Edit tour

Windows Analysis Report
http://gossnabgroup.ru

Overview

General Information

Sample URL:	http://gossnabgroup.ru
Analysis ID:	1405276
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Phishing site detected (based on OCR NLP Model)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5084 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2284,i,3100902536086182891,1735761918452591964,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6428 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://gossnabgroup.ru MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: winrenew-cash.life	Virustotal: Detection: 11%			Perma Link
Source: js.nextpsh.top	Virustotal: Detection: 9%			Perma Link

Phishing

Phishing site detected (based on OCR NLP Model)

Source: Chrome DOM

ML Model on OCR Text: Matched 90.0% probability on "To access the video, press "Allow". 0010M "

Source: https://storage.multstorage.com/log/count.html	HTTP Parser: No favicon
Source: about:blank	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0&co=aHR0cHM6Ly9wbGF5Lmdvb2dsZS5jb206NDQz&hl=en&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=yqeeu9fajvsp	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0&co=aHR0cHM6Ly9wbGF5Lmdvb2dsZS5jb206NDQz&hl=en&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=sirx2au0vxlj	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0&co=aHR0cHM6Ly9wbGF5Lmdvb2dsZS5jb206NDQz&hl=en&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=xepm3o2k6jm	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0&co=aHR0cHM6Ly9wbGF5Lmdvb2dsZS5jb206NDQz&hl=en&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=jw8ii2jdejpu	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.4:49741 version: TLS 1.2

Source:	Binary string: _.rW=function(a,b,c,d,e,f,g,h,k,m,n,q,t,v){v=void 0===v?!0:v;b.open("div","smLXwe");b.ka(DEb\|\|(DEb=["class","u4ICaf"]));b.W();b.T("tmR7Db");AEb(a,b,c,e,"MjT6xe sOCCfd "+(m?"gw1rab":n?"brKGGd":"HNnJkb")+" "+(f?f:"BhQfub"),k,d,t,g,q,h,v);b.V();b.Ga()};_.AW=function(a,b,c,d,e,f,g,h,k,m,n,q,t,v){v=void 0===v?!0:v;b.open("div","bEM52");b.ka(EEb\|\|(EEb=["class","u4ICaf"]));b.W();b.T("uBWc4d");_.Pdb(a,b,c,d,"MjT6xe ymHpFd "+(m?"gw1rab":n?"brKGGd":"HNnJkb")+" "+(e?e:"aLey0c"),k,f,t,g,q,h,v);b.V();b.Ga()}; source: chromecache_207.2.dr, chromecache_300.2.dr, chromecache_345.2.dr, chromecache_253.2.dr
Source:	Binary string: _.k5=function(a,b,c,d,e,f){!e\|\|(void 0===d?0:d)?(b.T("r8zipf"),_.Pdb(a,b,c,void 0,"LMoCf",!0,void 0,void 0,void 0,void 0,f)):(b.T("rr2wrc"),_.Sdb(a,b,c,(0,_.vo)(""+_.h0(a,e)),void 0,void 0,void 0,"LMoCf",void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,f));b.V()}; source: chromecache_251.2.dr
Source:	Binary string: "true")}),a.T("XbYgOd"),zdb(a,c??"",K),a.V(),t&&_.Z(q)&&a.print(q),a.T("UIJ8Od"),Edb(a,d??_.Fo(c),y,D,C,J,Ea,ua),a.V(),_.Z(ca)&&0===wa?a.print(ca):(a.open("div","wKiB1e"),a.ka(Odb\|\|(Odb=["class","VfPpkd-J1Ukfc-LhBDec"])),a.W(),a.close()));a.Ga()};udb=class extends _.UN{jc(){return this.data.label}Kd(){return this.data.ariaLabel}yd(){return this.data.disabled}Wa(){return this.data.icon}O(){return this.data.Jr}mf(){return this.data.attributes}H(){let a=this.data.Ir;return void 0===a?!1:a}};var Tdb,Rdb;_.Pdb=function(a,b,c,d,e,f,g,h,k,m,n,q){const t=void 0===q?!1:q;var v=void 0===v?!0:v;b.print(_.Y(z=>{var y="Rj2Mlf OLiIxf PDpWxe"+(null!=g?"":" P62QJc");y+=v?" LQeN7":"";y+=e?" "+e:"";const D=_.ON(C=>{_.Z(n)&&_.PN(C,_.eO(n))});z.T("L3cYdc");_.pO(a,z,c,d,void 0,y,void 0,!0,f,g,h,k,D,m,1,t);z.V()}))}; source: chromecache_297.2.dr, chromecache_266.2.dr, chromecache_235.2.dr, chromecache_378.2.dr

