000003.1665355347.0000012CDEE54000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\Local StateQ source: curcuma.exe, 00000025.00000003.1704640245.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1705370093.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: lC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062Z source: curcuma.exe, 00000025.00000003.1704640245.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1706127726.0000012CDEE4F000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1705370093.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1665993469.0000012CDEE4D000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1705642796.0000012CDEE4D000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1704853715.0000012CDEE4D000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\Local State source: curcuma.exe, 00000025.00000003.1704640245.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1705370093.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\Local State source: curcuma.exe, 00000025.00000003.1665166422.0000012CDEE27000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: G\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\Local State0F2 source: curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: ntdll.pdb source: curcuma.exe, 00000025.00000002.2067051232.0000012CE02AE000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2062028723.0000012CDF0B2000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2067503246.0000012CE04AA000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2070281440.0000012CE10A9000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2064043968.0000012CDF6BA000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2063400094.0000012CDF4B9000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2068870239.0000012CE0AAC000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2070779946.0000012CE12A5000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2067953052.0000012CE06A4000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2062689732.0000012CDF2B2000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2071810365.0000012CE16A1000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2069313603.0000012CE0CA6000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2066142942.0000012CDFEA6000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2068427148.0000012CE08AD000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2072299199.0000012CE18A5000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2069784689.0000012CE0EA7000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2065673413.0000012CDFCAF000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2071296730.0000012CE14A1000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2065176277.0000012CDFAB0000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2064620170.0000012CDF8B3000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000002.2066598163.0000012CE00A2000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: x\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: curcuma.exe, 00000025.00000003.1665087028.0000012CDEE82000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdbx source: curcuma.exe, 00000025.00000003.1665355347.0000012CDEE54000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\Local StateLvA source: curcuma.exe, 00000025.00000003.1665166422.0000012CDEE27000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\Local State source: curcuma.exe, 00000025.00000003.1665355347.0000012CDEE54000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: RegAsm.pdb4 source: RegAsm.exe, 0000001A.00000000.1139585263.0000000000502000.00000002.00000001.01000000.0000000B.sdmp |
| Source: | Binary string: winload_prod.pdb@0 source: curcuma.exe, 00000025.00000003.1665355347.0000012CDEE54000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062* source: curcuma.exe, 00000025.00000003.1704640245.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1705370093.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1665993469.0000012CDEE4D000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1705642796.0000012CDEE4D000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1704853715.0000012CDEE4D000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: curcuma.exe, 00000025.00000003.1704640245.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1705370093.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1665993469.0000012CDEE4D000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1705642796.0000012CDEE4D000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1704853715.0000012CDEE4D000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\Local State source: curcuma.exe, 00000025.00000003.1704640245.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1705370093.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp, curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: winload_prod.pdbs source: curcuma.exe, 00000025.00000003.1665355347.0000012CDEE54000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\ source: curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: BC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\ogFiles\0F2\en-US source: curcuma.exe, 00000025.00000003.1665166422.0000012CDEE47000.00000004.00000020.00020000.00000000.sdmp |
