Windows Analysis Report
WaffMEMZ-1.0-Destructive.exe

Overview

General Information

Sample name: WaffMEMZ-1.0-Destructive.exe
Analysis ID: 1417345
MD5: 90611031cb0669ce1ca71fa3d04f6e47
SHA1: 5e2c3015356cfa19d180c7d76bc73e60a2dd63c0
SHA256: 3d1c271c943780768ef58880c4a402811add9ea4a4cf5dab4c5b679f160ee373
Tags: exe
Infos:

Detection

KillMBR
Score: 63
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Phishing site detected (based on favicon image match)
Yara detected KillMBR
Contains functionality to access PhysicalDrive, possible boot sector overwrite
Contains functionality to infect the boot sector
Writes directly to the primary disk partition (DR0)
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
HTML body with high number of embedded images detected
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sleep loop found (likely to delay execution)
Tries to load missing DLLs
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: WaffMEMZ-1.0-Destructive.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: WaffMEMZ-1.0-Destructive.exe ReversingLabs: Detection: 80%
Source: WaffMEMZ-1.0-Destructive.exe Virustotal: Detection: 80% Perma Link
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 0_2_00341C30 CryptAcquireContextW,ExitProcess,CryptGenRandom, 0_2_00341C30
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 1_2_00341C30 CryptAcquireContextW,ExitProcess,CryptGenRandom, 1_2_00341C30

Phishing
barindex
Phishing site detected (based on favicon image match)
Source: https://google.co.ck Matcher: Template: facebook matched with high similarity
HTML body with high number of embedded images detected
Source: https://www.google.co.ck/search?q=cats&tbm=isch&sfr=vfe HTTP Parser: Total embedded image size: 238871
Source: https://www.google.co.ck/search?q=cats&tbm=isch&sfr=vfe#imgrc=huRXJHlMpmgP5M HTTP Parser: Total embedded image size: 244278
Source: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dfree%2Bgoogle%2Bplay%2Bcards%2Bno%2Bsurvey%2B2017&q=EgRmpTArGKCgmLAGIjBejhpNZGjmgux3KJ7Mslb3CzKIY-3UW9hy9mDpMJDo3JyBw-KBzf9SLys5rlZ2u_EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dfree%2Bgoogle%2Bplay%2Bcards%2Bno%2Bsurvey%2B2017&q=EgRmpTArGKCgmLAGIjBejhpNZGjmgux3KJ7Mslb3CzKIY-3UW9hy9mDpMJDo3JyBw-KBzf9SLys5rlZ2u_EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dfree%2Bgoogle%2Bplay%2Bcards%2Bno%2Bsurvey%2B2017&q=EgRmpTArGKCgmLAGIjBejhpNZGjmgux3KJ7Mslb3CzKIY-3UW9hy9mDpMJDo3JyBw-KBzf9SLys5rlZ2u_EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dfree%2Bgoogle%2Bplay%2Bcards%2Bno%2Bsurvey%2B2017&q=EgRmpTArGKCgmLAGIjBejhpNZGjmgux3KJ7Mslb3CzKIY-3UW9hy9mDpMJDo3JyBw-KBzf9SLys5rlZ2u_EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=S3woggdlKDNhk03qjYJLqs41XUZTODqiC9GZV7OYwRHG6m__DElQMnH-7O3bk-agOFSr33GgIao3TY09HmnFu3cWlSA49rYZEDM3L3qkQ2J0TS_FUMCuIN05Q6HQ2KrcvCihJs9s8MNF7HJJbTgd3N6LbF7nxjDK7rdgnpACvHlic1MJ6i0ffGPKIh9w5IkPIl8KvQ4mGhS-9CDY9sT-bXDgHIxj0XAv1ntFOs1El86lsUbA3oGtsaq-63fMsNpAMed7qxI1yniyVl4iEyoBtUJMUCdqkeE&cb=a41b0ezi7o34 HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=LDUdQoUcnidKdzRog69t7KkpL2ZQAa0l0KfAcqhuZc79wCqNrMw7JQvRA4vZRheRPfKcFLKPQ-2kQLHLh13C2joH-wRod1dZh3NSW2w-h_m3lUm3LXmfx9WkVylpM4hsIM2lzWaQZIycIh_QCTcRL7oF61DMPsC8uxLcYLSFrqkTEgXFZcyO0I90HFmm-fhccURuhggGfRb56oMeO6DvaDMOKqEAHM_tHkFMvWpLNiG034ehTgrW_Ev87GrWkRaScmwtugTMOodiy2UFlR41FMFvVpxv-eQ&cb=j1xpn4fbpzx7 HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=P4BD8b56xBTNXowtcKUS22wu17TqN8Bv01GbJDGqKIHLzC804mts0yPksi5i_MW-DHRl1g_isZQXHRMFEwiggCElkawKY_zlQOT3ebobVJlv5BZ_Lr4OMZhWDZsVQGxK100mHvBL2efkDRABIqmv8qODPdp5Ai3wCNZDoMdBXPqRSL9k45D02TzCpGXc7Mtuka5YN7bK00bcKMS6ZBk3sG_zaMULTyCp6te6I9JWZ8OMQsHiQyCyUZvW7q6C1poJYOG4ibLd-2iHLQgfyaIuAWsAFS5Tm-E&cb=2bq7ng1hpp1 HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dhow%2Bto%2Bmake%2Ba%2Bsandwich&q=EgRmpTArGLOgmLAGIjARsngc98PJpA56iG9TBPFT2CwJONbwm6MVwH44hDvwNC4XBiroxlacmilxkXTEwNoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP Parser: No favicon
Source: https://www.google.co.ck/search?q=cats&tbm=isch&sfr=vfe HTTP Parser: No favicon
Source: https://www.google.co.ck/search?q=cats&tbm=isch&sfr=vfe HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dhow%2Bto%2Bmove%2Bto%2Bnorth%2Bkorea&q=EgRmpTArGNOgmLAGIjDlNYqX949h36LFJxbB2S_iUgLOhTc5b3u5uxrVywo3_bh-y4VQdwBFOW8YO0WpjosyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dhow%2Bto%2Bmove%2Bto%2Bnorth%2Bkorea&q=EgRmpTArGNOgmLAGIjDlNYqX949h36LFJxbB2S_iUgLOhTc5b3u5uxrVywo3_bh-y4VQdwBFOW8YO0WpjosyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=kqcZW0c0TSFj6U8QC5LgbdC8BEsTuul4Wo5e2HjGNH41psMYmD3AUS4PcRHuZenPEmX_zafBhSiUGJl46in51b6UDVxgk66sfL5g8KbxxlAU_hLGpyibfmc31DSVqJf4yoIQ2slxFQPGIRVxfMvR-WJxxH2In0NVt18GChBnT_oOhdExRcETg4xLowjmL4MqP2CPcEImwzZA60BL5XfsiJTOu1Ke65gqnlsVlj0ge_CM3z1Mmr9EsxLbT2AYOFOTHZH1Fj2VZGNUpiE-Z9kejDl8ML-a1n4&cb=v3izh5nenri2 HTTP Parser: No favicon
Source: https://www.google.co.ck/search?q=cats&tbm=isch&sfr=vfe#imgrc=huRXJHlMpmgP5M HTTP Parser: No favicon
Source: https://www.google.co.ck/search?q=cats&tbm=isch&sfr=vfe#imgrc=huRXJHlMpmgP5M HTTP Parser: No favicon
Uses 32bit PE files
Source: WaffMEMZ-1.0-Destructive.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.52.162.98:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.52.162.98:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: WaffMEMZ-1.0-Destructive.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: '">';h='<div class="'+_.B("GYd9oe")+'">';var l=e?136:152;b=_.bf(_.af(b));for(var n=b.length,p=0;p<n;p++){var q=b[p],r=void 0,w=void 0;h+=c?oDb(a,q,p,l+(null!=(r=g)?r:0)):_.pDb({pla:q,Ll:p,Zj:l+(null!=(w=g)?w:0),Hjb:e},a)}c=(0,_.M)(h+"</div>");d+=_.SB(a,c,void 0,void 0,void 0,"eaevp",void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,"tP1BTe LgD65d")+"</div>";a=(0,_.M)(d);return(0,_.M)(f+a+"</div>")}; source: chromecache_473.13.dr