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: gossnabgroup.ruConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ps/ps.js?id=Ph8jYmrE70ufzXRCoxphlw HTTP/1.1Host: js.nextpsh.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /b313026a748183b52dfbacb3ef471b45.js HTTP/1.1Host: bddb2d2561.62b81f5af3.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://gossnabgroup.rusec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3572bcc7be69f5109a8d2b0b8fa39de1/151659?version_name=a HTTP/1.1Host: bddb2d2561.62b81f5af3.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://gossnabgroup.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /advertising.js HTTP/1.1Host: js.capndr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /11716c69a3d9e5ab14e0d555a9e69583.js HTTP/1.1Host: bddb2d2561.62b81f5af3.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log/count.html HTTP/1.1Host: storage.multstorage.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npc/sdk/push.m.js?v=1 HTTP/1.1Host: js.wpshsdk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3572bcc7be69f5109a8d2b0b8fa39de1/151659?version_name=a HTTP/1.1Host: bddb2d2561.62b81f5af3.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiIxNjg1NzA5Njk2NDQ4MjUzNTAwMCIsInRpbWV6b25lIjoxLCJ2ZXIiOiIzLjExMC4wIiwidGFnX2lkIjoxNTE2NTksInNjcmVlbl9yZXNvbHV0aW9uIjoiMTI4MHgxMDI0IiwiYWRibG9jayI6MCwidGltZXpvbmVfb2xzb24iOiJFdXJvcGUvWnVyaWNoIiwidXRtX3NvdXJjZSI6IiIsInV0bV9tZWRpdW0iOiIiLCJ1dG1fY2FtcGFpZ24iOiIiLCJ1dG1fY29udGVudCI6IiIsIm1tIjowLCJpbml0X3N0YXJ0X2xhdGVuY3kiOjEuMTUsImlzX3YyIjowLCJpc192Ml9lbXB0eSI6MCwidXNlcl9rZXl3b3JkcyI6IlZpZGVvIn0= HTTP/1.1Host: e1f6a352a1.3ea94c3718.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://gossnabgroup.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ps/XE4Wwo.js HTTP/1.1Host: gossnabgroup.ruConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://gossnabgroup.ru/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /9dc01d48437911a2369d0f0f8dd84903.js HTTP/1.1Host: bddb2d2561.62b81f5af3.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /in/dip?site=native-push&wl=0&event_id=164a9abc-e866-4104-adc5-0a55b6680b4b&subid=2083435515&sid=309884947&spot_id=513500&created_at=2024-03-08&timezone=1&ver=8.149.0&is_native=1 HTTP/1.1Host: nereserv.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://gossnabgroup.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiIxNjg1NzA5Njk2NDQ4MjUzNTAwMCIsInRpbWV6b25lIjoxLCJ2ZXIiOiIzLjExMC4wIiwidGFnX2lkIjoxNTE2NTksInNjcmVlbl9yZXNvbHV0aW9uIjoiMTI4MHgxMDI0IiwiYWRibG9jayI6MCwidGltZXpvbmVfb2xzb24iOiJFdXJvcGUvWnVyaWNoIiwidXRtX3NvdXJjZSI6IiIsInV0bV9tZWRpdW0iOiIiLCJ1dG1fY2FtcGFpZ24iOiIiLCJ1dG1fY29udGVudCI6IiIsIm1tIjowLCJpbml0X3N0YXJ0X2xhdGVuY3kiOjEuMTUsImlzX3YyIjowLCJpc192Ml9lbXB0eSI6MCwidXNlcl9rZXl3b3JkcyI6IlZpZGVvIn0= HTTP/1.1Host: e1f6a352a1.3ea94c3718.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ps/sw.js HTTP/1.1Host: sw.wpushorg.comConnection: keep-aliveCache-Control: max-age=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /in/dip?site=native-push&wl=0&event_id=164a9abc-e866-4104-adc5-0a55b6680b4b&subid=2083435515&sid=309884947&spot_id=513500&created_at=2024-03-08&timezone=1&ver=8.149.0&is_native=1 HTTP/1.1Host: nereserv.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fp?tag_id=151659 HTTP/1.1Host: fp.metricswpsh.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id=13089211365690299045
Source: global traffic	HTTP traffic detected: GET /npc/sdk/common/config.js HTTP/1.1Host: js.wpshsdk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Origin: https://gossnabgroup.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npc/sdk/common/core.js HTTP/1.1Host: js.wpshsdk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Origin: https://gossnabgroup.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /in/show/?tag_ab=a&site_id=31513500&adblock=0&testab=0&auction_host=&mm=0&yc=0&render_type=hq&pr=&banner_width=300&banner_height=100&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fgossnabgroup.ru%2F&refdom=gossnabgroup.ru&auction_time=1709885533&subid=2083435515&sid=309884947&tcid=0&ver=8.149.0&ver_c=&spot_id=513500&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-03-08&iabcat=IAB24-24&keywords=&user_fp=15589701474715202908&score=94.35555979594042&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D2083435515%26spot_id%3D513500%26is_adult%3D0%26p%3Dhttps%253A%252F%252Fgossnabgroup.ru%252F%26idzone%3D0%26sid%3D1885&is_cpm=0&resp_type=&crid=&crtid=b0681ff5c1739e7f8bdbb8527f77d810&url=https%3A%2F%2Feu.vilitram.com%2Fnty%2Fpostback%2Fclick%3Fkey%3Dv2-1709885533544-4-9731-1323166-801b07bb-f738-902a-80df-95680bda40a0&icons=0ZiyhCFIKAt-wGRriVT-_bbKIFjf6GtwYW-kujg_0U9Tvn_ko2YqpSClkK5TdoTalLZM-LsLrL_7rCywqygREjQK1VoGGC9OWu07H1N8vQ5eptV08ydgxSmjWoMcjq-Ugr0UXcfygI3UYv7_cD-oaxnH0rtOfXeAVU1LZws3rzQQ_fkA3g&ext_cid=0&px_id=53513500&min_cpm=0.010549713970892063&out_id=1&campaign_type=lq-pop&aid=3251&cid=12972&uniq=74b7e0d16e9c425032c044b987fe63b0cd84369eb30f462bd789bb288897fdb4&mid=6306908347043061180&skin_id=2&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.01630225445775319&cpm=0&verify_hash=a30abf33d9abe6aab011c99b8c5ee8b0&is_native=2&real_bid=0.00013379028046131208&original_bid_usd=0.0001668&original_bid=0.0001668&exp=240&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&ip_mismatch=154.16.105.38&geo=US&carrier=-&label_ids=83,89,27,20,108,0&need_redirect_show=0&applied_features=main-skins-settings,coef_098&show_count=1&expiration_timestamp=1709957533&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FSG%2FSG_083be47dfc3e28c9a68305b76181a5033bc45790.webp&site=native-push-mainstream&price=0.0001668&hostname=auc-inpage-hz-5-a&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=Europe/Zurich&topics=&historical_keywords=&pop_cpc=0.0000001668&ext_campaign_id_str=&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-b_r-body&mlf=1&mlc=1&st=0.11&cpa=a29659e7-7a4e-4dab-a245-833102ce2087&prev_step_diff=4097 HTTP/1.1Host: e32350d110.84bfe218ba.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /creatives/SG/SG_083be47dfc3e28c9a68305b76181a5033bc45790_icon.webp?pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-b_r-body&mlf=1&mlc=1&st=0.11&cpa=446c008d-62f6-43d5-8007-6b0144ac2eaf&prev_step_diff=4097 HTTP/1.1Host: static.bookmsg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /in/show/?tag_ab=a&site_id=31513500&adblock=0&testab=0&auction_host=&mm=0&yc=0&render_type=hq&pr=&banner_width=300&banner_height=100&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fgossnabgroup.ru%2F&refdom=gossnabgroup.ru&auction_time=1709885533&subid=2083435515&sid=309884947&tcid=0&ver=8.149.0&ver_c=&spot_id=513500&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-03-08&iabcat=IAB24-24&keywords=&user_fp=15589701474715202908&score=94.35555979594042&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D2083435515%26spot_id%3D513500%26is_adult%3D0%26p%3Dhttps%253A%252F%252Fgossnabgroup.ru%252F%26idzone%3D0%26sid%3D1885&is_cpm=0&resp_type=&crid=&crtid=ffee90ecb6dc1a17d2eb3cd0e77fbdd5&url=http%3A%2F%2Fads.ppcmate.com%2Fnty%2Fpostback%2Fclick%3Fkey%3Dv2-1709885533585-7-12019-1175748-b5d31157-1466-56b0-8695-ff0126c2348a&icons=dO3IjHAoxPEP4oiGQnMRa6m9IELNIwHLoGqK6l3HQiE4FgPcYWl4_wZSe3nTIoC9QzulGbUyOpbeBe8eS22dUnt_sf_loHWWxaVLB3WB2lNkB6DV3rr9FodIs7cicD8qd1Z92Zr64o7IA02mMc2FAWJlM44fmC4JwdoFW9Z2CSAagkDVeFSuQHC0yOIEcPqIRjBgmklyWPqg3Lnc1Gdk-thjr3OfNYX5wil-msV0pEKN6eNgUtTio3FGvVf3s4UoQ0dr2ttODZF9F17WHVjTrPc2PrJgfOWp3U36Uv_aQwUKa2jEYp_pItoJ2tLEWjnfleYFjsyr8a8QdMbTovFS-b4DW4Iv3OuMOKftEtgtpgDBFhY4JjF9keOdZp7m1ECDkABskY9sF1kP9i3PN3ExQ5_gdQ2SOpo8bSmIv9rcNfthP_-V7ar0XG_u0BZ88I3a-yIs9qmXoLP2YiZX-vgniXJzXlWM2mYUclE4lcWe7HSwjchp9rYgTTzqYJyCzyEwqEM9en-HNUjZzmsDYkPKOQvQyDNbJpsDxAR7roSY8QBE2X-sFYr_WdwlxgL6-nebvd9acg6paw&ext_cid=0&px_id=73513500&min_cpm=0.0002607245892657709&out_id=0&campaign_type=hq&aid=3774&cid=16046&uniq=31c121d268b114ae96380f2cd8f0292b3d52e889ba3d191624ed9e9e45d13a5f&mid=6306908347043061180&skin_id=2&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.015600382622377378&cpm=0&verify_hash=9a87fef304d0425db32ec725405fdb78&is_native=1&real_bid=0.00518049&original_bid_usd=0.00518049&original_bid=0.00518049&exp=720&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&ip_mismatch=154.16.105.38&geo=US&carrier=-&label_ids=0,83,90,108&need_redirect_show=0&applied_features=coef_098,main-skins-settings&show_count=1&expiration_timestamp=0&image_url=https%3A%2F%2Fcdn.stgcdn.com%2Ffiles%2F439950858060922bf976c7a20645da7a.jpg&site=native-push-mainstream&price=0.00518049&hostname=auc-inpage-hz-5-a&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=Europe/Zurich&topics=&historical_keywords=&pop_cpc=0.00000518049&ext_campaign_id_str=&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-b_r-body&st=0.11&cpa=264ba233-d9ac-425a-948f-1c04db49b270&prev_step_diff=4097 HTTP/1.1Host: e32350d110.84bfe218ba.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li
Source: global traffic	HTTP traffic detected: GET /creatives/SG/SG_083be47dfc3e28c9a68305b76181a5033bc45790.webp HTTP/1.1Host: static.bookmsg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/439950858060922bf976c7a20645da7a.jpg HTTP/1.1Host: cdn.stgcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /nty/metrics/save.img?event=impressions&bid-id=v2-1709885533585-7-12019-1175748-b5d31157-1466-56b0-8695-ff0126c2348a&country=HBoI&placement=L3pxfSx8cHl5eXErcHx7eSovL3woKHx4fSovLXp7KCw&device-type=BAYLAAUM&browser=CiE7JiQs&os-base=HiAnLSY-Og&lang=LCc&adv-bid-price=e3hneQ&pub-bid-price=fGd4cXl9cA&img=https%3A%2F%2Fcdn.stgcdn.com%2Ffiles%2F6b7c183bc5faf7a9ba96b9f945eeaf83.jpg&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-b_r-body&st=0.11&cpa=e65ee3a7-3b76-4d32-8fcc-473d9153077b&prev_step_diff=4097 HTTP/1.1Host: us.superfasti.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ps/XE4Wwo.js HTTP/1.1Host: gossnabgroup.ruConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://gossnabgroup.ru/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"65e860bc-33"If-Modified-Since: Wed, 06 Mar 2024 12:25:32 GMT
Source: global traffic	HTTP traffic detected: GET /creatives/SG/SG_083be47dfc3e28c9a68305b76181a5033bc45790_icon.webp?pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-b_r-body&mlf=1&mlc=1&st=0.11&cpa=446c008d-62f6-43d5-8007-6b0144ac2eaf&prev_step_diff=4097 HTTP/1.1Host: static.bookmsg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/6b7c183bc5faf7a9ba96b9f945eeaf83.jpg HTTP/1.1Host: cdn.stgcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /creatives/SG/SG_083be47dfc3e28c9a68305b76181a5033bc45790.webp HTTP/1.1Host: static.bookmsg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /in/multy HTTP/1.1Host: e32350d110.84bfe218ba.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /in/show/?tag_ab=a&site_id=31513500&adblock=0&testab=0&auction_host=&mm=0&yc=0&render_type=hq&pr=&banner_width=300&banner_height=100&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fgossnabgroup.ru%2F&refdom=gossnabgroup.ru&auction_time=1709885533&subid=2083435515&sid=309884947&tcid=0&ver=8.149.0&ver_c=&spot_id=513500&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-03-08&iabcat=IAB24-24&keywords=&user_fp=15589701474715202908&score=94.35555979594042&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D2083435515%26spot_id%3D513500%26is_adult%3D0%26p%3Dhttps%253A%252F%252Fgossnabgroup.ru%252F%26idzone%3D0%26sid%3D1885&is_cpm=0&resp_type=&crid=&crtid=b0681ff5c1739e7f8bdbb8527f77d810&url=https%3A%2F%2Feu.vilitram.com%2Fnty%2Fpostback%2Fclick%3Fkey%3Dv2-1709885533544-4-9731-1323166-801b07bb-f738-902a-80df-95680bda40a0&icons=0ZiyhCFIKAt-wGRriVT-_bbKIFjf6GtwYW-kujg_0U9Tvn_ko2YqpSClkK5TdoTalLZM-LsLrL_7rCywqygREjQK1VoGGC9OWu07H1N8vQ5eptV08ydgxSmjWoMcjq-Ugr0UXcfygI3UYv7_cD-oaxnH0rtOfXeAVU1LZws3rzQQ_fkA3g&ext_cid=0&px_id=53513500&min_cpm=0.010549713970892063&out_id=1&campaign_type=lq-pop&aid=3251&cid=12972&uniq=74b7e0d16e9c425032c044b987fe63b0cd84369eb30f462bd789bb288897fdb4&mid=6306908347043061180&skin_id=2&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.01630225445775319&cpm=0&verify_hash=a30abf33d9abe6aab011c99b8c5ee8b0&is_native=2&real_bid=0.00013379028046131208&original_bid_usd=0.0001668&original_bid=0.0001668&exp=240&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&ip_mismatch=154.16.105.38&geo=US&carrier=-&label_ids=83,89,27,20,108,0&need_redirect_show=0&applied_features=main-skins-settings,coef_098&show_count=1&expiration_timestamp=1709957533&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FSG%2FSG_083be47dfc3e28c9a68305b76181a5033bc45790.webp&site=native-push-mainstream&price=0.0001668&hostname=auc-inpage-hz-5-a&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=Europe/Zurich&topics=&historical_keywords=&pop_cpc=0.0000001668&ext_campaign_id_str=&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-b_r-body&mlf=1&mlc=1&st=0.11&cpa=a29659e7-7a4e-4dab-a245-833102ce2087&prev_step_diff=4097 HTTP/1.1Host: e32350d110.84bfe218ba.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /in/show/?tag_ab=a&site_id=31513500&adblock=0&testab=0&auction_host=&mm=0&yc=0&render_type=hq&pr=&banner_width=300&banner_height=100&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=dch_ip,tz_offset&ssp=3964&page=https%3A%2F%2Fgossnabgroup.ru%2F&refdom=gossnabgroup.ru&auction_time=1709885533&subid=2083435515&sid=309884947&tcid=0&ver=8.149.0&ver_c=&spot_id=513500&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-03-08&iabcat=IAB24-24&keywords=&user_fp=15589701474715202908&score=94.35555979594042&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D2083435515%26spot_id%3D513500%26is_adult%3D0%26p%3Dhttps%253A%252F%252Fgossnabgroup.ru%252F%26idzone%3D0%26sid%3D1885&is_cpm=0&resp_type=&crid=&crtid=ffee90ecb6dc1a17d2eb3cd0e77fbdd5&url=http%3A%2F%2Fads.ppcmate.com%2Fnty%2Fpostback%2Fclick%3Fkey%3Dv2-1709885533585-7-12019-1175748-b5d31157-1466-56b0-8695-ff0126c2348a&icons=dO3IjHAoxPEP4oiGQnMRa6m9IELNIwHLoGqK6l3HQiE4FgPcYWl4_wZSe3nTIoC9QzulGbUyOpbeBe8eS22dUnt_sf_loHWWxaVLB3WB2lNkB6DV3rr9FodIs7cicD8qd1Z92Zr64o7IA02mMc2FAWJlM44fmC4JwdoFW9Z2CSAagkDVeFSuQHC0yOIEcPqIRjBgmklyWPqg3Lnc1Gdk-thjr3OfNYX5wil-msV0pEKN6eNgUtTio3FGvVf3s4UoQ0dr2ttODZF9F17WHVjTrPc2PrJgfOWp3U36Uv_aQwUKa2jEYp_pItoJ2tLEWjnfleYFjsyr8a8QdMbTovFS-b4DW4Iv3OuMOKftEtgtpgDBFhY4JjF9keOdZp7m1ECDkABskY9sF1kP9i3PN3ExQ5_gdQ2SOpo8bSmIv9rcNfthP_-V7ar0XG_u0BZ88I3a-yIs9qmXoLP2YiZX-vgniXJzXlWM2mYUclE4lcWe7HSwjchp9rYgTTzqYJyCzyEwqEM9en-HNUjZzmsDYkPKOQvQyDNbJpsDxAR7roSY8QBE2X-sFYr_WdwlxgL6-nebvd9acg6paw&ext_cid=0&px_id=73513500&min_cpm=0.0002607245892657709&out_id=0&campaign_type=hq&aid=3774&cid=16046&uniq=31c121d268b114ae96380f2cd8f0292b3d52e889ba3d191624ed9e9e45d13a5f&mid=6306908347043061180&skin_id=2&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.015600382622377378&cpm=0&verify_hash=9a87fef304d0425db32ec725405fdb78&is_native=1&real_bid=0.00518049&original_bid_usd=0.00518049&original_bid=0.00518049&exp=720&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&ip_mismatch=154.16.105.38&geo=US&carrier=-&label_ids=0,83,90,108&need_redirect_show=0&applied_features=coef_098,main-skins-settings&show_count=1&expiration_timestamp=0&image_url=https%3A%2F%2Fcdn.stgcdn.com%2Ffiles%2F439950858060922bf976c7a20645da7a.jpg&site=native-push-mainstream&price=0.00518049&hostname=auc-inpage-hz-5-a&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=Europe/Zurich&topics=&historical_keywords=&pop_cpc=0.00000518049&ext_campaign_id_str=&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-b_r-body&st=0.11&cpa=264ba233-d9ac-425a-948f-1c04db49b270&prev_step_diff=4097 HTTP/1.1Host: e32350d110.84bfe218ba.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: cors