| Source: C:\Users\user\Desktop\ADFoyxP.exe | Code function: 0_2_004062D5 FindFirstFileW,FindClose, | 0_2_004062D5 |
| Source: C:\Users\user\Desktop\ADFoyxP.exe | Code function: 0_2_00402E18 FindFirstFileW, | 0_2_00402E18 |
| Source: C:\Users\user\Desktop\ADFoyxP.exe | Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, | 0_2_00406C9B |
| Source: C:\Users\user\AppData\Local\TradeSecure Innovations\TradeHub.com | Code function: 23_2_0082A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 23_2_0082A087 |
| Source: C:\Users\user\AppData\Local\TradeSecure Innovations\TradeHub.com | Code function: 23_2_0082A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 23_2_0082A1E2 |
| Source: C:\Users\user\AppData\Local\TradeSecure Innovations\TradeHub.com | Code function: 23_2_0081E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, | 23_2_0081E472 |
| Source: C:\Users\user\AppData\Local\TradeSecure Innovations\TradeHub.com | Code function: 23_2_0082A570 FindFirstFileW,Sleep,FindNextFileW,FindClose, | 23_2_0082A570 |
| Source: C:\Users\user\AppData\Local\TradeSecure Innovations\TradeHub.com | Code function: 23_2_007EC622 FindFirstFileExW, | 23_2_007EC622 |
| Source: C:\Users\user\AppData\Local\TradeSecure Innovations\TradeHub.com | Code function: 23_2_008266DC FindFirstFileW,FindNextFileW,FindClose, | 23_2_008266DC |
| Source: C:\Users\user\AppData\Local\TradeSecure Innovations\TradeHub.com | Code function: 23_2_008273D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, | 23_2_008273D4 |
| Source: C:\Users\user\AppData\Local\TradeSecure Innovations\TradeHub.com | Code function: 23_2_00827333 FindFirstFileW,FindClose, | 23_2_00827333 |
| Source: C:\Users\user\AppData\Local\TradeSecure Innovations\TradeHub.com | Code function: 23_2_0081D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, | 23_2_0081D921 |
| Source: C:\Users\user\AppData\Local\TradeSecure Innovations\TradeHub.com | Code function: 23_2_0081DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, | 23_2_0081DC54 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 96.16.68.63 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 104.90.245.116 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 35.186.224.24 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 96.16.68.63 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 96.16.68.63 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 35.186.224.24 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 104.90.245.116 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.79.197.34 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 23.221.103.220 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 23.221.103.220 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.79.197.34 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 23.221.103.220 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 23.221.103.220 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 20.59.87.225 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 20.190.190.193 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 23.221.103.220 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 20.190.190.193 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 20.190.190.193 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 20.59.87.225 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 23.221.103.220 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 20.190.190.193 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 20.190.190.193 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 20.190.190.193 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 23.221.103.220 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 23.221.103.220 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 20.190.190.193 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 20.190.190.193 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 69.192.139.84 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 45.95.18.173 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 23.221.103.220 |