Source: Binary string: 2)+"-"+_.Pj(_.Ql(g),3))+'"'+_.Fp(_.Zy(b))+">"+_.pDb({pla:g,Ll:g.Sd(),fw:!0,ew:!0,yr:!0,t2:c,Te:f.Ue()},b)+"</div></div>");return(0,_.M)(e)}); source: chromecache_473.13.dr
Source: Binary string: 0:_.Tz(ia))||1===r||w||z?"":'<div class="'+_.B("iXBThe")+'">'+_.dwb(a,_.eA(b))+"</div>")+"</div>";D+="<velog"+_.he(new _.Q(_.hA,null),!1)+">";D+=_.sDb(a,b,c,p,l,g,h);D=D+"</velog>"+((0<(null!=q?q:0)?_.oxb(a,q):"")+"</div></a>");return(0,_.M)(D+"</div>")};_.pDb=function(a,b){return _.zp("Oa")(a,b)}; source: chromecache_473.13.dr
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.0.128
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.0.128
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.0.128
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.0.128
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 23.52.162.98
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=z2xSF7Ya4vdSTbO&MD=UPkgUY3c HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=http://google.co.ck/search%3Fq%3Dfree%2Bgoogle%2Bplay%2Bcards%2Bno%2Bsurvey%2B2017&q=EgRmpTArGKCgmLAGIjBejhpNZGjmgux3KJ7Mslb3CzKIY-3UW9hy9mDpMJDo3JyBw-KBzf9SLys5rlZ2u_EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dfree%2Bgoogle%2Bplay%2Bcards%2Bno%2Bsurvey%2B2017&q=EgRmpTArGKCgmLAGIjBejhpNZGjmgux3KJ7Mslb3CzKIY-3UW9hy9mDpMJDo3JyBw-KBzf9SLys5rlZ2u_EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=S3woggdlKDNhk03qjYJLqs41XUZTODqiC9GZV7OYwRHG6m__DElQMnH-7O3bk-agOFSr33GgIao3TY09HmnFu3cWlSA49rYZEDM3L3qkQ2J0TS_FUMCuIN05Q6HQ2KrcvCihJs9s8MNF7HJJbTgd3N6LbF7nxjDK7rdgnpACvHlic1MJ6i0ffGPKIh9w5IkPIl8KvQ4mGhS-9CDY9sT-bXDgHIxj0XAv1ntFOs1El86lsUbA3oGtsaq-63fMsNpAMed7qxI1yniyVl4iEyoBtUJMUCdqkeE&cb=a41b0ezi7o34 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dfree%2Bgoogle%2Bplay%2Bcards%2Bno%2Bsurvey%2B2017&q=EgRmpTArGKCgmLAGIjBejhpNZGjmgux3KJ7Mslb3CzKIY-3UW9hy9mDpMJDo3JyBw-KBzf9SLys5rlZ2u_EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=S3woggdlKDNhk03qjYJLqs41XUZTODqiC9GZV7OYwRHG6m__DElQMnH-7O3bk-agOFSr33GgIao3TY09HmnFu3cWlSA49rYZEDM3L3qkQ2J0TS_FUMCuIN05Q6HQ2KrcvCihJs9s8MNF7HJJbTgd3N6LbF7nxjDK7rdgnpACvHlic1MJ6i0ffGPKIh9w5IkPIl8KvQ4mGhS-9CDY9sT-bXDgHIxj0XAv1ntFOs1El86lsUbA3oGtsaq-63fMsNpAMed7qxI1yniyVl4iEyoBtUJMUCdqkeE&cb=a41b0ezi7o34Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /js/bg/OMzbJ87gkB5MAUky6mmDB4mflkEza4rQHUJNCD4hS_4.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=S3woggdlKDNhk03qjYJLqs41XUZTODqiC9GZV7OYwRHG6m__DElQMnH-7O3bk-agOFSr33GgIao3TY09HmnFu3cWlSA49rYZEDM3L3qkQ2J0TS_FUMCuIN05Q6HQ2KrcvCihJs9s8MNF7HJJbTgd3N6LbF7nxjDK7rdgnpACvHlic1MJ6i0ffGPKIh9w5IkPIl8KvQ4mGhS-9CDY9sT-bXDgHIxj0XAv1ntFOs1El86lsUbA3oGtsaq-63fMsNpAMed7qxI1yniyVl4iEyoBtUJMUCdqkeE&cb=a41b0ezi7o34Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dfree%2Bgoogle%2Bplay%2Bcards%2Bno%2Bsurvey%2B2017&q=EgRmpTArGKCgmLAGIjBejhpNZGjmgux3KJ7Mslb3CzKIY-3UW9hy9mDpMJDo3JyBw-KBzf9SLys5rlZ2u_EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /js/bg/OMzbJ87gkB5MAUky6mmDB4mflkEza4rQHUJNCD4hS_4.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=S3woggdlKDNhk03qjYJLqs41XUZTODqiC9GZV7OYwRHG6m__DElQMnH-7O3bk-agOFSr33GgIao3TY09HmnFu3cWlSA49rYZEDM3L3qkQ2J0TS_FUMCuIN05Q6HQ2KrcvCihJs9s8MNF7HJJbTgd3N6LbF7nxjDK7rdgnpACvHlic1MJ6i0ffGPKIh9w5IkPIl8KvQ4mGhS-9CDY9sT-bXDgHIxj0XAv1ntFOs1El86lsUbA3oGtsaq-63fMsNpAMed7qxI1yniyVl4iEyoBtUJMUCdqkeE&cb=a41b0ezi7o34Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dfree%2Bgoogle%2Bplay%2Bcards%2Bno%2Bsurvey%2B2017&q=EgRmpTArGKCgmLAGIjBejhpNZGjmgux3KJ7Mslb3CzKIY-3UW9hy9mDpMJDo3JyBw-KBzf9SLys5rlZ2u_EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=http://google.co.ck/search%3Fq%3Dfree%2Bgoogle%2Bplay%2Bcards%2Bno%2Bsurvey%2B2017&q=EgRmpTArGKCgmLAGIjBejhpNZGjmgux3KJ7Mslb3CzKIY-3UW9hy9mDpMJDo3JyBw-KBzf9SLys5rlZ2u_EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dfree%2Bgoogle%2Bplay%2Bcards%2Bno%2Bsurvey%2B2017&q=EgRmpTArGKCgmLAGIjBejhpNZGjmgux3KJ7Mslb3CzKIY-3UW9hy9mDpMJDo3JyBw-KBzf9SLys5rlZ2u_EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=S3woggdlKDNhk03qjYJLqs41XUZTODqiC9GZV7OYwRHG6m__DElQMnH-7O3bk-agOFSr33GgIao3TY09HmnFu3cWlSA49rYZEDM3L3qkQ2J0TS_FUMCuIN05Q6HQ2KrcvCihJs9s8MNF7HJJbTgd3N6LbF7nxjDK7rdgnpACvHlic1MJ6i0ffGPKIh9w5IkPIl8KvQ4mGhS-9CDY9sT-bXDgHIxj0XAv1ntFOs1El86lsUbA3oGtsaq-63fMsNpAMed7qxI1yniyVl4iEyoBtUJMUCdqkeE&cb=a41b0ezi7o34 HTTP/1.1Host: www.google.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=S3woggdlKDNhk03qjYJLqs41XUZTODqiC9GZV7OYwRHG6m__DElQMnH-7O3bk-agOFSr33GgIao3TY09HmnFu3cWlSA49rYZEDM3L3qkQ2J0TS_FUMCuIN05Q6HQ2KrcvCihJs9s8MNF7HJJbTgd3N6LbF7nxjDK7rdgnpACvHlic1MJ6i0ffGPKIh9w5IkPIl8KvQ4mGhS-9CDY9sT-bXDgHIxj0XAv1ntFOs1El86lsUbA3oGtsaq-63fMsNpAMed7qxI1yniyVl4iEyoBtUJMUCdqkeE&cb=a41b0ezi7o34Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=LDUdQoUcnidKdzRog69t7KkpL2ZQAa0l0KfAcqhuZc79wCqNrMw7JQvRA4vZRheRPfKcFLKPQ-2kQLHLh13C2joH-wRod1dZh3NSW2w-h_m3lUm3LXmfx9WkVylpM4hsIM2lzWaQZIycIh_QCTcRL7oF61DMPsC8uxLcYLSFrqkTEgXFZcyO0I90HFmm-fhccURuhggGfRb56oMeO6DvaDMOKqEAHM_tHkFMvWpLNiG034ehTgrW_Ev87GrWkRaScmwtugTMOodiy2UFlR41FMFvVpxv-eQ&cb=j1xpn4fbpzx7 