Source: global traffic	HTTP traffic detected: GET /files/439950858060922bf976c7a20645da7a.jpg HTTP/1.1Host: cdn.stgcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ps/sw.js HTTP/1.1Host: sw.wpushorg.comConnection: keep-aliveCache-Control: max-age=0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://gossnabgroup.ru/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"65d4811d-1424"If-Modified-Since: Tue, 20 Feb 2024 10:38:21 GMT
Source: global traffic	HTTP traffic detected: GET /files/6b7c183bc5faf7a9ba96b9f945eeaf83.jpg HTTP/1.1Host: cdn.stgcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npc/sdk/push/styles.css HTTP/1.1Host: js.wpshsdk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /in/subscription-offers?href=https%3A%2F%2Fgossnabgroup.ru%2F&tcid=0&spot_id=513496&site=tcpublisher&source_id=0 HTTP/1.1Host: notification.tubecup.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /in/subscription-offers?href=https%3A%2F%2Fgossnabgroup.ru%2F&tcid=0&spot_id=513496&site=tcpublisher&source_id=0 HTTP/1.1Host: notification.tubecup.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?u=8h8p605&o=45bkxp3&t=3333 HTTP/1.1Host: winrenew-cash.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2YgTmjjbsOwLZ4vwROj2MhYIMFoaNHYbGg50Y-Yt_DG9e6h0-cylFw701szgbFrgCNo=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /NfjNow7xCVioIcwYKiH3bKUIgvUqsg1fRjI9m1d3NliEd0Fj38A4lUrS94JHZ05Kxg=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /0A4pQSWbjwwNdDeSg9X9cXJgnwRCrwnuP9E57LlumyebKeWC4IITmOJSTv_PuN8RRA=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /JLTSXDb4jBkaSMI_NsNPfUR9Ysw6WJy6nVJ5Iuh9lLuJiXogo4zwZckJoL7gywuxZ9o=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /TcHgSH30vCBCtQfyFLWvvPJdpOAJrSp1OtqopwMue3yRiXa7wT5Fs8gUbA3oJylGW991=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /IEbtDFfx84oGJxAjMuGDOEA3gRpDqhePZ2pAkpdz2GAPBLp8Pyg5SP5AAVstmPSeSQ=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2qbho4zgupoplTS8PXJRtmRiiyyc4-bCtv9u4HnnpWhdQxEZvwT5y2tKeYSB8H584g=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fDpoqIbZ884ylRnMK8Lx9Fu4DsLQk5yt4f9WkxeOAPpGnzc9BTi_YKkMsLvoMdx7Uzg=w240-h480-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /YX4IU7qLML-be7Xl25J-YkRBNgSZhVhJIsxeLdke3SaX1QBSFEKLbdcWORAwahq0oI4rrjz5YnWiVdb5=w48-h16-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /zVHhOG8l8bVPhxjkJj2ucRmKSRpQLIb_NJK6AHfy3hypEiqFm5UPV4YJZVi9bVKl_LQ=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /NVUOs8Vh4nvaP1pTvdrmhfzpy5rYZcWJl13uxyLjRCWZmEubC1PyjihCCi2TCO9FfQ=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KGCN_wYPWmCvGaLY8VmRLJOV1KYWJ_U68ceJSPt4DLKbcxvYBdxw_5ivLfDog0J3UA=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /0A4pQSWbjwwNdDeSg9X9cXJgnwRCrwnuP9E57LlumyebKeWC4IITmOJSTv_PuN8RRA=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /NfjNow7xCVioIcwYKiH3bKUIgvUqsg1fRjI9m1d3NliEd0Fj38A4lUrS94JHZ05Kxg=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2YgTmjjbsOwLZ4vwROj2MhYIMFoaNHYbGg50Y-Yt_DG9e6h0-cylFw701szgbFrgCNo=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /TcHgSH30vCBCtQfyFLWvvPJdpOAJrSp1OtqopwMue3yRiXa7wT5Fs8gUbA3oJylGW991=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /IEbtDFfx84oGJxAjMuGDOEA3gRpDqhePZ2pAkpdz2GAPBLp8Pyg5SP5AAVstmPSeSQ=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /JLTSXDb4jBkaSMI_NsNPfUR9Ysw6WJy6nVJ5Iuh9lLuJiXogo4zwZckJoL7gywuxZ9o=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /12sfBhw4O0sk8Bs9qKLJf2t4Cj_n6PJ10ficezyllp_lW6bc5UadmNtNS0rFdhkglLeP=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /iFstqoxDElUVv4T3KxkxP3OTcuFvWF5ZQQjT7aIxy4n2uaVigCCykxeG6EZV9FQ10X1itPj1oORm=s20-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /12USW7aflgz466ifDehKTnMoAep_VHxDmKJ6jEBoDZWCSefOC-ThRX14Mqe0r8KF9XCzrpMqJts=s20-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2qbho4zgupoplTS8PXJRtmRiiyyc4-bCtv9u4HnnpWhdQxEZvwT5y2tKeYSB8H584g=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /YX4IU7qLML-be7Xl25J-YkRBNgSZhVhJIsxeLdke3SaX1QBSFEKLbdcWORAwahq0oI4rrjz5YnWiVdb5=w48-h16-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fDpoqIbZ884ylRnMK8Lx9Fu4DsLQk5yt4f9WkxeOAPpGnzc9BTi_YKkMsLvoMdx7Uzg=w240-h480-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /NVUOs8Vh4nvaP1pTvdrmhfzpy5rYZcWJl13uxyLjRCWZmEubC1PyjihCCi2TCO9FfQ=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KGCN_wYPWmCvGaLY8VmRLJOV1KYWJ_U68ceJSPt4DLKbcxvYBdxw_5ivLfDog0J3UA=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /W5DPtvB8Fhmkn5LbFZki_OHL3ZI1Rdc-AFul19UK4f7np2NMjLE5QquD6H0HAeEJ977u3WH4yaQ=s20-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ohRyQRA9rNfhp7xLW0MtW1soD8SEX45Oec7MyH3FaxtukWUG_6GKVpvh3JiugzryLi7Bia02HPw=s20-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a-/ALV-UjVhAJroDG3rFcHCeguJJfqe0ywxWvOANSuyL2sZGhEVwnC1=s32-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /zVHhOG8l8bVPhxjkJj2ucRmKSRpQLIb_NJK6AHfy3hypEiqFm5UPV4YJZVi9bVKl_LQ=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a-/ALV-UjVEDgFjAocMId0v2Cxmm6MLmoD7yzAcB5ZdgKwNXzXXyFM=s32-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a-/ALV-UjWH6jUBtSGI7BBubov7tNbYm6JMKCh-M4rpyCwDH5Hzgz8=s32-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /byNQj20XRp7MfIVK7WryqB4jdyZceL087ABgIjwzZqw9y339Nz0_KLS_1B7ak51QLEg=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /12sfBhw4O0sk8Bs9qKLJf2t4Cj_n6PJ10ficezyllp_lW6bc5UadmNtNS0rFdhkglLeP=w526-h296-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /iFstqoxDElUVv4T3KxkxP3OTcuFvWF5ZQQjT7aIxy4n2uaVigCCykxeG6EZV9FQ10X1itPj1oORm=s20-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /12USW7aflgz466ifDehKTnMoAep_VHxDmKJ6jEBoDZWCSefOC-ThRX14Mqe0r8KF9XCzrpMqJts=s20-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KsCewcbhguiV2WXb5o-NM28xhZlhukM1JWU__L7POklqA3CP2DFXVfco8b4acM3wWHg=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /W5DPtvB8Fhmkn5LbFZki_OHL3ZI1Rdc-AFul19UK4f7np2NMjLE5QquD6H0HAeEJ977u3WH4yaQ=s20-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a-/ALV-UjVhAJroDG3rFcHCeguJJfqe0ywxWvOANSuyL2sZGhEVwnC1=s32-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a2HLOHpXniFGGEOxr6fcAkhmjQTT_r9IK2p23c9RDdvJAioZrSsyIwBdaxqRF7qScW0=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /TymHl9J6thzg_3mSBPcEb-JCcgBujUXZWjMQIe2HPWm0xukLUZ6BxtDK9qyExfY0n-4=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ohRyQRA9rNfhp7xLW0MtW1soD8SEX45Oec7MyH3FaxtukWUG_6GKVpvh3JiugzryLi7Bia02HPw=s20-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a-/ALV-UjVEDgFjAocMId0v2Cxmm6MLmoD7yzAcB5ZdgKwNXzXXyFM=s32-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a-/ALV-UjWH6jUBtSGI7BBubov7tNbYm6JMKCh-M4rpyCwDH5Hzgz8=s32-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /byNQj20XRp7MfIVK7WryqB4jdyZceL087ABgIjwzZqw9y339Nz0_KLS_1B7ak51QLEg=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KsCewcbhguiV2WXb5o-NM28xhZlhukM1JWU__L7POklqA3CP2DFXVfco8b4acM3wWHg=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /TymHl9J6thzg_3mSBPcEb-JCcgBujUXZWjMQIe2HPWm0xukLUZ6BxtDK9qyExfY0n-4=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a2HLOHpXniFGGEOxr6fcAkhmjQTT_r9IK2p23c9RDdvJAioZrSsyIwBdaxqRF7qScW0=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?trustedtypes=true&render=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /tools/feedback/chat_load.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0&co=aHR0cHM6Ly9wbGF5Lmdvb2dsZS5jb206NDQz&hl=en&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=yqeeu9fajvsp HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-19995903-1&cid=1169434221.1709885559&jid=1062486233&_u=YEBAAEAAAAAAACgDI~&z=659014817 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-19995903-1&cid=1169434221.1709885559&jid=1062486233&gjid=541615713&_gid=1992863761.1709885559&_u=YEBAAEAAAAAAACgDI~&z=1467949968 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-19995903-1&cid=1169434221.1709885559&jid=1062486233&_u=YEBAAEAAAAAAACgDI~&z=659014817 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=QquE1_MNjnFHgZF4HPsEcf_2 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0&co=aHR0cHM6Ly9wbGF5Lmdvb2dsZS5jb206NDQz&hl=en&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=yqeeu9fajvspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /js/bg/sLPIoIr_9R2H1vFE63bCW9_RmUPMbLk-XyKwDAco0G4.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0&co=aHR0cHM6Ly9wbGF5Lmdvb2dsZS5jb206NDQz&hl=en&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=yqeeu9fajvspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ACzWgXp-jx02vCPlG5OMuBakksCHDOd0wJd1bU4w39Eerd70dLaRsBZdo20C4D8Uefz9bjrMu76t3w2-cVunRsw; NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /payments/v4/js/integrator.js?rk=1 HTTP/1.1Host: payments.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ACzWgXpOHRDMpmX_lhnym7Z43Nzy87u9wYJHUg-hQrQmP4xtK735Afbq0xk8LlHgZ0J6CduiGTFSxOEWdv_2SgM; NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /9u1xt67PewWfe0nfh-ShHdyrNIDUi-eKyc73T2QBUPyWQWBn1Fnr_R2rxquLSnQdrZVe9rbFXi3u=w648-h364-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /-n3IGe2RWAsevJY_bEJ5yJYrirfK1m3LjDw2c2mdBSG9XuYDea5QvtsdhSaOrbbp0w=w416-h235-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /D4DUUFQDCsH9NIEa8hjMjQSWdtNhGX1Fd_jT-23ogAb5uMMqttqQDUJcUt4K_u8RYOQ=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vTMochUbMqk9ehiZ7npCcwvhzOX8x0GlN1EHTW8sg58GBkcF48Vf6fwbvag5KwHxLA=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi/5CBdVmCuDx4/hqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi/R3x88pl2rZI/hqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /OmRFgoSS-iZDwzkMpygYEjbBkpY-_fpE2CEiEgj2KG0yoj2DcP01fbGMutWEf8ip2tiv=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Kjxf_QViKaL8tmk2R2gtNr8teHl7Oz9bO5ckWZkvKa5w4h7Q2eb4gYa5cjPhAyn3d3NYAfJ8XQnH=w648-h364-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /D4DUUFQDCsH9NIEa8hjMjQSWdtNhGX1Fd_jT-23ogAb5uMMqttqQDUJcUt4K_u8RYOQ=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /OmRFgoSS-iZDwzkMpygYEjbBkpY-_fpE2CEiEgj2KG0yoj2DcP01fbGMutWEf8ip2tiv=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vTMochUbMqk9ehiZ7npCcwvhzOX8x0GlN1EHTW8sg58GBkcF48Vf6fwbvag5KwHxLA=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /-n3IGe2RWAsevJY_bEJ5yJYrirfK1m3LjDw2c2mdBSG9XuYDea5QvtsdhSaOrbbp0w=w416-h235-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi/R3x88pl2rZI/hqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi/5CBdVmCuDx4/hqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi/uWsQ5IWVilM/hqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi/C4uzmiVn8Og/hqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /z950eFx-wowoAV2KgHast5YFcrxoGJtY18fYd_eMgvEDVn8_tsJwApy4Dbs1iqE2tAjX=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /LByrur1mTmPeNr0ljI-uAUcct1rzmTve5Esau1SwoAzjBXQUby6uHIfHbF9TAT51mgHm=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Kjxf_QViKaL8tmk2R2gtNr8teHl7Oz9bO5ckWZkvKa5w4h7Q2eb4gYa5cjPhAyn3d3NYAfJ8XQnH=w648-h364-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fWeFmmqEhxgnidTfx0BGIy2ZNWKF1g4zLfnvy0GcQ0_bETqceP_VoB5O0YGAjwhI0osdHS5r4w=w648-h364-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /9u1xt67PewWfe0nfh-ShHdyrNIDUi-eKyc73T2QBUPyWQWBn1Fnr_R2rxquLSnQdrZVe9rbFXi3u=w648-h364-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi/dSg_iqQpKYA/hqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Y9BUoMIWfhZDUFZ_MxQmnsgSyb3O8s8Sds65E_j46-vdDSJi_0Xqmoa-fHaQa7fGlw=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi/-wpM1XofnD8/hqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /La2XvLnJqNI5JyshQ5RfxM18zHduji9KPgNge93Ibwpjc7znBZVYuuwJ4ycGk6T-DQ=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi/C4uzmiVn8Og/hqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /z950eFx-wowoAV2KgHast5YFcrxoGJtY18fYd_eMgvEDVn8_tsJwApy4Dbs1iqE2tAjX=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /LByrur1mTmPeNr0ljI-uAUcct1rzmTve5Esau1SwoAzjBXQUby6uHIfHbF9TAT51mgHm=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Y9BUoMIWfhZDUFZ_MxQmnsgSyb3O8s8Sds65E_j46-vdDSJi_0Xqmoa-fHaQa7fGlw=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi/dSg_iqQpKYA/hqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi/uWsQ5IWVilM/hqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi/-wpM1XofnD8/hqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fWeFmmqEhxgnidTfx0BGIy2ZNWKF1g4zLfnvy0GcQ0_bETqceP_VoB5O0YGAjwhI0osdHS5r4w=w648-h364-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /La2XvLnJqNI5JyshQ5RfxM18zHduji9KPgNge93Ibwpjc7znBZVYuuwJ4ycGk6T-DQ=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0&co=aHR0cHM6Ly9wbGF5Lmdvb2dsZS5jb206NDQz&hl=en&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=sirx2au0vxlj HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ACzWgXpOHRDMpmX_lhnym7Z43Nzy87u9wYJHUg-hQrQmP4xtK735Afbq0xk8LlHgZ0J6CduiGTFSxOEWdv_2SgM; NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; S=billing-ui-v3=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5:billing-ui-v3-efe=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5
Source: global traffic	HTTP traffic detected: GET /tools/feedback/chat_load.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; S=billing-ui-v3=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5:billing-ui-v3-efe=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ACzWgXomXTy4gErXxbsrCBDJVDIEqvB2Jy7WsNRGISMKpZ91ohXZxVys25OsQMTvRe5pPtA3tkYec-oWgQTIYoE; NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; S=billing-ui-v3=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5:billing-ui-v3-efe=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5
Source: global traffic	HTTP traffic detected: GET /fDpoqIbZ884ylRnMK8Lx9Fu4DsLQk5yt4f9WkxeOAPpGnzc9BTi_YKkMsLvoMdx7Uzg=s256-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /TcHgSH30vCBCtQfyFLWvvPJdpOAJrSp1OtqopwMue3yRiXa7wT5Fs8gUbA3oJylGW991=s256-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tPSknKHPUTRNsWt-YBQpcryIUlKiu3tjCdYgO7rFnpiRtl_oosb-oIZjM8LlHCLS5qY=w3840-h2160-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rCNE1TGBN3EgPecrC-B5ALFpIkW_QWTa3TAA8QDtcXmDK8TeMFW2fzqraMQAx5GRFw=s94-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fDpoqIbZ884ylRnMK8Lx9Fu4DsLQk5yt4f9WkxeOAPpGnzc9BTi_YKkMsLvoMdx7Uzg=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fDpoqIbZ884ylRnMK8Lx9Fu4DsLQk5yt4f9WkxeOAPpGnzc9BTi_YKkMsLvoMdx7Uzg=s52-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /TcHgSH30vCBCtQfyFLWvvPJdpOAJrSp1OtqopwMue3yRiXa7wT5Fs8gUbA3oJylGW991=s256-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rCNE1TGBN3EgPecrC-B5ALFpIkW_QWTa3TAA8QDtcXmDK8TeMFW2fzqraMQAx5GRFw=s94-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fDpoqIbZ884ylRnMK8Lx9Fu4DsLQk5yt4f9WkxeOAPpGnzc9BTi_YKkMsLvoMdx7Uzg=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fDpoqIbZ884ylRnMK8Lx9Fu4DsLQk5yt4f9WkxeOAPpGnzc9BTi_YKkMsLvoMdx7Uzg=s52-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fDpoqIbZ884ylRnMK8Lx9Fu4DsLQk5yt4f9WkxeOAPpGnzc9BTi_YKkMsLvoMdx7Uzg=s256-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tPSknKHPUTRNsWt-YBQpcryIUlKiu3tjCdYgO7rFnpiRtl_oosb-oIZjM8LlHCLS5qY=w3840-h2160-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tools/feedback/chat_load.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; S=billing-ui-v3=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5:billing-ui-v3-efe=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0&co=aHR0cHM6Ly9wbGF5Lmdvb2dsZS5jb206NDQz&hl=en&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=xepm3o2k6jm HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ACzWgXomXTy4gErXxbsrCBDJVDIEqvB2Jy7WsNRGISMKpZ91ohXZxVys25OsQMTvRe5pPtA3tkYec-oWgQTIYoE; NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; S=billing-ui-v3=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5:billing-ui-v3-efe=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ACzWgXrYkr_Cbi9BuSrCrlROZfC-WQ5uqrqGyrFfS9pxCoTkJYAy11hDS7SOyvJRAsI0zBORc-zMbevva9gQjqU; NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; S=billing-ui-v3=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5:billing-ui-v3-efe=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5