| Source: global traffic | HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIlaHLAQic/swBCIWgzQEIrJ7OAQjkr84BCMO2zgEIvbnOAQjtvM4BCLu9zgEI1r3OAQjMv84BGMHLzAEYva7OARidsc4BSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIlaHLAQic/swBCIWgzQEIrJ7OAQjkr84BCMO2zgEIvbnOAQjtvM4BCLu9zgEI1r3OAQjMv84BGMHLzAEYva7OARidsc4BSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgfycGL7HrL4GIjAhmMFMPH8wUKNr0bEtYM3LnQPsGF3J5h98t4VT4GecfiJQS2W_-ag002XOc99_7xoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=IVojWvzg6TUyKJVw0ku_QR3hPubqVuwe0yb4y4b-YIRsbXqlvFf4nf8hHcIJ1ezCk3DLcehLC-_5Gg1-eTlFENuF2t0DqMXXbVfN2CESIJWKoxrg2MoLaGmryadsX7Ff1GoLgL7-rmtQQBll9jCp-FFqmSeF3EAn4BWA9GOJ8HgICHnqGGsPvqV6deB-Ps1gO_KrS_reNHfeikY |
| Source: global traffic | HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgfycGL7HrL4GIjAmpIoRwQKUszb_kOodZXKTvmHkevR-Cd2RnhaUlOi-F-4Uf63dtl_aaApMYLDB-XMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIlaHLAQic/swBCIWgzQEIrJ7OAQjkr84BCMO2zgEIvbnOAQjtvM4BCLu9zgEI1r3OAQjMv84BGMHLzAEYva7OARidsc4BSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=OsvFMy0TgwoJRxbHC4JnqoCvr3qemCRmPKC10ZSZhhfE86TZBsQU7VmemVGgjpeaVwzhIP47Yf26Vw-fhI5OqagPGudTV5bsgbXftG8iKYPpr9wqdTXgk2ItVVq0oLoQ5j87AUXdpaRxR1HURODf7wyOT8W3s2tmAfN_fdfEOUZKBw_BpnUZlZ4bhCxKImP1clIgZtmnPqN0XjU |
| Source: global traffic | HTTP traffic detected: GET /edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.867cdfd625d830718faf.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8Origin: https://ntp.msn.comsec-ch-ua-model: rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 1.3sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; sptmarket=en-US||us|en-us|en-us|en||cf=8|RefA=CE27969BA8D74822BE092FFEAAAF385A.RefC=2025-03-07T16:50:12Z; USRLOC=; MUID=0DDB686F4DAE69E20AF07DC74C2A6898; MUIDB=0DDB686F4DAE69E20AF07DC74C2A6898; _EDGE_S=F=1&SID=09B6721C09FF608E3C5C67B408E461B2; _EDGE_V=1 |
| Source: global traffic | HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.948ffa5ea2d441a35f55.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8sec-ch-ua-model: rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; sptmarket=en-US||us|en-us|en-us|en||cf=8|RefA=CE27969BA8D74822BE092FFEAAAF385A.RefC=2025-03-07T16:50:12Z; USRLOC=; MUID=0DDB686F4DAE69E20AF07DC74C2A6898; MUIDB=0DDB686F4DAE69E20AF07DC74C2A6898; _EDGE_S=F=1&SID=09B6721C09FF608E3C5C67B408E461B2; _EDGE_V=1 |
| Source: global traffic | HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.5d0f28115e15fcff20c5.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.4fa8815283fe3d88a934.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.005fa5d1a45c7a2d7a6d.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.712fce86a817d16b2c92.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /resolver/api/resolve/v3/config/?expType=AppConfig&expInstance=default&apptype=edgeChromium&v=20250306.449&targetScope={%22audienceMode%22:%22adult%22,%22browser%22:{%22browserType%22:%22edgeChromium%22,%22version%22:%2294%22,%22ismobile%22:%22false%22},%22deviceFormFactor%22:%22desktop%22,%22domain%22:%22ntp.msn.com%22,%22locale%22:{%22content%22:{%22language%22:%22en%22,%22market%22:%22us%22},%22display%22:{%22language%22:%22en%22,%22market%22:%22us%22}},%22ocid%22:%22MNHP_U531%22,%22os%22:%22windows%22,%22platform%22:%22web%22,%22pageType%22:%22dhp%22,%22pageExperiments%22:[%22prg-c-adspfpv%22,%22prg-hometo-hpmsn%22,%22prg-hp-switchfeed%22,%22prg-update-hide%22]} HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8sec-ch-ua-model: rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 1.25sec-ch-ua-bitness: "64"ect: 3gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; sptmarket=en-US||us|en-us|en-us|en||cf=8|RefA=CE27969BA8D74822BE092FFEAAAF385A.RefC=2025-03-07T16:50:12Z; USRLOC=; MUID=0DDB686F4DAE69E20AF07DC74C2A6898; MUIDB=0DDB686F4DAE69E20AF07DC74C2A6898; _EDGE_S=F=1&SID=09B6721C09FF608E3C5C67B408E461B2; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=a977fbce-5f22-43a4-bd6f-4313a19b6779 |
| Source: global traffic | HTTP traffic detected: GET /c.gif?rnd=1741366219690&udc=true&pg.n=default&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ce27969ba8d74822be092ffeaaaf385a&activityId=ce27969ba8d74822be092ffeaaaf385a&d.imd=false&scr=1920x1080&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; USRLOC=; MUID=0DDB686F4DAE69E20AF07DC74C2A6898; _EDGE_S=F=1&SID=09B6721C09FF608E3C5C67B408E461B2; _EDGE_V=1 |
| Source: global traffic | HTTP traffic detected: GET /b?rn=1741366219690&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0DDB686F4DAE69E20AF07DC74C2A6898&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /b2?rn=1741366219690&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0DDB686F4DAE69E20AF07DC74C2A6898&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: UID=1C47a50091fdbfff61fd4501741366220 |