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dfree%2Bgoogle%2Bplay%2Bcards%2Bno%2Bsurvey%2B2017&q=EgRmpTArGKCgmLAGIjBejhpNZGjmgux3KJ7Mslb3CzKIY-3UW9hy9mDpMJDo3JyBw-KBzf9SLys5rlZ2u_EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=LDUdQoUcnidKdzRog69t7KkpL2ZQAa0l0KfAcqhuZc79wCqNrMw7JQvRA4vZRheRPfKcFLKPQ-2kQLHLh13C2joH-wRod1dZh3NSW2w-h_m3lUm3LXmfx9WkVylpM4hsIM2lzWaQZIycIh_QCTcRL7oF61DMPsC8uxLcYLSFrqkTEgXFZcyO0I90HFmm-fhccURuhggGfRb56oMeO6DvaDMOKqEAHM_tHkFMvWpLNiG034ehTgrW_Ev87GrWkRaScmwtugTMOodiy2UFlR41FMFvVpxv-eQ&cb=j1xpn4fbpzx7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dfree%2Bgoogle%2Bplay%2Bcards%2Bno%2Bsurvey%2B2017&q=EgRmpTArGKCgmLAGIjBejhpNZGjmgux3KJ7Mslb3CzKIY-3UW9hy9mDpMJDo3JyBw-KBzf9SLys5rlZ2u_EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=z2xSF7Ya4vdSTbO&MD=UPkgUY3c HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=http://google.co.ck/search%3Fq%3Dhow%2Bto%2Bmake%2Ba%2Bsandwich&q=EgRmpTArGLOgmLAGIjARsngc98PJpA56iG9TBPFT2CwJONbwm6MVwH44hDvwNC4XBiroxlacmilxkXTEwNoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=P4BD8b56xBTNXowtcKUS22wu17TqN8Bv01GbJDGqKIHLzC804mts0yPksi5i_MW-DHRl1g_isZQXHRMFEwiggCElkawKY_zlQOT3ebobVJlv5BZ_Lr4OMZhWDZsVQGxK100mHvBL2efkDRABIqmv8qODPdp5Ai3wCNZDoMdBXPqRSL9k45D02TzCpGXc7Mtuka5YN7bK00bcKMS6ZBk3sG_zaMULTyCp6te6I9JWZ8OMQsHiQyCyUZvW7q6C1poJYOG4ibLd-2iHLQgfyaIuAWsAFS5Tm-E&cb=2bq7ng1hpp1 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dhow%2Bto%2Bmake%2Ba%2Bsandwich&q=EgRmpTArGLOgmLAGIjARsngc98PJpA56iG9TBPFT2CwJONbwm6MVwH44hDvwNC4XBiroxlacmilxkXTEwNoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dhow%2Bto%2Bmake%2Ba%2Bsandwich&q=EgRmpTArGLOgmLAGIjARsngc98PJpA56iG9TBPFT2CwJONbwm6MVwH44hDvwNC4XBiroxlacmilxkXTEwNoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /_/VisualFrontendUi/browserinfo?f.sid=3196530663577752641&bl=boq_visualfrontendserver_20240326.01_p0&hl=en-GB&authuser&opi=89978449&soc-app=162&soc-platform=1&soc-device=1&_reqid=6616&rt=j HTTP/1.1Host: www.google.co.ckConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=Ae3NU9OQ9eWm6H18fmskySoGNPWVuu-BkKxriX3Jox2mvba77_jE_aDB8g==; 1P_JAR=2024-03-29-00; OTZ=7489490_52_52_123900_48_436380; NID=512=sZBz4pc-8AWxrC6yCNAPQeh8ResFY8tDb9c0cZvQadLBzd18jn6F7orBlT2PlvmhjMSEOm3woEGcyBZRBz3fpc9Tp0DgrJ8E4SQd1GNIQbnyS63maGb_01kg8IN-7HmMUD8H1NlFVnYzL77A_6qQ8pCJQqTKwhnkZJp92IHa9ubwW-MBu5kcWnayClgF
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.co.ckConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=Ae3NU9OQ9eWm6H18fmskySoGNPWVuu-BkKxriX3Jox2mvba77_jE_aDB8g==; 1P_JAR=2024-03-29-00; OTZ=7489490_52_52_123900_48_436380; NID=512=sZBz4pc-8AWxrC6yCNAPQeh8ResFY8tDb9c0cZvQadLBzd18jn6F7orBlT2PlvmhjMSEOm3woEGcyBZRBz3fpc9Tp0DgrJ8E4SQd1GNIQbnyS63maGb_01kg8IN-7HmMUD8H1NlFVnYzL77A_6qQ8pCJQqTKwhnkZJp92IHa9ubwW-MBu5kcWnayClgF
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=http://google.co.ck/search%3Fq%3Dhow%2Bto%2Bmove%2Bto%2Bnorth%2Bkorea&q=EgRmpTArGNOgmLAGIjDlNYqX949h36LFJxbB2S_iUgLOhTc5b3u5uxrVywo3_bh-y4VQdwBFOW8YO0WpjosyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=kqcZW0c0TSFj6U8QC5LgbdC8BEsTuul4Wo5e2HjGNH41psMYmD3AUS4PcRHuZenPEmX_zafBhSiUGJl46in51b6UDVxgk66sfL5g8KbxxlAU_hLGpyibfmc31DSVqJf4yoIQ2slxFQPGIRVxfMvR-WJxxH2In0NVt18GChBnT_oOhdExRcETg4xLowjmL4MqP2CPcEImwzZA60BL5XfsiJTOu1Ke65gqnlsVlj0ge_CM3z1Mmr9EsxLbT2AYOFOTHZH1Fj2VZGNUpiE-Z9kejDl8ML-a1n4&cb=v3izh5nenri2 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dhow%2Bto%2Bmove%2Bto%2Bnorth%2Bkorea&q=EgRmpTArGNOgmLAGIjDlNYqX949h36LFJxbB2S_iUgLOhTc5b3u5uxrVywo3_bh-y4VQdwBFOW8YO0WpjosyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dhow%2Bto%2Bmove%2Bto%2Bnorth%2Bkorea&q=EgRmpTArGNOgmLAGIjDlNYqX949h36LFJxbB2S_iUgLOhTc5b3u5uxrVywo3_bh-y4VQdwBFOW8YO0WpjosyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: www.google.co.ckConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=Ae3NU9OQ9eWm6H18fmskySoGNPWVuu-BkKxriX3Jox2mvba77_jE_aDB8g==; 1P_JAR=2024-03-29-00; OTZ=7489490_52_52_123900_48_436380; NID=512=sZBz4pc-8AWxrC6yCNAPQeh8ResFY8tDb9c0cZvQadLBzd18jn6F7orBlT2PlvmhjMSEOm3woEGcyBZRBz3fpc9Tp0DgrJ8E4SQd1GNIQbnyS63maGb_01kg8IN-7HmMUD8H1NlFVnYzL77A_6qQ8pCJQqTKwhnkZJp92IHa9ubwW-MBu5kcWnayClgF
Source: global traffic HTTP traffic detected: GET /_/VisualFrontendUi/data/batchexecute?rpcids=cinoBd&source-path=%2Fsearch&f.sid=3196530663577752641&bl=boq_visualfrontendserver_20240326.01_p0&hl=en-GB&authuser&opi=89978449&soc-app=162&soc-platform=1&soc-device=1&_reqid=106616&rt=c HTTP/1.1Host: www.google.co.ckConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=Ae3NU9OQ9eWm6H18fmskySoGNPWVuu-BkKxriX3Jox2mvba77_jE_aDB8g==; 1P_JAR=2024-03-29-00; OTZ=7489490_52_52_123900_48_436380; NID=512=sZBz4pc-8AWxrC6yCNAPQeh8ResFY8tDb9c0cZvQadLBzd18jn6F7orBlT2PlvmhjMSEOm3woEGcyBZRBz3fpc9Tp0DgrJ8E4SQd1GNIQbnyS63maGb_01kg8IN-7HmMUD8H1NlFVnYzL77A_6qQ8pCJQqTKwhnkZJp92IHa9ubwW-MBu5kcWnayClgF
Source: global traffic HTTP traffic detected: GET /_/VisualFrontendUi/data/batchexecute?rpcids=RQBMgb&source-path=%2Fsearch&viewertype=7&f.sid=3196530663577752641&bl=boq_visualfrontendserver_20240326.01_p0&hl=en-GB&authuser&opi=89978449&soc-app=162&soc-platform=1&soc-device=1&_reqid=206616&rt=c HTTP/1.1Host: www.google.co.ckConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=Ae3NU9OQ9eWm6H18fmskySoGNPWVuu-BkKxriX3Jox2mvba77_jE_aDB8g==; 1P_JAR=2024-03-29-00; OTZ=7489490_52_52_123900_48_436380; NID=512=sZBz4pc-8AWxrC6yCNAPQeh8ResFY8tDb9c0cZvQadLBzd18jn6F7orBlT2PlvmhjMSEOm3woEGcyBZRBz3fpc9Tp0DgrJ8E4SQd1GNIQbnyS63maGb_01kg8IN-7HmMUD8H1NlFVnYzL77A_6qQ8pCJQqTKwhnkZJp92IHa9ubwW-MBu5kcWnayClgF
Source: global traffic HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: www.google.co.ckConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=Ae3NU9OQ9eWm6H18fmskySoGNPWVuu-BkKxriX3Jox2mvba77_jE_aDB8g==; 1P_JAR=2024-03-29-00; OTZ=7489490_52_52_123900_48_436380; NID=512=sZBz4pc-8AWxrC6yCNAPQeh8ResFY8tDb9c0cZvQadLBzd18jn6F7orBlT2PlvmhjMSEOm3woEGcyBZRBz3fpc9Tp0DgrJ8E4SQd1GNIQbnyS63maGb_01kg8IN-7HmMUD8H1NlFVnYzL77A_6qQ8pCJQqTKwhnkZJp92IHa9ubwW-MBu5kcWnayClgF