Source: global traffic	HTTP traffic detected: GET /push/badges/pill.png HTTP/1.1Host: js.wpadmngr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /push/badges/love-letter.png HTTP/1.1Host: js.wpadmngr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /in/show/?mid=1957973405744584550&pid=0&site=tcpublisher&sc=US&usage_type=DCH&subid=0&sid=4609887414&cid=14610&price=0.07840000000000001&is_cpm=0&cpm=0&ecpm=0.24410841694819044&crid=1128662&crtid=1a8fdf761d745f21990263da0890b104&tcid=0&out_id=0&ver=2.89.1&ver_c=2.89.1&refdom=gossnabgroup.ru&hostname=lb-hz-6&site_id=30513496&spot_id=513496&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=1710144796&created_at=2024-03-08&is_native=0&burl=Y5Yd6SMRvZvQRmBc33lF-Iti53z3nmr_Z1oCo95YeoO0qaJ9tl5Maw&pop_winurl=&ip=&testab=&px_id=39513496&adblock=0&auction_host=&mm=0&yc=&render_type=&campaign_type=&uniq=ffe5027c91e31eaf96f8289de6aa298e76ce3e4f2be9c4a5b8b37dd3a0405b77&exp=1440&resp_type=&iabcat=&min_cpm=&placement_type_id=0&skin_test=&verify_hash=5942c91e71770006ddc66c26aa3b2a97&score=0&durl=&ml=&tag_ab=a&original_bid=0.07840000000000001&user_fp=0&v2=0&url=https%3A%2F%2Fimg.cdn.house%2Fi%2F1%2Fu5KMKIF1XZfyyXSH2MpUbH2gGje5Q5HBBLuJA3hGbrFW1WEPRUiVcPSx_hAXrkQldf-rX65sD79Uc-SKXQkvZPNwBU7iD03bMSjmtdPw4cm7R2K0Q-7mN3XXe3eFbY3dY5YklvpV7IhWHTK7Lz2mCVB4SwtnRNY-fPbYFYv06ftRTIe1CclVWnajhWb9ATfHLGmqUqikBuJKRYvt&image_url=&skin_id=&vertical_id=14&real_bid=0.06419391784667973&pr=&user_keywords=&auc_type=&aid=172&ext_cid=0&device_theme=&token_id=12&platform_id=0&badge_url=https%3A%2F%2Fjs.wpadmngr.com%2Fpush%2Fbadges%2Fpill.png&subscriptions=&labels=hq&applied_features=prod%2Cmain-button-settings&site_type=push-mainstream&is_pwa_subscription=0&show_count=1&reauction_flag=0&keywords=&m_filters=ttl_mismatch&ip_mismatch=154.16.105.38&ua_mismatch=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F117.0.0.0+Safari%2F537.36&geo=US&schedule_id=0&template_name=&original_bid_usd=0.07840000000000001&button_title=%2520e8i%2Clater&show_time=1709885596857&on_site=false&notification_position_number=1 HTTP/1.1Host: notification.tubecup.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /in/show/?mid=1957973405744584550&pid=0&site=tcpublisher&sc=US&usage_type=DCH&subid=0&sid=4609887414&cid=481&price=0.0686&is_cpm=0&cpm=0&ecpm=0.22162946616114873&crid=&crtid=1a8fdf761d745f21990263da0890b104&tcid=0&out_id=1&ver=2.89.1&ver_c=2.89.1&refdom=gossnabgroup.ru&hostname=lb-hz-6&site_id=30513496&spot_id=513496&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=1710144796&created_at=2024-03-08&is_native=0&burl=8-XiHGY-B98L-OWmghQLuDqgTwOoK3_d-t3RkRE7kXygUhx3Qnuzjg&pop_winurl=&ip=&testab=&px_id=30513496&adblock=0&auction_host=&mm=0&yc=&render_type=&campaign_type=&uniq=dcb6195614f36c888cc1b2e9b9d919dd47e1d20c99214d4a009d2532eec70572&exp=1440&resp_type=&iabcat=&min_cpm=&placement_type_id=0&skin_test=&verify_hash=6017e24e983cd1b7ed321657804a672f&score=0&durl=&ml=&tag_ab=a&original_bid=0.0686&user_fp=0&v2=0&url=https%3A%2F%2Fimg.cdn.house%2Fi%2F1%2F-9OALqIHyNTIm_d1II-HIWKeabcPQ0pxKvNaVCfewoFTk29xPmFD1wLWpyDvSbXk34nx9a21SItX7phzW_Is-E8LvOl5kyrR0RH_xlzISSqE24YKVUG6ha6cTKMEr_ziZmo3hsjH9U72gICa7BYKjQGKe2hvjFePL1QjZkU-EGDuyBY-Re9maOwdYBKNDVvBuWFjWVeZclM8eYtf&image_url=&skin_id=&vertical_id=14&real_bid=0.05828256117105482&pr=&user_keywords=&auc_type=&aid=172&ext_cid=1128662&device_theme=&token_id=12&platform_id=0&badge_url=https%3A%2F%2Fjs.wpadmngr.com%2Fpush%2Fbadges%2Flove-letter.png&subscriptions=&labels=&applied_features=main-button-settings%2Cprod&site_type=push-mainstream&is_pwa_subscription=0&show_count=1&reauction_flag=0&keywords=&m_filters=ttl_mismatch&ip_mismatch=154.16.105.38&ua_mismatch=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F117.0.0.0+Safari%2F537.36&geo=US&schedule_id=0&template_name=&original_bid_usd=0.0686&button_title=try%2520f1%2Cclose&show_time=1709885596859&on_site=false&notification_position_number=1 HTTP/1.1Host: notification.tubecup.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /in/show/?mid=1957973405744584550&pid=0&site=tcpublisher&sc=US&usage_type=DCH&subid=0&sid=4609887414&cid=454&price=0.0686&is_cpm=0&cpm=0&ecpm=0.21995994386194895&crid=&crtid=1a8fdf761d745f21990263da0890b104&tcid=0&out_id=2&ver=2.89.1&ver_c=2.89.1&refdom=gossnabgroup.ru&hostname=lb-hz-6&site_id=30513496&spot_id=513496&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=1710144796&created_at=2024-03-08&is_native=0&burl=t769n6kIqRnlDuTKZcd0eEdV6vYzRMElcoDLDXFvffQCs3D06OUY4A&pop_winurl=&ip=&testab=&px_id=30513496&adblock=0&auction_host=&mm=0&yc=&render_type=&campaign_type=&uniq=dcb6195614f36c888cc1b2e9b9d919dd47e1d20c99214d4a009d2532eec70572&exp=1440&resp_type=&iabcat=&min_cpm=&placement_type_id=0&skin_test=&verify_hash=85896d4450fb6e2778fb1695db8da9a3&score=0&durl=&ml=&tag_ab=a&original_bid=0.0686&user_fp=0&v2=0&url=https%3A%2F%2Fimg.cdn.house%2Fi%2F1%2Fva1kEykSYGeRCrFpRPiUxRiKYHlL1n18iguGiXun_Pfw7zhPN1NS60wHZXCuIhPHqumBct3kAN1OHHzcMwAbHuD4uqrAP4l6F4R_c5YM0ccYiWQIsIuGlWW_D3q05L0dTN-pS4v3EDAZq_XIGLMOwASCVNKeBcnEfzowPKz9mnNCNLAJ6dD7kUN-UA97xu3__xxILQiMbBwQhdJV&image_url=&skin_id=&vertical_id=14&real_bid=0.057843521916866474&pr=&user_keywords=&auc_type=&aid=172&ext_cid=1128662&device_theme=&token_id=12&platform_id=0&badge_url=https%3A%2F%2Fjs.wpadmngr.com%2Fpush%2Fbadges%2Flove-letter.png&subscriptions=&labels=&applied_features=prod%2Cmain-button-settings&site_type=push-mainstream&is_pwa_subscription=0&show_count=1&reauction_flag=0&keywords=&m_filters=ttl_mismatch&ip_mismatch=154.16.105.38&ua_mismatch=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F117.0.0.0+Safari%2F537.36&geo=US&schedule_id=0&template_name=&original_bid_usd=0.0686&button_title=try%2520e6%2Cclose&show_time=1709885596860&on_site=false&notification_position_number=1 HTTP/1.1Host: notification.tubecup.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/ads/56661/65ea33056122f.png HTTP/1.1Host: img.cdn.houseConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/1/va1kEykSYGeRCrFpRPiUxRiKYHlL1n18iguGiXun_Pfw7zhPN1NS60wHZXCuIhPHqumBct3kAN1OHHzcMwAbHuD4uqrAP4l6F4R_c5YM0ccYiWQIsIuGlWW_D3q05L0dTN-pS4v3EDAZq_XIGLMOwASCVNKeBcnEfzowPKz9mnNCNLAJ6dD7kUN-UA97xu3__xxILQiMbBwQhdJV HTTP/1.1Host: img.cdn.houseConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/1/-9OALqIHyNTIm_d1II-HIWKeabcPQ0pxKvNaVCfewoFTk29xPmFD1wLWpyDvSbXk34nx9a21SItX7phzW_Is-E8LvOl5kyrR0RH_xlzISSqE24YKVUG6ha6cTKMEr_ziZmo3hsjH9U72gICa7BYKjQGKe2hvjFePL1QjZkU-EGDuyBY-Re9maOwdYBKNDVvBuWFjWVeZclM8eYtf HTTP/1.1Host: img.cdn.houseConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/1/u5KMKIF1XZfyyXSH2MpUbH2gGje5Q5HBBLuJA3hGbrFW1WEPRUiVcPSx_hAXrkQldf-rX65sD79Uc-SKXQkvZPNwBU7iD03bMSjmtdPw4cm7R2K0Q-7mN3XXe3eFbY3dY5YklvpV7IhWHTK7Lz2mCVB4SwtnRNY-fPbYFYv06ftRTIe1CclVWnajhWb9ATfHLGmqUqikBuJKRYvt HTTP/1.1Host: img.cdn.houseConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0&co=aHR0cHM6Ly9wbGF5Lmdvb2dsZS5jb206NDQz&hl=en&v=QquE1_MNjnFHgZF4HPsEcf_2&size=invisible&cb=jw8ii2jdejpu HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ACzWgXrYkr_Cbi9BuSrCrlROZfC-WQ5uqrqGyrFfS9pxCoTkJYAy11hDS7SOyvJRAsI0zBORc-zMbevva9gQjqU; S=billing-ui-v3=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5:billing-ui-v3-efe=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5; NID=512=hzis3y1X6Uy7qNjckPgsocK8WIUCipOU7xNwKJvQLl16OhXK-WNkOTxDnuaeRLzf8BVZhZXNh_fENZe0i822Qp8TglScptQZA_guZyE7FiCwPqnStrNftGCbnXAb1OtMcKbLVqRoMBXrPR5a-4f13pAYFDuF05UXg4VTw4Abl972GW7nHi6JLQo
Source: global traffic	HTTP traffic detected: GET /tools/feedback/chat_load.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: S=billing-ui-v3=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5:billing-ui-v3-efe=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5; NID=512=hzis3y1X6Uy7qNjckPgsocK8WIUCipOU7xNwKJvQLl16OhXK-WNkOTxDnuaeRLzf8BVZhZXNh_fENZe0i822Qp8TglScptQZA_guZyE7FiCwPqnStrNftGCbnXAb1OtMcKbLVqRoMBXrPR5a-4f13pAYFDuF05UXg4VTw4Abl972GW7nHi6JLQo
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ACzWgXo7rwnE2H3TSKrrs5EQCRs7IELep39olMC_G2RxwD-WSnozydi6WlcEhnpFoJ9ydRuGowrNZdudLismC4U; S=billing-ui-v3=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5:billing-ui-v3-efe=ov5WaAuHQJRsQu44wJUSiaSORfo4xkj5; NID=512=hzis3y1X6Uy7qNjckPgsocK8WIUCipOU7xNwKJvQLl16OhXK-WNkOTxDnuaeRLzf8BVZhZXNh_fENZe0i822Qp8TglScptQZA_guZyE7FiCwPqnStrNftGCbnXAb1OtMcKbLVqRoMBXrPR5a-4f13pAYFDuF05UXg4VTw4Abl972GW7nHi6JLQo
Source: global traffic	HTTP traffic detected: GET /lwBxT-SXGW_99shrwHIzxUB5nyv248-9b_KfowA0mgBZYtTKftUAX7ewr17hAzWJQYA=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mix0TYeOXNQ8vCIKE-dwOlCUrb5RKuJJVdmWmDfjosD1l-Btx08-rZRK0e91ap_gMrw=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xpX5w34G9QV1XPag2GuJdioMpbed-QMSbcOytfXil8RYy91rm42mTviA-OIjzUGDyA=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /zYr-IOjSchYmqnC_JoWsdKahclhgngZCm_VmmIb6nyKXYIuduFi_hRa3os2aHN0zX8M=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1AHYBUDcZyY48U2UAFgIXhwQ_RJ0BmU7Sa9vOZ7JVla9Qum5Xxp5fndJ62qKQKXtmBQ=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tH2ui3MqYnTyt7EG9S3DVNDO7SV7eRtts2phjaE-vZNBvf4meAx5_a5LZc_IbZGAFw=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /5P5svqXNCWqE0NtHSV91pl2YUGKJ2aitjaUWIVZd-65AtskDVO2o9bpYx1oAV9fr0-nt=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /7odIr8zuMI5ddrSG6KtefaVNEvKBoiGzo6Q96lowbP5tLFhqiqUl3Mc16PMk2E1m9g=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://play.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xpX5w34G9QV1XPag2GuJdioMpbed-QMSbcOytfXil8RYy91rm42mTviA-OIjzUGDyA=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mix0TYeOXNQ8vCIKE-dwOlCUrb5RKuJJVdmWmDfjosD1l-Btx08-rZRK0e91ap_gMrw=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1AHYBUDcZyY48U2UAFgIXhwQ_RJ0BmU7Sa9vOZ7JVla9Qum5Xxp5fndJ62qKQKXtmBQ=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /zYr-IOjSchYmqnC_JoWsdKahclhgngZCm_VmmIb6nyKXYIuduFi_hRa3os2aHN0zX8M=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tH2ui3MqYnTyt7EG9S3DVNDO7SV7eRtts2phjaE-vZNBvf4meAx5_a5LZc_IbZGAFw=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lwBxT-SXGW_99shrwHIzxUB5nyv248-9b_KfowA0mgBZYtTKftUAX7ewr17hAzWJQYA=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /5P5svqXNCWqE0NtHSV91pl2YUGKJ2aitjaUWIVZd-65AtskDVO2o9bpYx1oAV9fr0-nt=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /7odIr8zuMI5ddrSG6KtefaVNEvKBoiGzo6Q96lowbP5tLFhqiqUl3Mc16PMk2E1m9g=s64-rw HTTP/1.1Host: play-lh.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_313.2.dr	String found in binary or memory: Ze=u(["https://sandbox.google.com/tools/feedback/"]),$e=u(["https://www.google.cn/tools/feedback/"]),af=u(["https://help.youtube.com/tools/feedback/"]),bf=u(["https://asx-frontend-staging.corp.google.com/inapp/"]),cf=u(["https://asx-frontend-staging.corp.google.com/tools/feedback/"]),df=u(["https://localhost.corp.google.com/inapp/"]),ef=u(["https://localhost.proxy.googlers.com/inapp/"]),ff=T(Ie),gf=[T(Je),T(Ke)],hf=[T(Le),T(Me),T(Ne),T(Oe),T(Pe),T(Qe),T(Re),T(Se),T(Te),T(Ue)],jf=[T(Ve),T(We)],kf= equals www.youtube.com (Youtube)
Source: chromecache_304.2.dr	String found in binary or memory: _.$e=function(a){this.h=_.pb([],function(b){return _.Ye(b)});this.g=_.pb("https://apps.admob.com https://arctic-ocean-116022.appspot.com https://gweb-io2016-registration.appspot.com https://3-dot-gweb-io2016-registration.appspot.com https://bus-payments-dev.googleplex.com https://gbusrides.googleplex.com https://www.editionsatplay.com https://website-dot-cl-syd-eap.appspot.com https://massage-hrd-dev.googleplex.com https://massage-hrd-stg.googleplex.com https://massage.googleplex.com https://massage-hrd.googleplex.com https://googlecommassage-hrd.appspot.com https://nik.googlegoro.com https://taylormarshall-dot-test-dot-402-bslatkin-staging.appspot.com https://402-bslatkin-staging.appspot.com https://gweb-nextregistration.appspot.com https://qa-dot-gweb-nextregistration.appspot.com https://dev-dot-gweb-nextregistration.appspot.com https://cloudnext.withgoogle.com https://defjam-staging.appspot.com https://payments-dot-defjam-staging.appspot.com https://vector-customer.googleplex.com/ https://vector-test-customer.googleplex.com/ https://vector-dev-customer.googleplex.com/ https://vector-staging-customer.googleplex.com/ https://vector-perf-customer.googleplex.com/ https://youtube-xsell-tool.googleplex.com https://youtube-xsell-tool-stg.googleplex.com https://youtube.com https://www.youtube.com https://yt-web-green.corp.youtube.com https://yt-web-release.corp.youtube.com https://checkout.youtube.com https://checkout-green-qa.youtube.com https://home.nest.com https://alpha.home.nest.com https://home.ft.nest.com https://home.qa.nestlabs.com https://major.home.qa.nestlabs.com https://home.integration.nestlabs.com https://major.home.integration.nestlabs.com https://biz.waze.com https://biz.world.waze.com https://biz-il.waze.com https://biz-beta.witools.foo https://biz-beta-row.witools.foo https://biz-beta-il.witools.foo https://biz-qa.gcp.wazestg.com https://biz.gcp.wazestg.com https://embark-staging.corp.google.com https://embark-test.corp.google.com https://localdev.wazestg.com https://console.cloud.google https://payments.cloud.google https://payments-demoserver-sandbox.corp.cloud.google https://payments-sandbox.corp.cloud.google https://payments-sandbox.cloud.google https://spend-staging.corp.google.com https://spend-test.corp.google.com".split(" "),function(b){return _.Ye(b)}); equals www.youtube.com (Youtube)
Source: chromecache_321.2.dr	String found in binary or memory: c(U[ha],F.He)){Zz("https://www.youtube.com/iframe_api");t=!0;break}})}}else H(u.vtp_gtmOnSuccess)}var p=["www.youtube.com","www.youtube-nocookie.com"],q={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},r,t=!1;(function(u){Z.__ytl=u;Z.__ytl.m="ytl";Z.__ytl.isVendorTemplate=!0;Z.__ytl.priorityOverride=0;Z.__ytl.isInfrastructure=!1;Z.__ytl.runInSiloedMode=!1})(function(u){u.vtp_triggerStartOption?n(u):Qv(function(){n(u)})})}(); equals www.youtube.com (Youtube)
Source: chromecache_212.2.dr	String found in binary or memory: disableRealtimeCallback:!1,drive_share:{skipInitCommand:!0},csi:{rate:.01},client:{cors:!1},signInDeprecation:{rate:0},include_granted_scopes:!0,llang:"en",iframes:{youtube:{params:{location:["search","hash"]},url:":socialhost:/:session_prefix:_/widget/render/youtube?usegapi=1",methods:["scroll","openwindow"]},ytsubscribe:{url:"https://www.youtube.com/subscribe_embed?usegapi=1"},plus_circle:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/plus/circle?usegapi=1"},plus_share:{params:{url:""}, equals www.youtube.com (Youtube)
Source: chromecache_321.2.dr, chromecache_203.2.dr	String found in binary or memory: return b}uD.D="internal.enableAutoEventOnTimer";var vc=da(["data-gtm-yt-inspected-"]),vD=["www.youtube.com","www.youtube-nocookie.com"],wD,xD=!1; equals www.youtube.com (Youtube)
Source: chromecache_288.2.dr	String found in binary or memory: var LJb=function(a){return _.ub(null===a?"null":void 0===a?"undefined":a)},MJb=function(a){const b=new _.Jn(a);return"www.youtube.com"===b.ha&&"/watch"===b.H?(a=_.Zn(b,"v"),`https://www.youtube.com/embed/${encodeURIComponent(a)}`):a},NJb=function(a,b){0===a.H.size&&a.O.addEventListener("message",d=>{if(/\.google\.com$/.test(d.origin)&&d.data){var e=a.H.get(d.data.type);e&&e.Vh().forEach(f=>{f.call(d)})}});var c=a.H.get("CLOSE_DIALOG");c?c.add(b):(c=new _.pM,c.add(b),a.H.set("CLOSE_DIALOG",c))},OJb= equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: gossnabgroup.ru