| Source: global traffic | HTTP traffic detected: GET /c.gif?rnd=1741366219690&udc=true&pg.n=default&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ce27969ba8d74822be092ffeaaaf385a&activityId=ce27969ba8d74822be092ffeaaaf385a&d.imd=false&scr=1920x1080&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=7E37932775ED4049B307204B663D93FA&MUID=0DDB686F4DAE69E20AF07DC74C2A6898 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0DDB686F4DAE69E20AF07DC74C2A6898; _EDGE_S=F=1&SID=09B6721C09FF608E3C5C67B408E461B2; _EDGE_V=1; SM=T |
| Source: global traffic | HTTP traffic detected: GET /sg/msn/1/cm?taboola_hm=0DDB686F4DAE69E20AF07DC74C2A6898&gdpr=0&gdpr_consent= HTTP/1.1Host: trc.taboola.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /cksync.php?type=nms&cs=3&ovsid=0DDB686F4DAE69E20AF07DC74C2A6898&gdpr=0&gdpr_consent= HTTP/1.1Host: hbx.media.netConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /m?cdsp=516415&c=0DDB686F4DAE69E20AF07DC74C2A6898&mode=inverse&msn_src=ntp&&gdpr=0&gdpr_consent= HTTP/1.1Host: cm.mgid.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /uidmappixel?ext_uid=0DDB686F4DAE69E20AF07DC74C2A6898&pname=MSN&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.outbrain.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /mapuid?suid=0DDB686F4DAE69E20AF07DC74C2A6898&sid=16&gdpr=0&gdpr_consent= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /sync/msn?gdpr=0&gdpr_consent= HTTP/1.1Host: pr-bh.ybp.yahoo.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/1.1Host: px.ads.linkedin.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept: */*Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US||us|en-us|en-us|en||cf=8|RefA=CE27969BA8D74822BE092FFEAAAF385A.RefC=2025-03-07T16:50:12Z; USRLOC=; MUID=0DDB686F4DAE69E20AF07DC74C2A6898; MUIDB=0DDB686F4DAE69E20AF07DC74C2A6898; _EDGE_S=F=1&SID=09B6721C09FF608E3C5C67B408E461B2; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=a977fbce-5f22-43a4-bd6f-4313a19b6779; ai_session=U3AHhvkvWqkroU9hfsRIm7|1741366219682|1741366219682; sptmarket_restored=en-US||us|en-us|en-us|en||cf=8|RefA=CE27969BA8D74822BE092FFEAAAF385A.RefC=2025-03-07T16:50:12Z; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D |
| Source: global traffic | HTTP traffic detected: GET /edge/ntp?locale=en-US&title=New+tab&OCID=MNHP_U531&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8sec-ch-ua-model: rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 3.8sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US||us|en-us|en-us|en||cf=8|RefA=CE27969BA8D74822BE092FFEAAAF385A.RefC=2025-03-07T16:50:12Z; USRLOC=; MUID=0DDB686F4DAE69E20AF07DC74C2A6898; MUIDB=0DDB686F4DAE69E20AF07DC74C2A6898; _EDGE_S=F=1&SID=09B6721C09FF608E3C5C67B408E461B2; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=a977fbce-5f22-43a4-bd6f-4313a19b6779; ai_session=U3AHhvkvWqkroU9hfsRIm7|1741366219682|1741366219682; sptmarket_restored=en-US||us|en-us|en-us|en||cf=8|RefA=CE27969BA8D74822BE092FFEAAAF385A.RefC=2025-03-07T16:50:12Z; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D |
| Source: global traffic | HTTP traffic detected: GET /sync?ssp=msn&id=0DDB686F4DAE69E20AF07DC74C2A6898&gdpr=0&gdpr_consent= HTTP/1.1Host: code.yengo.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /visitor/sync?uid=9871605be8d4b2a982914bf5c9348e7b&name=MSN&visitor=0DDB686F4DAE69E20AF07DC74C2A6898&external=true&gdpr=0&gdpr_consent= HTTP/1.1Host: visitor.omnitagjs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /cs/msn?id=0DDB686F4DAE69E20AF07DC74C2A6898&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.mediago.ioConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /notify/served?rid=ce27969ba8d74822be092ffeaaaf385a&r=river&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=7af2a3f4-e29e-46f6-8bb1-bb526b3dff9b&ii=1&c=13632534912796677099&bid=bef813bc-b568-41df-9b1e-3d66353a0ada&tid=edgechrntp-river-1&ptid=edgechrntp-peekriver-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0DDB686F4DAE69E20AF07DC74C2A6898; _EDGE_S=F=1&SID=09B6721C09FF608E3C5C67B408E461B2; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D |
| Source: global traffic | HTTP traffic detected: GET /oRTB?redirect={PubRedirectUrl}&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /notify/served?rid=ce27969ba8d74822be092ffeaaaf385a&r=resriver&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=0230aa10-aefe-4507-a806-0ed773d001f4&ii=1&c=16708633625282948573&bid=bef813bc-b568-41df-9b1e-3d66353a0ada&tid=edgechrntp-resriver-1&ptid=edgechrntp-resriver-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0DDB686F4DAE69E20AF07DC74C2A6898; _EDGE_S=F=1&SID=09B6721C09FF608E3C5C67B408E461B2; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D |