Source: global traffic HTTP traffic detected: GET /watch?v=RET-cJ5NFYA HTTP/1.1Host: youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /watch?v=RET-cJ5NFYA HTTP/1.1Host: www.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /s/player/3b96d06c/player_ias.vflset/en_US/base.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/jsbin/desktop_polymer.vflset/desktop_polymer.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/jsbin/webcomponents-sd.vflset/webcomponents-sd.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /generate_204 HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/RET-cJ5NFYA/hqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /s/player/3b96d06c/www-player.css HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /generate_204 HTTP/1.1Host: rr4---sn-p5qlsn76.googlevideo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /generate_204?conn2 HTTP/1.1Host: rr4---sn-p5qlsn76.googlevideo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/cssbin/www-main-desktop-watch-page-skeleton.css HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/cssbin/www-main-desktop-player-skeleton.css HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/cssbin/www-onepick.css HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/_/ytmainappweb/_/ss/k=ytmainappweb.kevlar_base.UHvH1oGi5ac.L.B1.O/am=ACBACw/d=0/rs=AGKMywFhlACJMLs8HPa0yJIu4w52h-s5EQ HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/jsbin/intersection-observer.min.vflset/intersection-observer.min.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/jsbin/scheduler.vflset/scheduler.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/jsbin/spf.vflset/spf.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/jsbin/network.vflset/network.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/player/3b96d06c/player_ias.vflset/en_US/offline.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/player/3b96d06c/player_ias.vflset/en_US/remote.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/player/3b96d06c/player_ias.vflset/en_US/miniplayer.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/player/3b96d06c/player_ias.vflset/en_US/endscreen.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D
Source: global traffic HTTP traffic detected: GET /s/search/audio/failure.mp3 HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, *;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3DRange: bytes=0-
Source: global traffic HTTP traffic detected: GET /s/search/audio/no_input.mp3 HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, *;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3DRange: bytes=0-
Source: global traffic HTTP traffic detected: GET /s/search/audio/open.mp3 HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, *;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.ZurichRange: bytes=0-
Source: global traffic HTTP traffic detected: GET /s/search/audio/success.mp3 HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, *;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.ZurichRange: bytes=0-
Source: global traffic HTTP traffic detected: GET /vi/RET-cJ5NFYA/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLBwcKFll1Kk1gcnBqiV4Xg4IGAbvQ HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /sw.js HTTP/1.1Host: www.youtube.comConnection: keep-aliveCache-Control: max-age=0Accept: */*Service-Worker: scriptX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich
Source: global traffic HTTP traffic detected: GET /instream/ad_status.js HTTP/1.1Host: static.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/EvbCWGXZxL4/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLAXWLnbBwERh86qOcPn3shvNbNg2g HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/L4xj2mxI7uE/hqdefault.jpg?sqp=-oaymwEwCKgBEF5IWvKriqkDIwgBFQAAiEIYAfABAfgBtgiAAoAPigIMCAAQARh_IBMoSzAP&rs=AOn4CLBmd8wyyJkzeYre6n7Tm1QW9CTgvA HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/QdtIOhsHhjM/hq2.jpg?sqp=-oaymwE1CKgBEF5IVfKriqkDKAgBFQAAiEIYAHABwAEG8AEB-AG2CIACgA-KAgwIABABGHIgSyhHMA8=&rs=AOn4CLD8SIl9LoTcgurFndI1CRATTNZWbg HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/NHZr6P1csiY/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLCpz0ytCMDp8nXZmXMyVJI6iu3nNA HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/3GGg4XOsaRI/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLByxRMqSY8luKDN5QHN1jhuzVzPtQ HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pagead/lvz?evtid=ACd6Ktw72rPRS5UmcBC9F9QjmI1KHq1mThbZ5QQ2FY3MExYONnnNC3amgaY-FmIWiIFLcnbRywukbdHJMtRkx3ujnYz8j8VPIQ&req_ts=1711673449&pg=MainAppBootstrap%3AWatch&az=1&sigh=AB9vU40nqXX1Z6wjLbgJPZy5t8Bk1v7C3A HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /vi/WapcfZvU-Aw/hqdefault.jpg?sqp=-oaymwE1CKgBEF5IVfKriqkDKAgBFQAAiEIYAXABwAEG8AEB-AH-CYAC0AWKAgwIABABGGUgTyhBMA8=&rs=AOn4CLBrsyellH2tBQlGCHNu8yjrzodOZQ HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ytc/AIdro_lI-1fKvLog4cdgTzH3tSLXdDxIoXMKS-MVsE4EBQ=s48-c-k-c0x00ffffff-no-rj-mo HTTP/1.1Host: yt3.ggpht.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/jsbin/serviceworker-kevlar-appshell.vflset/serviceworker-kevlar-appshell.js HTTP/1.1Host: www.youtube.comConnection: keep-aliveCache-Control: max-age=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich
Source: global traffic HTTP traffic detected: GET /api/stats/playback?ns=yt&el=detailpage&cpn=f-fLtixrB5CGYAkV&ver=2&cmt=0.013&fmt=396&fs=0&rt=2.938&euri&lact=2995&cl=619202668&mos=0&volume=100&cbr=Chrome&cbrver=117.0.0.0&c=WEB&cver=2.20240327.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&hl=en_US&cr=US&len=8.521&fexp=v1%2C23983296%2C2730%2C12811%2C5807%2C76094%2C54572%2C73455%2C230596%2C84737%2C464%2C25896%2C9958%2C6271%2C133212%2C26306282%2C4054%2C7111%2C9369%2C10825%2C1265%2C395%2C14489%2C9954%2C1192%2C7913%2C1991%2C16592%2C1598%2C2549%2C911%2C1908%2C2%2C4747%2C1942%2C880%2C1127%2C5975%2C2%2C3095%2C3440%2C5%2C9073%2C592%2C39%2C2%2C2%2C2%2C2%2C171%2C5951%2C194%2C601%2C644%2C57%2C186%2C2840%2C2556%2C416%2C3%2C2373%2C3%2C1065%2C6894&rtn=10&afmt=251&muted=0&docid=RET-cJ5NFYA&ei=aBAGZtm5Kaucy_sPwdSC6AY&plid=AAYUwgfiKhqy-R1g&of=hlQIrIH4TMnbBTYX3UuvGg&vm=CAEQARgEOjJBSHFpSlRLdkc2ZDdCNjk5XzZkSm5lSUxKaklKa29nM3pRYkZmbHNES29MbUhkaXZ6d2JiQVBta0tETC1OOS1OTEQxSWVYRGVFYnVaNVNJYjZzdkxoVnVWS1EwX3FFbXFhZWhqRzc3Y2ZsTGZEanVMQy1jRmVMd1FsQlZTSENYX2E4VzRiZ3c0MnBKRHlPbmZhUS1MeXdoAg HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-YouTube-Device: cbr=Chrome&cbrver=117.0.0.0&ceng=WebKit&cengver=537.36&cos=Windows&cosver=10.0&cplatform=DESKTOPX-YouTube-Page-Label: youtube.desktop.web_20240327_00_RC00sec-ch-ua-arch: "x86"X-Goog-Request-Time: 1711673455375X-YouTube-Page-CL: 619251461X-Goog-Event-Time: 1711673455375X-YouTube-Utc-Offset: 60sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""X-YouTube-Time-Zone: Europe/Zurichsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-full-version: "117.0.5938.132"X-YouTube-Client-Name: 1X-YouTube-Client-Version: 2.20240327.00.00X-Goog-Visitor-Id: CgstXzcta0RXRDRERSjooJiwBjIKCgJVUxIEGgAgUg%3D%3DX-YouTube-Ad-Signals: dt=1711673452595&flash=0&frm&u_tz=60&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=870&biw=1017&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&wgl=true&ca_type=imageAccept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich
Source: global traffic HTTP traffic detected: GET /ptracking?html5=1&video_id=RET-cJ5NFYA&cpn=f-fLtixrB5CGYAkV&ei=aBAGZtm5Kaucy_sPwdSC6AY&ptk=youtube_single&oid=0j1lnr53Y2391_3xSxe8RA&ptchn=q6aw03lNILzV96UvEAASfQ&pltype=content&m=AgY-IWMMMLK2xibKPQ-EVQyzCwtZiQWXpqlY01YoVnAsPiTQMIINRQa9HVDxKTnGTxXfRlFxKZFyMG5waNQlSudn HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-YouTube-Device: cbr=Chrome&cbrver=117.0.0.0&ceng=WebKit&cengver=537.36&cos=Windows&cosver=10.0&cplatform=DESKTOPX-YouTube-Page-Label: youtube.desktop.web_20240327_00_RC00sec-ch-ua-arch: "x86"X-YouTube-Page-CL: 619251461sec-ch-ua-platform-version: "10.0.0"X-YouTube-Utc-Offset: 60sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""X-YouTube-Time-Zone: Europe/Zurichsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-full-version: "117.0.5938.132"X-YouTube-Client-Name: 1X-YouTube-Client-Version: 2.20240327.00.00X-Goog-Visitor-Id: CgstXzcta0RXRDRERSjooJiwBjIKCgJVUxIEGgAgUg%3D%3DX-YouTube-Ad-Signals: dt=1711673452314&flash=0&frm&u_tz=60&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=870&biw=1017&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&wgl=true&ca_type=imageAccept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: youtube.comConnection: keep-alivePragma: no-cacheCache-Control: no-cachesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.youtube.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/E7oEq6CE78g/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLAvaI2e9L01KAF205x82ODYE1kWQA HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/9SwFwTrwS9I/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLDTMlLcfYLBCJpgR8H3dGCkDR7lHw HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/8NArIVIQ4BI/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLCgMZ5Okoq5nWZzACduqMvECyC91g HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /sw.js_data HTTP/1.1Host: www.youtube.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70
Source: global traffic HTTP traffic detected: GET /manifest.webmanifest HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich
Source: global traffic HTTP traffic detected: GET /app_shell HTTP/1.1Host: www.youtube.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70
Source: global traffic HTTP traffic detected: GET /ytc/AIdro_mLh0V6_RMRI05BKmU3SRfmIyHS2cCBANLW7w=s88-c-k-c0x00ffffff-no-rj HTTP/1.1Host: yt3.ggpht.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /a/default-user=s48-c-k-c0x00ffffff-no-rj HTTP/1.1Host: yt3.ggpht.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /js/th/ZsUwGEaTXaXoI738hgfiAxwmtaoYIPrUg4qZn7H1-gg.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/jsbin/www-tampering.vflset/www-tampering.js HTTP/1.1Host: www.youtube.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70
Source: global traffic HTTP traffic detected: GET /ytc/AIdro_lRbnh76maj-l4rhy_6CKM6wLwnb5QaiDD-nNg=s88-c-k-c0x00ffffff-no-rj HTTP/1.1Host: yt3.ggpht.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ytc/AIdro_mDSzv-maZ2O1G5ZrRg0kxawMXzhLCLPmBnxfNS=s88-c-k-c0x00ffffff-no-rj HTTP/1.1Host: yt3.ggpht.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/cssbin/www-main-desktop-home-page-skeleton.css HTTP/1.1Host: www.youtube.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70
Source: global traffic HTTP traffic detected: GET /JwU_kF_Nmp2Ec7qBWlmcAN4LIoSrT4gI90mjIcRmrYLUnArmgXEdCdwYIFDB--fX4cOu8Eht=s88-c-k-c0x00ffffff-no-rj HTTP/1.1Host: yt3.ggpht.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /generate_204?xois7w HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/img/favicon_144x144.png HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/jsbin/www-searchbox.vflset/www-searchbox.js HTTP/1.1Host: www.youtube.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/img/favicon.ico HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70
Source: global traffic HTTP traffic detected: GET /s/desktop/accca349/img/favicon_32x32.png HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70