Source: unknown

HTTP traffic detected: POST /fp?tag_id=151659 HTTP/1.1Host: fp.metricswpsh.comConnection: keep-aliveContent-Length: 2036sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/json;charset=UTF-8Accept: */*Origin: https://gossnabgroup.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gossnabgroup.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2284,i,3100902536086182891,1735761918452591964,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://gossnabgroup.ru
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2284,i,3100902536086182891,1735761918452591964,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://gossnabgroup.ru	0%	Virustotal		Browse
http://gossnabgroup.ru	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Link
storage.multstorage.com	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
fp.metricswpsh.com	2%	Virustotal	Browse
cdn.gdns.revopush.com	2%	Virustotal	Browse
winrenew-cash.life	12%	Virustotal	Browse
notification.tubecup.net	0%	Virustotal	Browse
nereserv.com	1%	Virustotal	Browse
js.nextpsh.top	10%	Virustotal	Browse
gossnabgroup.ru	0%	Virustotal	Browse
ntvpforever.com	1%	Virustotal	Browse
subscribers.production.wpu.sh	0%	Virustotal	Browse
us.superfasti.co	0%	Virustotal	Browse
js.wpshsdk.com	2%	Virustotal	Browse
sw.wpushorg.com	0%	Virustotal	Browse
js.capndr.com	0%	Virustotal	Browse
js.wpadmngr.com	0%	Virustotal	Browse
img.cdn.house	0%	Virustotal	Browse
cdn.stgcdn.com	0%	Virustotal	Browse
e32350d110.84bfe218ba.com	2%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://localhost.proxy.googlers.com/inapp/	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	0%	URL Reputation	safe
https://biz-qa.gcp.wazestg.com	0%	Avira URL Cloud	safe
https://gweb-nextregistration.appspot.com	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
https://www.gstatic.c..?/recaptcha/releases/QquE1_MNjnFHgZF4HPsEcf_2/recaptcha__.	0%	Avira URL Cloud	safe
https://www.editionsatplay.com	0%	Avira URL Cloud	safe
https://cdn.stgcdn.com/files/6b7c183bc5faf7a9ba96b9f945eeaf83.jpg	0%	Avira URL Cloud	safe
https://img.cdn.house/i/1/u5KMKIF1XZfyyXSH2MpUbH2gGje5Q5HBBLuJA3hGbrFW1WEPRUiVcPSx_hAXrkQldf-rX65sD79Uc-SKXQkvZPNwBU7iD03bMSjmtdPw4cm7R2K0Q-7mN3XXe3eFbY3dY5YklvpV7IhWHTK7Lz2mCVB4SwtnRNY-fPbYFYv06ftRTIe1CclVWnajhWb9ATfHLGmqUqikBuJKRYvt	0%	Avira URL Cloud	safe
https://biz-qa.gcp.wazestg.com	0%	Virustotal		Browse
https://www.editionsatplay.com	0%	Virustotal		Browse
https://console.cloud.google	0%	Avira URL Cloud	safe
https://payments-demoserver-sandbox.corp.cloud.google	0%	Avira URL Cloud	safe
https://3-dot-gweb-io2016-registration.appspot.com	0%	Avira URL Cloud	safe
https://js.wpshsdk.com/npc/sdk/push/styles.css	0%	Avira URL Cloud	safe
https://console.cloud.google	0%	Virustotal		Browse
https://payments.cloud.google	0%	Avira URL Cloud	safe
https://biz.gcp.wazestg.com	0%	Avira URL Cloud	safe
https://gweb-nextregistration.appspot.com	0%	Virustotal		Browse
https://3-dot-gweb-io2016-registration.appspot.com	0%	Virustotal		Browse
https://nik.googlegoro.com	0%	Avira URL Cloud	safe
https://js.wpshsdk.com/npc/sdk/push/styles.css	1%	Virustotal		Browse
https://payments-demoserver-sandbox.corp.cloud.google	0%	Virustotal		Browse
https://biz.gcp.wazestg.com	0%	Virustotal		Browse
https://arctic-ocean-116022.appspot.com	0%	Virustotal		Browse
https://arctic-ocean-116022.appspot.com	0%	Avira URL Cloud	safe
https://payments.cloud.google	0%	Virustotal		Browse
https://js.wpadmngr.com/push/badges/love-letter.png	0%	Avira URL Cloud	safe
https://notification.tubecup.net/in/multy	0%	Avira URL Cloud	safe
https://taylormarshall-dot-test-dot-402-bslatkin-staging.appspot.com	0%	Avira URL Cloud	safe
https://js.wpshsdk.com/npc/sdk/common/config.js	0%	Avira URL Cloud	safe
https://defjam-staging.appspot.com	0%	Avira URL Cloud	safe
https://googlecommassage-hrd.appspot.com	0%	Avira URL Cloud	safe
https://nik.googlegoro.com	0%	Virustotal		Browse
https://clientlog.cloud.google/log?format=json&hasfast=true	0%	Avira URL Cloud	safe
https://taylormarshall-dot-test-dot-402-bslatkin-staging.appspot.com	0%	Virustotal		Browse
https://js.wpadmngr.com/push/badges/pill.png	0%	Avira URL Cloud	safe
https://cdn.stgcdn.com/files/439950858060922bf976c7a20645da7a.jpg	0%	Avira URL Cloud	safe
https://website-dot-cl-syd-eap.appspot.com	0%	Avira URL Cloud	safe
https://js.wpshsdk.com/npc/sdk/common/config.js	1%	Virustotal		Browse
https://bddb2d2561.62b81f5af3.com/9dc01d48437911a2369d0f0f8dd84903.js	0%	Avira URL Cloud	safe
https://defjam-staging.appspot.com	0%	Virustotal		Browse
https://dev-dot-gweb-nextregistration.appspot.com	0%	Avira URL Cloud	safe
https://biz-beta-row.witools.foo	0%	Avira URL Cloud	safe
https://notification.tubecup.net/in/multy	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
storage.multstorage.com	104.21.30.242	true	false	0%, Virustotal, Browse	unknown
i.ytimg.com	142.250.141.119	true	false		high
js.nextpsh.top	104.21.39.40	true	false	10%, Virustotal, Browse	unknown
mobile-gtalk.l.google.com	142.251.2.188	true	false		high
gossnabgroup.ru	172.67.210.214	true	false	0%, Virustotal, Browse	unknown
nereserv.com	94.130.198.6	true	false	1%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
stats.g.doubleclick.net	142.250.141.155	true	false		high
cdn28786515.ahacdn.me	45.133.44.52	true	false		high
fp.metricswpsh.com	157.90.84.242	true	false	2%, Virustotal, Browse	unknown
play-lh.googleusercontent.com	142.251.2.119	true	false		high
www.google.com	142.251.2.99	true	false		high
winrenew-cash.life	185.155.184.32	true	false	12%, Virustotal, Browse	unknown
cdn.gdns.revopush.com	95.216.14.117	true	false	2%, Virustotal, Browse	unknown
android.l.google.com	142.250.101.100	true	false		high
cdn66489868.ahacdn.me	45.133.44.25	true	false		high
cdn.adx1.com	31.204.132.207	true	false		high
plus.l.google.com	142.251.2.113	true	false		high
cdn44221613.ahacdn.me	45.133.44.53	true	false		high
notification.tubecup.net	88.198.204.166	true	false	0%, Virustotal, Browse	unknown
payments.google.com	142.251.2.92	true	false		high
play.google.com	142.250.141.100	true	false		high
ntvpforever.com	94.130.198.6	true	false	1%, Virustotal, Browse	unknown
us.superfasti.co	109.200.209.143	true	false	0%, Virustotal, Browse	unknown
subscribers.production.wpu.sh	178.62.192.95	true	false	0%, Virustotal, Browse	unknown
js.wpadmngr.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
bddb2d2561.62b81f5af3.com	unknown	unknown	false		unknown
img.cdn.house	unknown	unknown	false	0%, Virustotal, Browse	unknown
js.wpshsdk.com	unknown	unknown	false	2%, Virustotal, Browse	unknown
sw.wpushorg.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
js.capndr.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
e32350d110.84bfe218ba.com	unknown	unknown	false	2%, Virustotal, Browse	unknown
cdn.stgcdn.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
e1f6a352a1.3ea94c3718.com	unknown	unknown	false		unknown
static.bookmsg.com	unknown	unknown	false		unknown
apis.google.com	unknown	unknown	false		high