| Source: global traffic | HTTP traffic detected: GET /getuid?https://c.bing.com/c.gif?anx_uid=$UID&Red3=MSAN_pd&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /cs/msn?id=0DDB686F4DAE69E20AF07DC74C2A6898&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.popin.ccConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /mapuid?member=280&user=0DDB686F4DAE69E20AF07DC74C2A6898;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0DDB686F4DAE69E20AF07DC74C2A6898%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc.bing.com%2Fc.gif%3Fanx_uid%3D%24UID%26Red3%3DMSAN_pd%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D0DDB686F4DAE69E20AF07DC74C2A6898%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D0DDB686F4DAE69E20AF07DC74C2A6898%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /sync?redirect=%7BPubRedirectUrl%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry= HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /notify/served?rid=ce27969ba8d74822be092ffeaaaf385a&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=7be4f360-7a45-4690-9827-f98ea0750a81&ii=1&c=4886528655992380158&bid=0dc69f93-1809-4c34-890e-36ab305fca5b&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0DDB686F4DAE69E20AF07DC74C2A6898; _EDGE_S=F=1&SID=09B6721C09FF608E3C5C67B408E461B2; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D; _C_Auth=; sptmarket=en-us||us|en-us|en-us|en||cf=8|RefA=1309CA76ED03451A921A0B8E388ABE7F.RefC=2025-03-07T16:50:24Z; MUIDB=0DDB686F4DAE69E20AF07DC74C2A6898 |
| Source: global traffic | HTTP traffic detected: GET /notify/served?rid=ce27969ba8d74822be092ffeaaaf385a&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=61926c86-c943-4aaa-9700-8c55594c9cc6&ii=1&c=8361246589242145283&bid=0dc69f93-1809-4c34-890e-36ab305fca5b&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0DDB686F4DAE69E20AF07DC74C2A6898; _EDGE_S=F=1&SID=09B6721C09FF608E3C5C67B408E461B2; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D; _C_Auth=; sptmarket=en-us||us|en-us|en-us|en||cf=8|RefA=1309CA76ED03451A921A0B8E388ABE7F.RefC=2025-03-07T16:50:24Z; MUIDB=0DDB686F4DAE69E20AF07DC74C2A6898 |
| Source: global traffic | HTTP traffic detected: GET /notify/served?rid=ce27969ba8d74822be092ffeaaaf385a&r=infopane&i=15&p=edgechrntp&l=en-us&d=bing&b=Edg&a=c2d5071e-7ea2-4638-95e9-9e3dc320cc86&ii=1&c=15962976797232155595&bid=0dc69f93-1809-4c34-890e-36ab305fca5b&tid=edgechrntp-infopane-15&ptid=edgechrntp-peekinfopane-3&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0DDB686F4DAE69E20AF07DC74C2A6898; _EDGE_S=F=1&SID=09B6721C09FF608E3C5C67B408E461B2; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D; _C_Auth=; sptmarket=en-us||us|en-us|en-us|en||cf=8|RefA=1309CA76ED03451A921A0B8E388ABE7F.RefC=2025-03-07T16:50:24Z; MUIDB=0DDB686F4DAE69E20AF07DC74C2A6898 |
| Source: global traffic | HTTP traffic detected: GET /notify/served?rid=ce27969ba8d74822be092ffeaaaf385a&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=80005825-8f03-421c-96d9-39c079d8b6a8&ii=1&c=7461836026324319374&bid=0dc69f93-1809-4c34-890e-36ab305fca5b&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0DDB686F4DAE69E20AF07DC74C2A6898; _EDGE_S=F=1&SID=09B6721C09FF608E3C5C67B408E461B2; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D; _C_Auth=; sptmarket=en-us||us|en-us|en-us|en||cf=8|RefA=1309CA76ED03451A921A0B8E388ABE7F.RefC=2025-03-07T16:50:24Z; MUIDB=0DDB686F4DAE69E20AF07DC74C2A6898 |
| Source: global traffic | HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D0DDB686F4DAE69E20AF07DC74C2A6898%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0DDB686F4DAE69E20AF07DC74C2A6898%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /mapuid?member=280&user=0DDB686F4DAE69E20AF07DC74C2A6898&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0DDB686F4DAE69E20AF07DC74C2A6898%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D0DDB686F4DAE69E20AF07DC74C2A6898%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D0DDB686F4DAE69E20AF07DC74C2A6898%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D0DDB686F4DAE69E20AF07DC74C2A6898%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /setuid?entity=483&code=0DDB686F4DAE69E20AF07DC74C2A6898&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /bounce?%2Fsetuid%3Fentity%3D483%26code%3D0DDB686F4DAE69E20AF07DC74C2A6898%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0DDB686F4DAE69E20AF07DC74C2A6898%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /setuid?entity=483&code=0DDB686F4DAE69E20AF07DC74C2A6898&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /bounce?