Source: global traffic HTTP traffic detected: GET /s/player/3b96d06c/player_ias.vflset/en_US/captions.js HTTP/1.1Host: www.youtube.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70
Source: global traffic HTTP traffic detected: GET /api/stats/watchtime?ns=yt&el=detailpage&cpn=f-fLtixrB5CGYAkV&ver=2&cmt=6.873&fmt=396&fs=0&rt=10.012&euri&lact=992&cl=619202668&state=playing&volume=100&cbr=Chrome&cbrver=117.0.0.0&c=WEB&cver=2.20240327.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&hl=en_US&cr=US&len=8.521&rtn=20&afmt=251&idpj=-3&ldpj=-11&rti=10&st=0&et=6.873&muted=0&docid=RET-cJ5NFYA&ei=aBAGZtm5Kaucy_sPwdSC6AY&plid=AAYUwgfiKhqy-R1g&of=hlQIrIH4TMnbBTYX3UuvGg&vm=CAEQARgEOjJBSHFpSlRLdkc2ZDdCNjk5XzZkSm5lSUxKaklKa29nM3pRYkZmbHNES29MbUhkaXZ6d2JiQVBta0tETC1OOS1OTEQxSWVYRGVFYnVaNVNJYjZzdkxoVnVWS1EwX3FFbXFhZWhqRzc3Y2ZsTGZEanVMQy1jRmVMd1FsQlZTSENYX2E4VzRiZ3c0MnBKRHlPbmZhUS1MeXdoAg HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-YouTube-Device: cbr=Chrome&cbrver=117.0.0.0&ceng=WebKit&cengver=537.36&cos=Windows&cosver=10.0&cplatform=DESKTOPX-YouTube-Page-Label: youtube.desktop.web_20240327_00_RC00sec-ch-ua-arch: "x86"X-Goog-Request-Time: 1711673462447X-YouTube-Page-CL: 619251461X-Goog-Event-Time: 1711673462447X-YouTube-Utc-Offset: 60sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""X-YouTube-Time-Zone: Europe/Zurichsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-full-version: "117.0.5938.132"X-YouTube-Client-Name: 1X-YouTube-Client-Version: 2.20240327.00.00X-Goog-Visitor-Id: CgstXzcta0RXRDRERSjooJiwBjIKCgJVUxIEGgAgUg%3D%3DX-YouTube-Ad-Signals: dt=1711673452595&flash=0&frm&u_tz=60&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=870&biw=1017&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&wgl=true&ca_type=imageAccept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70
Source: global traffic HTTP traffic detected: GET /api/stats/watchtime?ns=yt&el=detailpage&cpn=f-fLtixrB5CGYAkV&ver=2&cmt=8.521&fmt=396&fs=0&rt=11.65&euri&lact=2630&cl=619202668&state=paused&volume=100&cbr=Chrome&cbrver=117.0.0.0&c=WEB&cver=2.20240327.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&hl=en_US&cr=US&len=8.521&afmt=251&idpj=-3&ldpj=-11&rti=20&st=6.873&et=8.521&muted=0&docid=RET-cJ5NFYA&ei=aBAGZtm5Kaucy_sPwdSC6AY&plid=AAYUwgfiKhqy-R1g&of=hlQIrIH4TMnbBTYX3UuvGg&vm=CAEQARgEOjJBSHFpSlRLdkc2ZDdCNjk5XzZkSm5lSUxKaklKa29nM3pRYkZmbHNES29MbUhkaXZ6d2JiQVBta0tETC1OOS1OTEQxSWVYRGVFYnVaNVNJYjZzdkxoVnVWS1EwX3FFbXFhZWhqRzc3Y2ZsTGZEanVMQy1jRmVMd1FsQlZTSENYX2E4VzRiZ3c0MnBKRHlPbmZhUS1MeXdoAg HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-YouTube-Device: cbr=Chrome&cbrver=117.0.0.0&ceng=WebKit&cengver=537.36&cos=Windows&cosver=10.0&cplatform=DESKTOPX-YouTube-Page-Label: youtube.desktop.web_20240327_00_RC00sec-ch-ua-arch: "x86"X-Goog-Request-Time: 1711673464086X-YouTube-Page-CL: 619251461X-Goog-Event-Time: 1711673464086X-YouTube-Utc-Offset: 60sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""X-YouTube-Time-Zone: Europe/Zurichsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-full-version: "117.0.5938.132"X-YouTube-Client-Name: 1X-YouTube-Client-Version: 2.20240327.00.00X-Goog-Visitor-Id: CgstXzcta0RXRDRERSjooJiwBjIKCgJVUxIEGgAgUg%3D%3DX-YouTube-Ad-Signals: dt=1711673452595&flash=0&frm&u_tz=60&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=870&biw=1017&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&wgl=true&ca_type=imageAccept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/watch?v=RET-cJ5NFYAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70
Source: global traffic HTTP traffic detected: GET /vi/9SwFwTrwS9I/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLDHEl4H2Vg1jpYcY2mxBY3TnSYizQ HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /sw.js_data HTTP/1.1Host: www.youtube.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70
Source: global traffic HTTP traffic detected: GET /watch?v=a0uQnWAmf-k&index=229&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y HTTP/1.1Host: youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70; ST-lbf88v=csn=MC42MzYzMTk1MzQxMzE3MDYz&itct=CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D&lact=50&pbis=3&prefetch_reason=hc_pbis&vis=0&autonav=1&endpoint=%7B%22clickTrackingParams%22%3A%22CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D%22%2C%22commandMetadata%22%3A%7B%22webCommandMetadata%22%3A%7B%22url%22%3A%22%2Fwatch%3Fv%3D9SwFwTrwS9I%26pp%3DQAFIAQ%253D%253D%22%2C%22webPageType%22%3A%22WEB_PAGE_TYPE_WATCH%22%2C%22rootVe%22%3A3832%7D%7D%2C%22watchEndpoint%22%3A%7B%22videoId%22%3A%229SwFwTrwS9I%22%2C%22params%22%3A%22EAEYAdoBBAgBKgA%253D%22%2C%22playerParams%22%3A%22QAFIAQ%253D%253D%22%2C%22watchEndpointSupportedPrefetchConfig%22%3A%7B%22prefetchHintConfig%22%3A%7B%22prefetchPriority%22%3A0%2C%22countdownUiRelativeSecondsPrefetchCondition%22%3A-3%7D%7D%7D%7D
Source: global traffic HTTP traffic detected: GET /watch?v=a0uQnWAmf-k&index=229&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y HTTP/1.1Host: www.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Service-Worker-Navigation-Preload: trueX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70; ST-lbf88v=csn=MC42MzYzMTk1MzQxMzE3MDYz&itct=CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D&lact=50&pbis=3&prefetch_reason=hc_pbis&vis=0&autonav=1&endpoint=%7B%22clickTrackingParams%22%3A%22CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D%22%2C%22commandMetadata%22%3A%7B%22webCommandMetadata%22%3A%7B%22url%22%3A%22%2Fwatch%3Fv%3D9SwFwTrwS9I%26pp%3DQAFIAQ%253D%253D%22%2C%22webPageType%22%3A%22WEB_PAGE_TYPE_WATCH%22%2C%22rootVe%22%3A3832%7D%7D%2C%22watchEndpoint%22%3A%7B%22videoId%22%3A%229SwFwTrwS9I%22%2C%22params%22%3A%22EAEYAdoBBAgBKgA%253D%22%2C%22playerParams%22%3A%22QAFIAQ%253D%253D%22%2C%22watchEndpointSupportedPrefetchConfig%22%3A%7B%22prefetchHintConfig%22%3A%7B%22prefetchPriority%22%3A0%2C%22countdownUiRelativeSecondsPrefetchCondition%22%3A-3%7D%7D%7D%7D