Name	Malicious	Antivirus Detection	Reputation
https://play-lh.googleusercontent.com/La2XvLnJqNI5JyshQ5RfxM18zHduji9KPgNge93Ibwpjc7znBZVYuuwJ4ycGk6T-DQ=s64-rw	false		high
https://play-lh.googleusercontent.com/2YgTmjjbsOwLZ4vwROj2MhYIMFoaNHYbGg50Y-Yt_DG9e6h0-cylFw701szgbFrgCNo=w526-h296-rw	false		high
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-19995903-1&cid=1169434221.1709885559&jid=1062486233&gjid=541615713&_gid=1992863761.1709885559&_u=YEBAAEAAAAAAACgDI~&z=1467949968	false		high
https://i.ytimg.com/vi/C4uzmiVn8Og/hqdefault.jpg	false		high
https://play-lh.googleusercontent.com/z950eFx-wowoAV2KgHast5YFcrxoGJtY18fYd_eMgvEDVn8_tsJwApy4Dbs1iqE2tAjX=s64-rw	false		high
https://play-lh.googleusercontent.com/fDpoqIbZ884ylRnMK8Lx9Fu4DsLQk5yt4f9WkxeOAPpGnzc9BTi_YKkMsLvoMdx7Uzg=s256-rw	false		high
https://play.google.com/store/apps/details?id=com.tinder	false		high
about:blank	false	Avira URL Cloud: safe	low
https://play-lh.googleusercontent.com/a-/ALV-UjVEDgFjAocMId0v2Cxmm6MLmoD7yzAcB5ZdgKwNXzXXyFM=s32-rw	false		high
https://play-lh.googleusercontent.com/a-/ALV-UjWH6jUBtSGI7BBubov7tNbYm6JMKCh-M4rpyCwDH5Hzgz8=s32-rw	false		high
https://play-lh.googleusercontent.com/vTMochUbMqk9ehiZ7npCcwvhzOX8x0GlN1EHTW8sg58GBkcF48Vf6fwbvag5KwHxLA=s64-rw	false		high
https://cdn.stgcdn.com/files/6b7c183bc5faf7a9ba96b9f945eeaf83.jpg	false	Avira URL Cloud: safe	unknown
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-19995903-1&cid=1169434221.1709885559&jid=1062486233&_u=YEBAAEAAAAAAACgDI~&z=659014817	false		high
https://play-lh.googleusercontent.com/12USW7aflgz466ifDehKTnMoAep_VHxDmKJ6jEBoDZWCSefOC-ThRX14Mqe0r8KF9XCzrpMqJts=s20-rw	false		high
https://img.cdn.house/i/1/u5KMKIF1XZfyyXSH2MpUbH2gGje5Q5HBBLuJA3hGbrFW1WEPRUiVcPSx_hAXrkQldf-rX65sD79Uc-SKXQkvZPNwBU7iD03bMSjmtdPw4cm7R2K0Q-7mN3XXe3eFbY3dY5YklvpV7IhWHTK7Lz2mCVB4SwtnRNY-fPbYFYv06ftRTIe1CclVWnajhWb9ATfHLGmqUqikBuJKRYvt	false	Avira URL Cloud: safe	unknown
https://play-lh.googleusercontent.com/NVUOs8Vh4nvaP1pTvdrmhfzpy5rYZcWJl13uxyLjRCWZmEubC1PyjihCCi2TCO9FfQ=w526-h296-rw	false		high
https://play-lh.googleusercontent.com/D4DUUFQDCsH9NIEa8hjMjQSWdtNhGX1Fd_jT-23ogAb5uMMqttqQDUJcUt4K_u8RYOQ=s64-rw	false		high
https://play-lh.googleusercontent.com/KsCewcbhguiV2WXb5o-NM28xhZlhukM1JWU__L7POklqA3CP2DFXVfco8b4acM3wWHg=s64-rw	false		high
https://js.wpshsdk.com/npc/sdk/push/styles.css	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://play-lh.googleusercontent.com/Kjxf_QViKaL8tmk2R2gtNr8teHl7Oz9bO5ckWZkvKa5w4h7Q2eb4gYa5cjPhAyn3d3NYAfJ8XQnH=w648-h364-rw	false		high
https://js.wpadmngr.com/push/badges/love-letter.png	false	Avira URL Cloud: safe	unknown
https://notification.tubecup.net/in/multy	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://js.wpshsdk.com/npc/sdk/common/config.js	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://play-lh.googleusercontent.com/IEbtDFfx84oGJxAjMuGDOEA3gRpDqhePZ2pAkpdz2GAPBLp8Pyg5SP5AAVstmPSeSQ=s64-rw	false		high
https://play-lh.googleusercontent.com/byNQj20XRp7MfIVK7WryqB4jdyZceL087ABgIjwzZqw9y339Nz0_KLS_1B7ak51QLEg=s64-rw	false		high
https://play-lh.googleusercontent.com/9u1xt67PewWfe0nfh-ShHdyrNIDUi-eKyc73T2QBUPyWQWBn1Fnr_R2rxquLSnQdrZVe9rbFXi3u=w648-h364-rw	false		high
https://js.wpadmngr.com/push/badges/pill.png	false	Avira URL Cloud: safe	unknown
https://cdn.stgcdn.com/files/439950858060922bf976c7a20645da7a.jpg	false	Avira URL Cloud: safe	unknown
https://bddb2d2561.62b81f5af3.com/9dc01d48437911a2369d0f0f8dd84903.js	false	Avira URL Cloud: safe	unknown
https://gossnabgroup.ru/	false		unknown
https://www.google.com/tools/feedback/chat_load.js	false		high
https://play-lh.googleusercontent.com/Y9BUoMIWfhZDUFZ_MxQmnsgSyb3O8s8Sds65E_j46-vdDSJi_0Xqmoa-fHaQa7fGlw=s64-rw	false		high
https://i.ytimg.com/vi/-wpM1XofnD8/hqdefault.jpg	false		high
https://play-lh.googleusercontent.com/OmRFgoSS-iZDwzkMpygYEjbBkpY-_fpE2CEiEgj2KG0yoj2DcP01fbGMutWEf8ip2tiv=s64-rw	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_203.2.dr	false		high
https://feedback.googleusercontent.com/resources/annotator.css	chromecache_313.2.dr	false		high
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_376.2.dr	false		high
https://apis.google.com/js/client.js	chromecache_313.2.dr	false		high
https://support.google.com	chromecache_297.2.dr, chromecache_266.2.dr, chromecache_235.2.dr, chromecache_304.2.dr, chromecache_378.2.dr	false		high
https://massage-hrd-dev.googleplex.com	chromecache_304.2.dr	false		high
https://biz-qa.gcp.wazestg.com	chromecache_304.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://localhost.proxy.googlers.com/inapp/	chromecache_313.2.dr	false	URL Reputation: safe	unknown
https://gweb-nextregistration.appspot.com	chromecache_304.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://stagingqual-feedback-pa-googleapis.sandbox.google.com	chromecache_313.2.dr	false		high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_358.2.dr	false		high
https://home.ft.nest.com	chromecache_304.2.dr	false		high
https://www.youtube.com	chromecache_304.2.dr	false		high
https://checkout.youtube.com	chromecache_304.2.dr	false		high
https://vector-customer.googleplex.com/	chromecache_304.2.dr	false		high
https://www.gstatic.c..?/recaptcha/releases/QquE1_MNjnFHgZF4HPsEcf_2/recaptcha__.	chromecache_376.2.dr	false	Avira URL Cloud: safe	low
https://pay.google.com/gp/v/widget/save	chromecache_212.2.dr	false		high
https://www.editionsatplay.com	chromecache_304.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.google.com/recaptcha/#6175971	chromecache_376.2.dr	false		high
https://policies.google.com/terms;target;_blank;class;cOP9Jc	chromecache_251.2.dr	false		high
https://www.google.com/shopping/customerreviews/optin?usegapi=1	chromecache_212.2.dr	false		high
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	chromecache_313.2.dr	false	URL Reputation: safe	unknown
https://stats.g.doubleclick.net/j/collect	chromecache_358.2.dr	false		high
https://support.google.com/googleplay/?p=report_content	chromecache_251.2.dr, chromecache_246.2.dr	false		high
https://support.google.com/recaptcha	chromecache_376.2.dr	false		high
https://console.cloud.google	chromecache_304.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/tools/feedback	chromecache_313.2.dr, chromecache_339.2.dr	false		high
https://payments-demoserver-sandbox.corp.cloud.google	chromecache_304.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sandbox.google.com/inapp/%	chromecache_313.2.dr	false		high
https://3-dot-gweb-io2016-registration.appspot.com	chromecache_304.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://apis.google.com/js/api.js	chromecache_212.2.dr, chromecache_331.2.dr, chromecache_275.2.dr, chromecache_168.2.dr, chromecache_202.2.dr	false		high
https://payments.cloud.google	chromecache_304.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/tools/feedback/	chromecache_313.2.dr	false		high
https://www.youtube.com/subscribe_embed?usegapi=1	chromecache_212.2.dr	false		high
https://biz.gcp.wazestg.com	chromecache_304.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://schema.org	chromecache_251.2.dr	false		high
https://nik.googlegoro.com	chromecache_304.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://feedback2-test.corp.google.com/tools/feedback/%	chromecache_313.2.dr	false		high
https://arctic-ocean-116022.appspot.com	chromecache_304.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://plus.google.com	chromecache_309.2.dr	false		high
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_376.2.dr	false		high
https://asx-frontend-autopush.corp.google.de/tools/feedback/	chromecache_313.2.dr	false		high
https://asx-frontend-autopush.corp.google.com/inapp/	chromecache_313.2.dr	false		high
https://feedback.googleusercontent.com/resources/render_frame2.html	chromecache_313.2.dr	false		high
https://sandbox.google.com/tools/feedback/%	chromecache_313.2.dr	false		high
https://taylormarshall-dot-test-dot-402-bslatkin-staging.appspot.com	chromecache_304.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/g/collect?v=2&	chromecache_203.2.dr	false		high
https://play.google.com/work/embedded/search?usegapi=1&usegapi=1	chromecache_212.2.dr	false		high
https://policies.google.com/privacy	chromecache_322.2.dr, chromecache_300.2.dr, chromecache_251.2.dr, chromecache_332.2.dr, chromecache_246.2.dr, chromecache_377.2.dr, chromecache_371.2.dr, chromecache_169.2.dr	false		high
https://defjam-staging.appspot.com	chromecache_304.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://googlecommassage-hrd.appspot.com	chromecache_304.2.dr	false	Avira URL Cloud: safe	unknown
https://clientlog.cloud.google/log?format=json&hasfast=true	chromecache_304.2.dr	false	Avira URL Cloud: safe	unknown
https://yt-web-release.corp.youtube.com	chromecache_304.2.dr	false		high
https://website-dot-cl-syd-eap.appspot.com	chromecache_304.2.dr	false	Avira URL Cloud: safe	unknown
https://payments.sandbox.google.com/payments/v4/js/integrator.js?rk=1	chromecache_207.2.dr, chromecache_345.2.dr	false		high
https://play.google.com	chromecache_297.2.dr, chromecache_266.2.dr, chromecache_235.2.dr, chromecache_304.2.dr, chromecache_378.2.dr	false		high
https://biz-beta-row.witools.foo	chromecache_304.2.dr	false	Avira URL Cloud: safe	unknown
https://major.home.integration.nestlabs.com	chromecache_304.2.dr	false		high
https://www.google.com/log?format=json&hasfast=true	chromecache_331.2.dr, chromecache_275.2.dr, chromecache_168.2.dr, chromecache_202.2.dr	false		high
https://support.google.com/inapp/%	chromecache_313.2.dr	false		high
https://youtube-xsell-tool-stg.googleplex.com	chromecache_304.2.dr	false		high
https://vector-perf-customer.googleplex.com/	chromecache_304.2.dr	false		high
https://cloud.google.com/contact	chromecache_376.2.dr	false		high
https://www.google.com/shopping/customerreviews/badge?usegapi=1	chromecache_212.2.dr	false		high
https://dev-dot-gweb-nextregistration.appspot.com	chromecache_304.2.dr	false	Avira URL Cloud: safe	unknown
https://drive.google.com/savetodrivebutton?usegapi=1	chromecache_212.2.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
45.133.44.25	cdn66489868.ahacdn.me	Turkey	59447	SAYFANETTR	false
185.155.184.32	winrenew-cash.life	Switzerland	44160	INTERNETONEInternetServicesProviderIT	false
45.133.44.24	unknown	Turkey	59447	SAYFANETTR	false
94.130.198.6	nereserv.com	Germany	24940	HETZNER-ASDE	false
109.200.209.143	us.superfasti.co	Netherlands	49544	I3DNETNL	false
178.62.192.95	subscribers.production.wpu.sh	European Union	14061	DIGITALOCEAN-ASNUS	false
104.21.30.242	storage.multstorage.com	United States	13335	CLOUDFLARENETUS	false
88.198.204.166	notification.tubecup.net	Germany	24940	HETZNER-ASDE	false
142.251.2.119	play-lh.googleusercontent.com	United States	15169	GOOGLEUS	false
157.90.84.242	fp.metricswpsh.com	United States	766	REDIRISRedIRISAutonomousSystemES	false
142.251.2.99	www.google.com	United States	15169	GOOGLEUS	false
104.21.39.40	js.nextpsh.top	United States	13335	CLOUDFLARENETUS	false
167.235.163.216	unknown	United States	3525	ALBERTSONSUS	false
45.133.44.53	cdn44221613.ahacdn.me	Turkey	59447	SAYFANETTR	false
45.133.44.52	cdn28786515.ahacdn.me	Turkey	59447	SAYFANETTR	false
142.250.101.100	android.l.google.com	United States	15169	GOOGLEUS	false
142.251.2.92	payments.google.com	United States	15169	GOOGLEUS	false
142.250.101.99	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.67.210.214	gossnabgroup.ru	United States	13335	CLOUDFLARENETUS	false
142.250.141.119	i.ytimg.com	United States	15169	GOOGLEUS	false
31.204.132.207	cdn.adx1.com	Netherlands	49544	I3DNETNL	false
95.216.14.117	cdn.gdns.revopush.com	Germany	24940	HETZNER-ASDE	false
142.251.2.188	mobile-gtalk.l.google.com	United States	15169	GOOGLEUS	false
142.250.141.155	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1405276
Start date and time:	2024-03-08 09:11:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	http://gossnabgroup.ru
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.win@25/363@84/27
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://play.google.com/store/games Browse: https://play.google.com/store/apps/dev?id=8070166968320699506 Browse: https://play.google.com/store/apps/category/DATING