%2Fsetuid%3Fentity%3D483%26code%3D0DDB686F4DAE69E20AF07DC74C2A6898%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: curcuma.exe, 00000025.00000003.1739334877.0000012CDEE27000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: "pushengage.com"},{"applied_policy":"prompt","domain":"www.timesnownews.com"},{"applied_policy":"prompt","domain":"www.couponrani.com"},{"applied_policy":"prompt","domain":"www.wholesomeyum.com"},{"applied_policy":"prompt","domain":"www.asklaila.com"},{"applied_policy":"prompt","domain":"www.sammobile.com"},{"applied_policy":"prompt","domain":"www.ecuavisa.com"},{"applied_policy":"prompt","domain":"uz.sputniknews.ru"},{"applied_policy":"prompt","domain":"www.ndtv.com"},{"applied_policy":"prompt","domain":"www.elimparcial.com"},{"applied_policy":"prompt","domain":"www.povarenok.ru"},{"applied_policy":"prompt","domain":"www.estadao.com.br"},{"applied_policy":"prompt","domain":"olxpakistan.os.tc"},{"applied_policy":"prompt","domain":"televisa.com"},{"applied_policy":"prompt","domain":"uol.com.br"},{"applied_policy":"prompt","domain":"www.axisbank.com"},{"applied_policy":"prompt","domain":"mutualfund.adityabirlacapital.com"},{"applied_policy":"prompt","domain":"www.facebook.com"},{"applied_policy":"prompt","domain":"www.instagram.com"},{"applied_policy":"prompt","domain":"www.messenger.com"}],"policies":[{"name":"prompt","reason":"","type":"","value":""}],"version":1}},"fre":{"autoimport_spartan_visible_item_completed":true,"oem_bookmarks_set":true,"should_user_see_fre_banner":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default"},"hardware_acceleration_mode_previous":true,"is_dsp_recommended":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"Default":{"migration_attempt":0,"migration_version":4},"last_edgeuwp_pin_migration_on_edge_version":"94.0.992.31","last_edgeuwp_pin_migration_on_os_version":"10 Version 20H2 (Build 19042.1165)","last_edgeuwp_pin_migration_success":false},"network_primary_browser":{"browser_name_enum":1,"last_computed_time":"13276780388565220","network_usage":{"browser_with_highest_network_usage":1,"browsers_usage":{"1":100.0},"ie":0}},"network_time":{"network_time_mapping":{"local":1.691263997088662e+12,"network":1.691260396e+12,"ticks":126914944.0,"uncertainty":1220870.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAb7qWBj3YRSZSg2yN3JOzDEAAAAAoAAABFAGQAZwBlAAAAEGYAAAABt~r equals www.facebook.com (Facebook) |
| Source: curcuma.exe, 00000025.00000003.1829527739.0000012CDEEC3000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: @bing.com/videos/search www.facebook.com equals www.facebook.com (Facebook) |
| Source: curcuma.exe, 00000025.00000003.1829527739.0000012CDEEC3000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: bing.com/videos/search www.facebook.com equals www.facebook.com (Facebook) |
| Source: curcuma.exe, 00000025.00000003.1803130341.0000012CDEEC0000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: ditu.live.com https://dev.virtualearth.net/REST/v1/Routes/ https://dev.ditu.live.com/REST/v1/Routes/ https://dev.virtualearth.net/REST/v1/Locations/ https://dev.ditu.live.com/REST/v1/Locations/ browser.events.data.microsoft.com ib.msn.com https://proxy.uet.s.microsoft.com/tpv-dv/;default-src 'none';font-src 'self' data: assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-src https://api.msn.com/auth/cookie/silentpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.com;img-src https://* blob: chrome-search://ntpicon/ chrome-search://local-ntp/ chrome-search://theme/ data:;media-src 'self' blob: *.mavideo.microsoft.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn https://sapphire.azureedge.net th.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn video.yidianzixun.com liveshopping.azureedge.net;report-to csp-endpoint;require-trusted-types-for 'script';style-src 'self' 'unsafe-inline' c.s-microsoft.com/mscc/ assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;trusted-types serviceWorkerUrlPolicy baw-trustedtypes-policy svgPassThroughPolicy xmlPassThroughPolicy webpackTrustedTypesPolicy webWorkerUrlPolicy inlineHeadCssPassthroughPolicy bundleUrlPolicy fallbackBundleUrlPolicy scriptSrcUrlPolicy commonAsScriptPolicy dompurify fast-html base-html-policy ot-trusted-type-policy default 'allow-duplicates' IasUrlPolicy DvUrlPolicy;worker-src 'self' blob: 'report-sample';script-src 'nonce-3AtRQJCJTaCvAW3r8IbXW552FO059JGHecXNKsPqyDo=' 'strict-dynamic' equals www.facebook.com (Facebook) |