IP
192.168.2.4
192.168.2.5

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	486
Entropy (8bit):	7.456735643048542
Encrypted:	false
SSDEEP:	12:rbPqOLycYgACU4do/wZVbEqb0hyCQRdLOdsw:rbyUyXgdo/wZVbEvHObw
MD5:	CEEB4E8840C24621C0E0352B42B38A5B
SHA1:	03CBCEB0134A39267014595938705E2916580644
SHA-256:	50CB77AE9715629235F102DD53A68559DF1B64416F71179DBB4AA942725790B3
SHA-512:	80D4128488580567597BA5EB65DBFF2DD4A8EFC625C64CAC6A027A1BB5C229545206669F04A50A252B54F471BEE4FDC892E6BFE8347A50DD216BBA67BD671A03
Malicious:	false
Reputation:	low
URL:	https://static.bookmsg.com/creatives/SG/SG_083be47dfc3e28c9a68305b76181a5033bc45790_icon.webp?pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-b_r-body&mlf=1&mlc=1&st=0.11&cpa=446c008d-62f6-43d5-8007-6b0144ac2eaf&prev_step_diff=4097
Preview:	RIFF....WEBPVP8 .........d.d.?9..\/.&".Z..'.gl.>.". h.q/.O...m..v..>. {.]..AP..F.l....^.O....jd.I$&V.?..'...,z..].&..Q.+.......1Tg..Q...e..!t.....W ...y...)....r...m...3?..C...f.^......i.K.$B..}...R..m.g..5....PFg.lZ.\....X8...1m.Q........).c....t..C.9...&.E.{..x....q..rCI..:.H.N....8......q:S.VLs.Z.'lF.za..K9nU..Yk.Z.y.....h/5&.U.l.t....:..f...-.~iL....a..O..9..dR...g_(B.....h..p8~..0..EWB..?0.rV.A........z.Q.c..fZ.....M.5...D.h:........#i.u...,BA..aU[.hC5@..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2162)
Category:	downloaded
Size (bytes):	195575
Entropy (8bit):	5.484447098062502
Encrypted:	false
SSDEEP:	3072:ZHARgMLVYxC4rboc7KTgdFiQnBCckeGrxygKxP/toI0QFY3o1u7ojsVFcSFgFlnF:ZHARgMLV4RrboSKTgdFiQBCck7rxygKR
MD5:	AB8804FC24BF364CA1169FF0F7D9192F
SHA1:	4B1E723246EA6F88C1F7E07895777AE99DC3E2C5
SHA-256:	5461579426FD97036CE5C52E27625C2B61085DC38E8FDB81992FD5E825A26DDB
SHA-512:	883BF8FACEC5C3E19274150332F3AF17618C9D5A54C6BA938A4F445DE91A6C66F8FD3E6E9E6ADF30AFB1F691483A374ECD86CBD23ECEF97E6813070B929B0E1E
Malicious:	false
Reputation:	low
URL:	"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.Q_BxHty5I84.2021.O/am=022DoYEFBv4jfQ-2/d=1/excm=_b,_tp,appdetailsview/ed=1/dg=0/wt=2/ujg=1/rs=AB1caFU4y67OJEhh6CzWJiwmF9DXNHswJA/m=_b,_tp"
Preview:	"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x21836dd3, 0x38181606, 0x20f7d23f, 0x2d, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././. SPDX-License-Identifier: Apache-2.0././.. Copyright 2013 Google LLC.. SPDX-License-Identifier: Apache-2.0./.var baa,daa,haa,laa,Ja,Ma,Oa,maa,naa,oaa,paa,Va,Xa,raa,uaa,kb,Haa,Jaa,Gb,Ib,Naa,Paa,Qaa,Uaa,bba,hba,iba,jba,lba,oc,nc,oba,Bc,tba,sba,uba,vba,Cc,wba,yba,Hc,Aba,Rc,Bba,Tba,Qc,Vba,Oc,Wba,Dc,bca,ed,lca,nd,nca,od,rca,tca,xca,yca,Aca,Bca,Fca,Hca,Lca,Mca,Nca,Rca,Zca,Vca,ada,ce,fda,gda,ida,ne,pda,rda,te,sda,uda,vda,zda,Bda,Eda,Fda,Gda,Hda,Ida,Lda,Mda,Qda,Wda,Xda,Yda,$da,dea,eea,fea,aaa,gea,hea,iea,jea;_.p=function(a){return function(){return aaa[a].

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1142)
Category:	downloaded
Size (bytes):	18939
Entropy (8bit):	5.671340841999808
Encrypted:	false
SSDEEP:	384:ZlAjJyXrH4i8ViAfav6jfNMy5kuNHk8p4ITqRrNKYugHQ6Og8MDqryIz4pHJriqz:ZlAjQXrYiAfav6jfNM1uNHk8p4oqRrN/
MD5:	B98C43C54254DF5830E5DE6F0C6FAD64
SHA1:	7B49FF8A3F37824C81E45DB4F28938F71C0364FD
SHA-256:	5B8BD1DF219E3CCF74E50FC3229741197475910D1B16AF31E7E079A47987976A
SHA-512:	725EFF6695FA2DC97B30F40775FE9C6E5255C924C1126EA5205CD570ADB49963215A3CA6D8505787F65CC3E7B7379970835E713E07B0000F7BA514FCE32A29ED
Malicious:	false
Reputation:	low
URL:	"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.Q_BxHty5I84.2021.O/ck=boq-play.PlayStoreUi.yLOfNYXhHv8.L.B1.O/am=022DoYEFBv4jfQ-2/d=1/exm=A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,COQbmf,EEDORb,EFQ78c,GkRiKb,IJGqxf,IZT63,IcVnM,JH2zc,JNoxi,JWUKXe,KG2eXe,KUM7Z,L1AAkb,LCkxpb,LEikZe,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,QIhFr,RMhBfe,RQJprf,RqjULd,SWD8cc,SdcwHb,SpsfSb,U0aPgd,UUJqVe,Uas9Hd,Ulmmrd,V3dDOb,VwDzFe,WO9ee,XVMNvd,Z5uLle,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,bm51tf,byfTOb,chfSwc,e5qFLc,fI4Vwc,fKUV3e,fdeHmf,fl2Zj,gychg,hKSk3e,hc6Ubd,indMcf,j9sf1,jX6UVc,kJXwXb,kWgXee,kjKdXe,kr6Nlf,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,n73qwf,nKuFpb,oEJvKc,ovKuLd,pYCIec,pjICDe,pw70Gc,q4UNLc,qfGEyb,rpbmN,s39S4,sJhETb,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w9hDv,wW2D8b,wg1P6b,ws9Tlc,xQtZb,xUdipf,yDVVkb,ywOR5c,z5Gxfe,zBPctc,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFWkNlDOp0fBemB9CcPjGshi9lHtFg/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:QIhFr;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;sgjhQc:bQAegc;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=dfkSTe"
Preview:	"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi\|\|{};(function(_){var window=this;.try{._.Me(_.yoa);._.u("sOXFj");.var ywa=class extends _.nq{constructor(a){super(a.wa)}H(a){return a()}};_.pq(_.xoa,ywa);._.w();._.u("oGtAuc");._.pwa=new _.ej(_.yoa);._.w();._.qwa=class extends _.rk{static Ja(){return{Th:{EW:function(){return _.De(this)}}}}constructor(a){super(a.wa);this.soy=this.sj=null;if(this.Mj()){var b=_.gj(this.Tg(),[_.Dj,_.Cj]);b=_.re([b[_.Dj],b[_.Cj]]).then(function(c){this.soy=c[0];this.sj=c[1]},null,this);_.qk(this,b)}this.Pa=a.Th.EW}getContext(a){return this.Pa.getContext(a)}getData(a){return this.Pa.getData(a)}Hp(){_.Xk(this.sj.Oe())}rF(){}};_.lr=(a,b)=>{_.pk(b);a&&_.dj.Ib().register(a,b)};._.u("q0xTif");.var swa=function(a){const b=c=>{_.zk(c)&&(_.zk(c).mc=null,_.Wq(c,null));c.XyHi9&&(c.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(let c=0;c<a.length;c++)b(a[c])};var twa,uwa,vwa,wwa;twa=function(a){const b=a.hb();return(...c)=>a.Ta.H(()=>b(...c))};uwa=fu