| Source: curcuma.exe, 00000025.00000003.1803130341.0000012CDEEC0000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: ditu.live.com https://dev.virtualearth.net/REST/v1/Routes/ https://dev.ditu.live.com/REST/v1/Routes/ https://dev.virtualearth.net/REST/v1/Locations/ https://dev.ditu.live.com/REST/v1/Locations/ browser.events.data.microsoft.com ib.msn.com https://proxy.uet.s.microsoft.com/tpv-dv/;default-src 'none';font-src 'self' data: assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-src https://api.msn.com/auth/cookie/silentpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.com;img-src https://* blob: chrome-search://ntpicon/ chrome-search://local-ntp/ chrome-search://theme/ data:;media-src 'self' blob: *.mavideo.microsoft.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn https://sapphire.azureedge.net th.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn video.yidianzixun.com liveshopping.azureedge.net;report-to csp-endpoint;require-trusted-types-for 'script';style-src 'self' 'unsafe-inline' c.s-microsoft.com/mscc/ assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;trusted-types serviceWorkerUrlPolicy baw-trustedtypes-policy svgPassThroughPolicy xmlPassThroughPolicy webpackTrustedTypesPolicy webWorkerUrlPolicy inlineHeadCssPassthroughPolicy bundleUrlPolicy fallbackBundleUrlPolicy scriptSrcUrlPolicy commonAsScriptPolicy dompurify fast-html base-html-policy ot-trusted-type-policy default 'allow-duplicates' IasUrlPolicy DvUrlPolicy;worker-src 'self' blob: 'report-sample';script-src 'nonce-3AtRQJCJTaCvAW3r8IbXW552FO059JGHecXNKsPqyDo=' 'strict-dynamic' equals www.youtube.com (Youtube) |
| Source: curcuma.exe, 00000025.00000003.1803130341.0000012CDEEC0000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: ditu.live.com https://dev.virtualearth.net/REST/v1/Routes/ https://dev.ditu.live.com/REST/v1/Routes/ https://dev.virtualearth.net/REST/v1/Locations/ https://dev.ditu.live.com/REST/v1/Locations/ browser.events.data.microsoft.com ib.msn.com https://proxy.uet.s.microsoft.com/tpv-dv/;default-src 'none';font-src 'self' data: assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-src https://api.msn.com/auth/cookie/silentpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.com;img-src https://* blob: chrome-search://ntpicon/ chrome-search://local-ntp/ chrome-search://theme/ data:;media-src 'self' blob: *.mavideo.microsoft.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn https://sapphire.azureedge.net th.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn video.yidianzixun.com liveshopping.azureedge.net;report-to csp-endpoint;require-trusted-types-for 'script';style-src 'self' 'unsafe-inline' c.s-microsoft.com/mscc/ assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;trusted-types serviceWorkerUrlPolicy baw-trustedtypes-policy svgPassThroughPolicy xmlPassThroughPolicy webpackTrustedTypesPolicy webWorkerUrlPolicy inlineHeadCssPassthroughPolicy bundleUrlPolicy fallbackBundleUrlPolicy scriptSrcUrlPolicy commonAsScriptPolicy dompurify fast-html base-html-policy ot-trusted-type-policy default 'allow-duplicates' IasUrlPolicy DvUrlPolicy;worker-src 'self' blob: 'report-sample';script-src 'nonce-3AtRQJCJTaCvAW3r8IbXW552FO059JGHecXNKsPqyDo=' 'strict-dynamic'@ equals www.facebook.com (Facebook) |
| Source: curcuma.exe, 00000025.00000003.1803130341.0000012CDEEC0000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: ditu.live.com https://dev.virtualearth.net/REST/v1/Routes/ https://dev.ditu.live.com/REST/v1/Routes/ https://dev.virtualearth.net/REST/v1/Locations/ https://dev.ditu.live.com/REST/v1/Locations/ browser.events.data.microsoft.com ib.msn.com https://proxy.uet.s.microsoft.com/tpv-dv/;default-src 'none';font-src 'self' data: assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-src https://api.msn.com/auth/cookie/silentpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.com;img-src https://* blob: chrome-search://ntpicon/ chrome-search://local-ntp/ chrome-search://theme/ data:;media-src 'self' blob: *.mavideo.microsoft.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn https://sapphire.azureedge.net th.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn video.yidianzixun.com liveshopping.azureedge.net;report-to csp-endpoint;require-trusted-types-for 'script';style-src 'self' 'unsafe-inline' c.s-microsoft.com/mscc/ assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;trusted-types serviceWorkerUrlPolicy baw-trustedtypes-policy svgPassThroughPolicy xmlPassThroughPolicy webpackTrustedTypesPolicy webWorkerUrlPolicy inlineHeadCssPassthroughPolicy bundleUrlPolicy fallbackBundleUrlPolicy scriptSrcUrlPolicy commonAsScriptPolicy dompurify fast-html base-html-policy ot-trusted-type-policy default 'allow-duplicates' IasUrlPolicy DvUrlPolicy;worker-src 'self' blob: 'report-sample';script-src 'nonce-3AtRQJCJTaCvAW3r8IbXW552FO059JGHecXNKsPqyDo=' 'strict-dynamic'@ equals www.youtube.com (Youtube) |