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 8, 2024 09:11:52.077917099 CET	49675	443	192.168.2.4	173.222.162.32
Mar 8, 2024 09:12:01.782766104 CET	49675	443	192.168.2.4	173.222.162.32
Mar 8, 2024 09:12:04.408004045 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:04.408055067 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:04.408123016 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:04.408442974 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:04.408457994 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:04.736741066 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:04.737176895 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:04.737205029 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:04.738733053 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:04.738817930 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:04.740255117 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:04.740329027 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:04.741003990 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:04.741010904 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:04.787267923 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:05.399188995 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.399260998 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.399302006 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.399337053 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:05.399354935 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.399396896 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:05.399404049 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.399486065 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.399537086 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.399549007 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:05.399561882 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.399621010 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:05.399626017 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.399730921 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.399774075 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:05.399780035 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.400526047 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.400573015 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:05.400579929 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.401182890 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.401230097 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:05.401236057 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.401299000 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.401338100 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:05.401345015 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.402033091 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.402085066 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:05.402091026 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.402237892 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.402308941 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:05.464854956 CET	49736	443	192.168.2.4	172.67.210.214
Mar 8, 2024 09:12:05.464886904 CET	443	49736	172.67.210.214	192.168.2.4
Mar 8, 2024 09:12:05.775003910 CET	49737	443	192.168.2.4	142.251.2.99
Mar 8, 2024 09:12:05.775080919 CET	443	49737	142.251.2.99	192.168.2.4
Mar 8, 2024 09:12:05.775167942 CET	49737	443	192.168.2.4	142.251.2.99
Mar 8, 2024 09:12:05.776503086 CET	49737	443	192.168.2.4	142.251.2.99
Mar 8, 2024 09:12:05.776537895 CET	443	49737	142.251.2.99	192.168.2.4
Mar 8, 2024 09:12:05.928159952 CET	49738	443	192.168.2.4	104.21.39.40
Mar 8, 2024 09:12:05.928196907 CET	443	49738	104.21.39.40	192.168.2.4
Mar 8, 2024 09:12:05.928266048 CET	49738	443	192.168.2.4	104.21.39.40
Mar 8, 2024 09:12:05.929121971 CET	49738	443	192.168.2.4	104.21.39.40
Mar 8, 2024 09:12:05.929140091 CET	443	49738	104.21.39.40	192.168.2.4
Mar 8, 2024 09:12:06.146512985 CET	443	49737	142.251.2.99	192.168.2.4
Mar 8, 2024 09:12:06.146903992 CET	49737	443	192.168.2.4	142.251.2.99
Mar 8, 2024 09:12:06.146965981 CET	443	49737	142.251.2.99	192.168.2.4
Mar 8, 2024 09:12:06.148458004 CET	443	49737	142.251.2.99	192.168.2.4
Mar 8, 2024 09:12:06.148536921 CET	49737	443	192.168.2.4	142.251.2.99
Mar 8, 2024 09:12:06.262893915 CET	443	49738	104.21.39.40	192.168.2.4
Mar 8, 2024 09:12:06.263556004 CET	49738	443	192.168.2.4	104.21.39.40
Mar 8, 2024 09:12:06.263585091 CET	443	49738	104.21.39.40	192.168.2.4
Mar 8, 2024 09:12:06.265089989 CET	443	49738	104.21.39.40	192.168.2.4
Mar 8, 2024 09:12:06.265152931 CET	49738	443	192.168.2.4	104.21.39.40
Mar 8, 2024 09:12:06.313271046 CET	49738	443	192.168.2.4	104.21.39.40
Mar 8, 2024 09:12:06.331804037 CET	49737	443	192.168.2.4	142.251.2.99
Mar 8, 2024 09:12:06.332079887 CET	443	49737	142.251.2.99	192.168.2.4
Mar 8, 2024 09:12:06.333187103 CET	49738	443	192.168.2.4	104.21.39.40
Mar 8, 2024 09:12:06.333260059 CET	49738	443	192.168.2.4	104.21.39.40
Mar 8, 2024 09:12:06.333368063 CET	443	49738	104.21.39.40	192.168.2.4
Mar 8, 2024 09:12:06.374865055 CET	49738	443	192.168.2.4	104.21.39.40
Mar 8, 2024 09:12:06.374891996 CET	443	49738	104.21.39.40	192.168.2.4
Mar 8, 2024 09:12:06.374933004 CET	49737	443	192.168.2.4	142.251.2.99
Mar 8, 2024 09:12:06.374990940 CET	443	49737	142.251.2.99	192.168.2.4
Mar 8, 2024 09:12:06.420697927 CET	49738	443	192.168.2.4	104.21.39.40
Mar 8, 2024 09:12:06.420819044 CET	49737	443	192.168.2.4	142.251.2.99
Mar 8, 2024 09:12:06.602186918 CET	49739	443	192.168.2.4	23.202.57.177
Mar 8, 2024 09:12:06.602210999 CET	443	49739	23.202.57.177	192.168.2.4
Mar 8, 2024 09:12:06.602330923 CET	49739	443	192.168.2.4	23.202.57.177
Mar 8, 2024 09:12:06.606462002 CET	49739	443	192.168.2.4	23.202.57.177
Mar 8, 2024 09:12:06.606471062 CET	443	49739	23.202.57.177	192.168.2.4
Mar 8, 2024 09:12:06.926927090 CET	443	49738	104.21.39.40	192.168.2.4
Mar 8, 2024 09:12:06.927207947 CET	443	49738	104.21.39.40	192.168.2.4
Mar 8, 2024 09:12:06.927346945 CET	49738	443	192.168.2.4	104.21.39.40
Mar 8, 2024 09:12:06.927964926 CET	49738	443	192.168.2.4	104.21.39.40
Mar 8, 2024 09:12:06.927984953 CET	443	49738	104.21.39.40	192.168.2.4
Mar 8, 2024 09:12:06.954680920 CET	443	49739	23.202.57.177	192.168.2.4
Mar 8, 2024 09:12:06.954881907 CET	49739	443	192.168.2.4	23.202.57.177
Mar 8, 2024 09:12:06.980309963 CET	49739	443	192.168.2.4	23.202.57.177
Mar 8, 2024 09:12:06.980330944 CET	443	49739	23.202.57.177	192.168.2.4
Mar 8, 2024 09:12:06.981236935 CET	443	49739	23.202.57.177	192.168.2.4
Mar 8, 2024 09:12:07.030402899 CET	49739	443	192.168.2.4	23.202.57.177
Mar 8, 2024 09:12:07.081847906 CET	49739	443	192.168.2.4	23.202.57.177
Mar 8, 2024 09:12:07.128238916 CET	443	49739	23.202.57.177	192.168.2.4
Mar 8, 2024 09:12:07.138323069 CET	49740	443	192.168.2.4	45.133.44.52

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 8, 2024 09:12:01.816157103 CET	53	57707	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:01.931332111 CET	53	58577	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:03.750606060 CET	61833	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:03.751085997 CET	65198	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:03.932265997 CET	53	50449	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:04.247452021 CET	53	61833	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:04.247869968 CET	53	65198	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:04.251435995 CET	60549	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:04.251576900 CET	49301	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:04.406781912 CET	53	60549	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:04.407143116 CET	53	49301	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:05.474977016 CET	49607	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:05.476145983 CET	52636	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:05.616224051 CET	51237	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:05.616722107 CET	62717	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:05.771434069 CET	53	51237	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:05.771500111 CET	53	62717	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:05.926214933 CET	53	49607	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:05.926326990 CET	53	52636	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:06.981843948 CET	62939	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:06.982451916 CET	58660	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:07.137588024 CET	53	62939	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:07.137634039 CET	53	58660	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:08.153665066 CET	55500	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:08.153930902 CET	57409	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:08.309452057 CET	53	55500	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:08.309499979 CET	53	57409	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:09.291646957 CET	64841	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:09.292347908 CET	59895	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:09.292592049 CET	49253	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:09.294979095 CET	50941	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:09.352161884 CET	50504	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:09.352672100 CET	61838	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:09.354243040 CET	56255	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:09.354629040 CET	55500	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:09.369925022 CET	54366	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:09.370467901 CET	63985	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:09.447449923 CET	53	49253	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:09.447540045 CET	53	59895	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:09.448215961 CET	53	64841	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:09.450058937 CET	53	50941	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:09.507214069 CET	53	50504	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:09.507333040 CET	53	61838	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:09.509114027 CET	53	55500	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:09.509193897 CET	53	56255	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:09.524912119 CET	53	54366	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:09.525443077 CET	53	63985	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:10.618345022 CET	52092	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:10.618957996 CET	54069	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:10.650882006 CET	63763	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:10.651665926 CET	56440	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:10.705724955 CET	53	52470	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:10.773355961 CET	53	52092	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:10.806869984 CET	53	56440	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:10.824035883 CET	53	63763	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:10.978207111 CET	53	54069	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:12.294271946 CET	62230	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:12.294491053 CET	65489	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:12.449306011 CET	53	62230	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:12.450572968 CET	53	65489	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:12.540030003 CET	50327	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:12.540450096 CET	57652	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:12.648438931 CET	61330	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:12.648948908 CET	53753	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:12.695254087 CET	53	50327	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:12.695420027 CET	53	57652	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:12.868590117 CET	53	53753	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:12.869323969 CET	53	61330	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:13.402642965 CET	56721	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:13.411117077 CET	62830	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:13.557892084 CET	53	56721	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:13.566356897 CET	53	62830	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:15.404321909 CET	53148	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:15.410892010 CET	57458	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:15.417076111 CET	58193	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:15.417740107 CET	57157	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:15.418551922 CET	56882	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:15.418823957 CET	58989	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:15.559638023 CET	53	53148	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:15.566610098 CET	53	57458	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:15.641114950 CET	53	58193	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:15.641294003 CET	53	57157	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:15.643142939 CET	53	56882	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:15.643224001 CET	53	58989	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:16.758594036 CET	64061	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:16.758991957 CET	62132	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:16.832560062 CET	59517	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:16.833002090 CET	49344	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:16.913563013 CET	53	62132	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:16.987978935 CET	53	59517	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:16.988333941 CET	53	49344	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:17.051561117 CET	53	64061	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:17.143495083 CET	50902	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:17.144490957 CET	64269	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:17.299006939 CET	53	50902	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:17.299181938 CET	53	64269	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:19.035655022 CET	60416	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:19.038242102 CET	56089	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:19.191184044 CET	53	60416	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:19.193603039 CET	53	56089	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:19.997683048 CET	138	138	192.168.2.4	192.168.2.255
Mar 8, 2024 09:12:20.452008963 CET	56547	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:20.452677965 CET	63312	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:20.607666969 CET	53	56547	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:20.608216047 CET	53	63312	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:22.284010887 CET	53	61010	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:30.159965992 CET	55072	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:30.163701057 CET	55306	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:30.413796902 CET	53	55072	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:30.413815975 CET	53	55306	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:31.777200937 CET	65270	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:31.777384043 CET	54879	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:31.932189941 CET	53	54879	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:31.932261944 CET	53	65270	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:33.756242990 CET	56392	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:33.756602049 CET	57011	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:33.881679058 CET	53	59930	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:33.902201891 CET	53	53719	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:33.910976887 CET	53	56392	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:33.944654942 CET	53	57011	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:34.700253963 CET	60422	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:34.700593948 CET	50175	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:34.792063951 CET	53	54569	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:34.854743004 CET	53	60422	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:34.856384039 CET	53	50175	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:36.350462914 CET	53	56703	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:37.235322952 CET	53	61615	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:39.070031881 CET	53	60995	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:39.072134972 CET	53	65120	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:40.918587923 CET	62751	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:40.918966055 CET	50076	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:41.067455053 CET	53	64663	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:41.073646069 CET	53	62751	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:41.073728085 CET	53	50076	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:41.084203005 CET	53	51843	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:41.629056931 CET	53	64940	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:41.818464994 CET	49477	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:41.818464994 CET	56370	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:41.973175049 CET	53	49477	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:41.973444939 CET	53	56370	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:42.594067097 CET	55634	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:42.596007109 CET	56290	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:42.749085903 CET	53	55634	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:42.750535011 CET	53	56290	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:43.087387085 CET	61745	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:43.088254929 CET	55822	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:43.242106915 CET	53	61745	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:43.243180990 CET	53	55822	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:46.634991884 CET	53	53073	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:53.075536966 CET	57191	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:53.076508999 CET	64741	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:53.082935095 CET	53516	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:53.083529949 CET	49823	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:53.231154919 CET	53	57191	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:53.231643915 CET	53	64741	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:53.238109112 CET	53	53516	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:53.238243103 CET	53	49823	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:55.960808992 CET	64160	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:55.960846901 CET	52289	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:56.115976095 CET	53	64160	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:56.116712093 CET	53	52289	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:56.330061913 CET	57931	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:56.330249071 CET	63355	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:56.590627909 CET	53	57931	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:56.590656042 CET	53	63355	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:56.923827887 CET	59191	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:56.924098015 CET	59520	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:12:57.078161001 CET	53	59191	1.1.1.1	192.168.2.4
Mar 8, 2024 09:12:57.078700066 CET	53	59520	1.1.1.1	192.168.2.4
Mar 8, 2024 09:13:01.313594103 CET	53	54805	1.1.1.1	192.168.2.4
Mar 8, 2024 09:13:04.080365896 CET	53	51043	1.1.1.1	192.168.2.4
Mar 8, 2024 09:13:17.719887018 CET	57594	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:13:17.722456932 CET	64776	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:13:17.722853899 CET	65226	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:13:17.723079920 CET	64584	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:13:17.877674103 CET	53	64776	1.1.1.1	192.168.2.4
Mar 8, 2024 09:13:17.877888918 CET	53	65226	1.1.1.1	192.168.2.4
Mar 8, 2024 09:13:17.878180027 CET	53	64584	1.1.1.1	192.168.2.4
Mar 8, 2024 09:13:18.031425953 CET	53	57594	1.1.1.1	192.168.2.4
Mar 8, 2024 09:13:30.560456991 CET	53	51727	1.1.1.1	192.168.2.4
Mar 8, 2024 09:13:33.438971996 CET	61900	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:13:33.439390898 CET	52816	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:13:33.594059944 CET	53	52816	1.1.1.1	192.168.2.4
Mar 8, 2024 09:13:33.594104052 CET	53	61900	1.1.1.1	192.168.2.4
Mar 8, 2024 09:13:52.942486048 CET	55394	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:13:52.942972898 CET	50962	53	192.168.2.4	1.1.1.1
Mar 8, 2024 09:13:53.098212004 CET	53	55394	1.1.1.1	192.168.2.4
Mar 8, 2024 09:13:53.098659039 CET	53	50962	1.1.1.1	192.168.2.4

Target ID:	0
Start time:	09:11:55
Start date:	08/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	09:12:00
Start date:	08/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2284,i,3100902536086182891,1735761918452591964,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	09:12:02
Start date:	08/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "http://gossnabgroup.ru
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://gossnabgroup.ru

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Chrome Cache Entry: 172

Chrome Cache Entry: 173

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 188

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Windows Analysis Report
http://gossnabgroup.ru