| Source: curcuma.exe, 00000025.00000003.1803417504.0000012CDEE2A000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: extURLsOnly","domain":"slack.com"},{"applied_policy":"PlainTextURLsOnly","domain":"facebook.com"},{"applied_policy":"PlainTextURLsOnly","domain":"wechat.com"},{"applied_policy":"PlainTextURLsOnly","domain":"weixin.com"},{"applied_policy":"PlainTextURLsOnly","domain":"qq.com"},{"applied_policy":"PlainTextURLsOnly","domain":"webex.com"},{"applied_policy":"PlainTextURLsOnly","domain":"wordpress.com"},{"applied_policy":"PlainTextURLsOnly","domain":"twitter.com"},{"applied_policy":"PlainTextURLsOnly","domain":"discord.com"}],"policies":[{"name":"PlainTextURLsOnly","type":"ECPOnlyPlaintextURLs"}],"version":1},"idl_override":{"applications":[{"applied_policy":"ExposePrefixedEME","domain":"netflix.com"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.co.jp"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.co.uk"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.com"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.de"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.es"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.fr"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.in"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.it"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.ca"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.com.br"},{"applied_policy":"ExposePrefixedEME","domain":"sling.com"},{"applied_policy":"ExposePrefixedEME","domain":"openidconnectweb.azurewebsites.net"}],"policies":[{"name":"ExposePrefixedEME","type":"PrefixedEme"}],"version":1},"media_foundation_override":{"applications":[{"applied_policy":"OptIn","domain":"youtube.com","path_exclude":["/shorts","/kids"],"subdomain_exclude":["tv.youtube.com","studio.youtube.com","vr.youtube.com"]}],"policies":[{"name":"OptIn","type":"MediaFoundationOptIn"},{"name":"OptOut","type":"MediaFoundationOptOut"}],"version":1},"web_notification_override":{"applications":[{"applied_policy":"prompt","domain":"www.reddit.com"},{"applied_policy":"prompt","domain":"www.telegraphindia.com"},{"applied_policy":"prompt","domain":"timesofindia.indiatimes.com"},{"applied_policy":"prompt"," equals www.youtube.com (Youtube) |
| Source: curcuma.exe, 00000025.00000003.1829527739.0000012CDEEC3000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: ive/cognitiveservices/ www.bing.com/fd/ls/ls.gif www.msn.com www.msn.cn www.microsoftstart.com cn.bing.com/api/ cn.bing.com/bnc/ cn.bing.com/pnp/ cn.bing.com/profile/interestmanager/update *.cn.mm.bing.net *.mm.cn.bing.net www.bing.com/HPImageArchive.aspx www.bing.com/api/custom/opal/reco/ www.bing.com/DSB cn.bing.com/DSB www.bing.com/DSB/partner/ cn.bing.com/DSB/partner/ www.bing.com/api/ www.bing.com/as/ www.bing.com/AS/Suggestions www.bing.com/AS/Suggestions/v2 www.bing.com/bnc/ www.bing.com/crop/warmer.png www.bing.com/historyHandler www.bing.com/images/sbidlg www.bing.com/pnp/ www.bing.com/profile/history/data www.bing.com/profile/interestmanager/update www.bing.com/retail/msn/api/shopcard www.bing.com/retailexp/msn/api/ www.bing.com/retailexpdata/msndata/ www.bing.com/rp/rms_pr.png www.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn msn-api.go2yd.com zerocodecms.blob.core.windows.net *.oneservice.msn.com *.oneservice.msn.cn api.msn.com api.msn.cn ent-api.msn.com ent-api.msn.cn ent-nf-api.msn.com ent-nf-api.msn.cn ppe-api.msn.com ppe-api.msn.cn graph.microsoft.com/beta/ graph.microsoft.com/v1.0/ https://*.vo.msecnd.net https://user.auth.xboxlive.com/user/authenticate https://xsts.auth.xboxlive.com/xsts/authorize https://titlehub.xboxlive.com/users/ https://t.ssl.ak.dynamic.tiles.virtualearth.net https://dynamic.t0.tiles.ditu.live.com https://dev.virtualearth.net/REST/v1/Routes/ https://dev.ditu.live.com/REST/v1/Routes/ https://dev.virtualearth.net/REST/v1/Locations/ https://dev.ditu.live.com/REST/v1/Locations/ browser.events.data.microsoft.com ib.msn.com https://proxy.uet.s.microsoft.com/tpv-dv/;default-src 'none';font-src 'self' data: assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-src https://api.msn.com/auth/cookie/silentpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.com;img-src https://* blob: chrome-search://ntpicon/ chrome-search://local-ntp/ chrome-search://theme/ data:;media-src 'self' blob: *.mavideo.mic |
Edit tour
ADFoyxP.exe (PID: 2068 cmdline: 
cmd.exe (PID: 5876 cmdline: 
expand.exe (PID: 708 cmdline: 
Seat.com (PID: 7468 cmdline: 
powershell.exe (PID: 8416 cmdline: 
chrome.exe (PID: 8680 cmdline: 
msedge.exe (PID: 2312 cmdline: 
wscript.exe (PID: 8432 cmdline: 