Source: global traffic HTTP traffic detected: GET /vi/a0uQnWAmf-k/hqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /generate_204 HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /generate_204 HTTP/1.1Host: rr3---sn-p5qddn7k.googlevideo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /generate_204?conn2 HTTP/1.1Host: rr3---sn-p5qddn7k.googlevideo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /api/stats/watchtime?ns=yt&el=detailpage&cpn=f-fLtixrB5CGYAkV&ver=2&cmt=8.521&fmt=396&fs=0&rt=19.368&euri&lact=2070&cl=619202668&state=paused&volume=100&cbr=Chrome&cbrver=117.0.0.0&c=WEB&cver=2.20240327.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&hl=en_US&cr=US&len=8.521&afmt=251&idpj=-3&ldpj=-11&st=8.521&et=8.521&pe=1&muted=0&vis=3&docid=RET-cJ5NFYA&ei=aBAGZtm5Kaucy_sPwdSC6AY&plid=AAYUwgfiKhqy-R1g&of=hlQIrIH4TMnbBTYX3UuvGg&vm=CAEQARgEOjJBSHFpSlRLdkc2ZDdCNjk5XzZkSm5lSUxKaklKa29nM3pRYkZmbHNES29MbUhkaXZ6d2JiQVBta0tETC1OOS1OTEQxSWVYRGVFYnVaNVNJYjZzdkxoVnVWS1EwX3FFbXFhZWhqRzc3Y2ZsTGZEanVMQy1jRmVMd1FsQlZTSENYX2E4VzRiZ3c0MnBKRHlPbmZhUS1MeXdoAg HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-YouTube-Device: cbr=Chrome&cbrver=117.0.0.0&ceng=WebKit&cengver=537.36&cos=Windows&cosver=10.0&cplatform=DESKTOPX-YouTube-Page-Label: youtube.desktop.web_20240327_00_RC00sec-ch-ua-arch: "x86"X-Goog-Request-Time: 1711673471803X-YouTube-Page-CL: 619251461X-Goog-Event-Time: 1711673471803X-YouTube-Utc-Offset: 60sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""X-YouTube-Time-Zone: Europe/Zurichsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-full-version: "117.0.5938.132"X-YouTube-Client-Name: 1X-YouTube-Client-Version: 2.20240327.00.00X-Goog-Visitor-Id: CgstXzcta0RXRDRERSjooJiwBjIKCgJVUxIEGgAgUg%3D%3DX-YouTube-Ad-Signals: dt=1711673452595&flash=0&frm&u_tz=60&u_his=2&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=870&biw=1017&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=2&wgl=true&ca_type=imageAccept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/watch?v=9SwFwTrwS9IAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70; ST-lbf88v=csn=MC42MzYzMTk1MzQxMzE3MDYz&itct=CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D&lact=50&pbis=3&prefetch_reason=hc_pbis&vis=0&autonav=1&endpoint=%7B%22clickTrackingParams%22%3A%22CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D%22%2C%22commandMetadata%22%3A%7B%22webCommandMetadata%22%3A%7B
Source: global traffic HTTP traffic detected: GET /api/stats/watchtime?ns=yt&el=detailpage&cpn=f-fLtixrB5CGYAkV&ver=2&cmt=8.521&fmt=396&fs=0&rt=19.372&euri&lact=2074&cl=619202668&state=paused&volume=100&cbr=Chrome&cbrver=117.0.0.0&c=WEB&cver=2.20240327.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&final=1&hl=en_US&cr=US&len=8.521&afmt=251&idpj=-3&ldpj=-11&st=8.521&et=8.521&pe=1&muted=0&vis=3&docid=RET-cJ5NFYA&ei=aBAGZtm5Kaucy_sPwdSC6AY&plid=AAYUwgfiKhqy-R1g&of=hlQIrIH4TMnbBTYX3UuvGg&vm=CAEQARgEOjJBSHFpSlRLdkc2ZDdCNjk5XzZkSm5lSUxKaklKa29nM3pRYkZmbHNES29MbUhkaXZ6d2JiQVBta0tETC1OOS1OTEQxSWVYRGVFYnVaNVNJYjZzdkxoVnVWS1EwX3FFbXFhZWhqRzc3Y2ZsTGZEanVMQy1jRmVMd1FsQlZTSENYX2E4VzRiZ3c0MnBKRHlPbmZhUS1MeXdoAg HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-YouTube-Device: cbr=Chrome&cbrver=117.0.0.0&ceng=WebKit&cengver=537.36&cos=Windows&cosver=10.0&cplatform=DESKTOPX-YouTube-Page-Label: youtube.desktop.web_20240327_00_RC00sec-ch-ua-arch: "x86"X-Goog-Request-Time: 1711673471807X-YouTube-Page-CL: 619251461X-Goog-Event-Time: 1711673471807X-YouTube-Utc-Offset: 60sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""X-YouTube-Time-Zone: Europe/Zurichsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-full-version: "117.0.5938.132"X-YouTube-Client-Name: 1X-YouTube-Client-Version: 2.20240327.00.00X-Goog-Visitor-Id: CgstXzcta0RXRDRERSjooJiwBjIKCgJVUxIEGgAgUg%3D%3DX-YouTube-Ad-Signals: dt=1711673452595&flash=0&frm&u_tz=60&u_his=2&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=870&biw=1017&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=2&wgl=true&ca_type=imageAccept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/watch?v=9SwFwTrwS9IAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70; ST-lbf88v=csn=MC42MzYzMTk1MzQxMzE3MDYz&itct=CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D&lact=50&pbis=3&prefetch_reason=hc_pbis&vis=0&autonav=1&endpoint=%7B%22clickTrackingParams%22%3A%22CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D%22%2C%22commandMetadata%22%3A%7B%22webCommandMetadata%
Source: global traffic HTTP traffic detected: GET /s/search/audio/failure.mp3 HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, *;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioReferer: https://www.youtube.com/watch?v=a0uQnWAmf-k&index=229&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5yAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70; ST-lbf88v=csn=MC42MzYzMTk1MzQxMzE3MDYz&itct=CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D&lact=50&pbis=3&prefetch_reason=hc_pbis&vis=0&autonav=1&endpoint=%7B%22clickTrackingParams%22%3A%22CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D%22%2C%22commandMetadata%22%3A%7B%22webCommandMetadata%22%3A%7B%22url%22%3A%22%2Fwatch%3Fv%3D9SwFwTrwS9I%26pp%3DQAFIAQ%253D%253D%22%2C%22webPageType%22%3A%22WEB_PAGE_TYPE_WATCH%22%2C%22rootVe%22%3A3832%7D%7D%2C%22watchEndpoint%22%3A%7B%22videoId%22%3A%229SwFwTrwS9I%22%2C%22params%22%3A%22EAEYAdoBBAgBKgA%253D%22%2C%22playerParams%22%3A%22QAFIAQ%253D%253D%22%2C%22watchEndpointSupportedPrefetchConfig%22%3A%7B%22prefetchHintConfig%22%3A%7B%22prefetchPriority%22%3A0%2C%22countdownUiRelativeSecondsPrefetchCondition%22%3A-3%7D%7D%7D%7D; ST-kv3gy4=autonav=1&playnext=0&itct=CDgQ4ZIBIhMIkpuFv6CYhQMV4dZyCR2wxAkeMgxyZWxhdGVkLWF1dG9IgKu08onOv6JEmgEFCAMQ-B0%3D&lact=2048&vis=3&csn=MC42MzYzMTk1MzQxMzE3MDYz&endpoint=%7B%22watchEndpoint%22%3A%7B%22videoId%22%3A%229SwFwTrwS9I%22%2C%22params%22%3A%22EAEYAdoBBAgBKgA%253D%22%2C%22playerParams%22%3A%22QAFIAQ%253D%253D%22%2C%22watchEndpointSupportedPrefetchConfig%22%3A%7B%22prefetchHintConfig%22%3A%7B%22prefetchPriority%22%3A0%2C%22countdownUiRelativeSecondsPrefetchCondition%22%3A-3%7D%7D%7D%2C%22commandMetadata%22%3A%7B%22webCommandMetadata%22%3A%7B%22url%22%3A%22%2Fwatch%3Fv%3D9SwFwTrwS9I%26pp%3DQAFIAQ%253D%253D%22%2C%22webPageType%22%3A%22WEB_PAGE_TYPE_WATCH%22%2C%22rootVe%22%3A3832%7D%7D%2C%22clickTrackingParams%22%3A%22CDgQ4ZIBIhMIkpuFv6CYhQMV4dZyCR2wxAkeMgxyZWxhdGVkLWF1dG9IgKu08onOv6JEmgEFCAMQ-B0%
Source: global traffic HTTP traffic detected: GET /s/search/audio/no_input.mp3 HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, *;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioReferer: https://www.youtube.com/watch?v=a0uQnWAmf-k&index=229&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5yAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70; ST-lbf88v=csn=MC42MzYzMTk1MzQxMzE3MDYz&itct=CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D&lact=50&pbis=3&prefetch_reason=hc_pbis&vis=0&autonav=1&endpoint=%7B%22clickTrackingParams%22%3A%22CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D%22%2C%22commandMetadata%22%3A%7B%22webCommandMetadata%22%3A%7B%22url%22%3A%22%2Fwatch%3Fv%3D9SwFwTrwS9I%26pp%3DQAFIAQ%253D%253D%22%2C%22webPageType%22%3A%22WEB_PAGE_TYPE_WATCH%22%2C%22rootVe%22%3A3832%7D%7D%2C%22watchEndpoint%22%3A%7B%22videoId%22%3A%229SwFwTrwS9I%22%2C%22params%22%3A%22EAEYAdoBBAgBKgA%253D%22%2C%22playerParams%22%3A%22QAFIAQ%253D%253D%22%2C%22watchEndpointSupportedPrefetchConfig%22%3A%7B%22prefetchHintConfig%22%3A%7B%22prefetchPriority%22%3A0%2C%22countdownUiRelativeSecondsPrefetchCondition%22%3A-3%7D%7D%7D%7D; ST-kv3gy4=autonav=1&playnext=0&itct=CDgQ4ZIBIhMIkpuFv6CYhQMV4dZyCR2wxAkeMgxyZWxhdGVkLWF1dG9IgKu08onOv6JEmgEFCAMQ-B0%3D&lact=2048&vis=3&csn=MC42MzYzMTk1MzQxMzE3MDYz&endpoint=%7B%22watchEndpoint%22%3A%7B%22videoId%22%3A%229SwFwTrwS9I%22%2C%22params%22%3A%22EAEYAdoBBAgBKgA%253D%22%2C%22playerParams%22%3A%22QAFIAQ%253D%253D%22%2C%22watchEndpointSupportedPrefetchConfig%22%3A%7B%22prefetchHintConfig%22%3A%7B%22prefetchPriority%22%3A0%2C%22countdownUiRelativeSecondsPrefetchCondition%22%3A-3%7D%7D%7D%2C%22commandMetadata%22%3A%7B%22webCommandMetadata%22%3A%7B%22url%22%3A%22%2Fwatch%3Fv%3D9SwFwTrwS9I%26pp%3DQAFIAQ%253D%253D%22%2C%22webPageType%22%3A%22WEB_PAGE_TYPE_WATCH%22%2C%22rootVe%22%3A3832%7D%7D%2C%22clickTrackingParams%22%3A%22CDgQ4ZIBIhMIkpuFv6CYhQMV4dZyCR2wxAkeMgxyZWxhdGVkLWF1dG9IgKu08onOv6JEmgEFCAMQ-B0
Source: global traffic HTTP traffic detected: GET /namo5BC7xpkncQUc_nKGzn73HCbYhjFhTsklJZXQtVi_TXNczXtaEfgsyEu3mkZsifLTQS16UQ=s48-c-k-c0x00ffffff-no-rj HTTP/1.1Host: yt3.ggpht.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/wEkRjlSgIIQ/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLB00Ln1PwOr-LgQkATQmuVXz_JCQQ HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/40KcrrfbJ6o/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLBlDaZBkJDbmlzk8MA7OH2a31nUDQ HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pagead/lvz?evtid=ACd6KtxSrk2AtTTb7RfCfjhkVgiBqGbIkuyHJkaPdkmJinClP4VPzrnB5pycWF73wPWM5MHsDblioLkJzHH5cWnIFCHDInrPyQ&req_ts=1711673471&pg=MainAppBootstrap%3AWatch&az=1&sigh=AB9vU429tfMLbPkpEQwks5zrlsFSOnpsdA HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: GET /vi/31pdm7lxe1c/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLCKogv-ZIutySpJLrqz_GqrYwzDFQ HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/3OGH6PlOiAw/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLBJEpDfALtaNZSlhj74PfO9fdiuqA HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/wRRsXxE1KVY/hqdefault.jpg?sqp=-oaymwE1CKgBEF5IVfKriqkDKAgBFQAAiEIYAXABwAEG8AEB-AH-BIAC6AKKAgwIABABGHIgSShAMA8=&rs=AOn4CLDOi-a494Evs6Obur1k6bGhG8LBFA HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /api/timedtext?v=bIekKuwnUoo&ei=fxAGZvOKBcWM_9EPloyC0A0&caps=asr&opi=112496729&xoaf=5&hl=en&ip=0.0.0.0&ipbits=0&expire=1711698671&sparams=ip%2Cipbits%2Cexpire%2Cv%2Cei%2Ccaps%2Copi%2Cxoaf&signature=95FBF37CF96965D4311521F47C0F4F83E9AEA2DE.57BAD7F9BCB1CDE76BD7545A53DF8BB7C7DF329D&key=yt8&lang=en&fmt=json3&xorb=2&xobt=3&xovt=3&cbr=Chrome&cbrver=117.0.0.0&c=WEB&cver=2.20240327.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-YouTube-Device: cbr=Chrome&cbrver=117.0.0.0&ceng=WebKit&cengver=537.36&cos=Windows&cosver=10.0&cplatform=DESKTOPX-YouTube-Page-Label: youtube.desktop.web_20240327_00_RC00sec-ch-ua-arch: "x86"X-YouTube-Page-CL: 619251461sec-ch-ua-platform-version: "10.0.0"X-YouTube-Utc-Offset: 60sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""X-YouTube-Time-Zone: Europe/Zurichsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-full-version: "117.0.5938.132"X-YouTube-Client-Name: 1X-YouTube-Client-Version: 2.20240327.00.00X-Goog-Visitor-Id: CgstXzcta0RXRDRERSjooJiwBjIKCgJVUxIEGgAgUg%3D%3DX-YouTube-Ad-Signals: dt=1711673452314&flash=0&frm&u_tz=60&u_his=2&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=870&biw=1017&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=2&wgl=true&ca_type=imageAccept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/watch?v=9SwFwTrwS9IAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70; ST-lbf88v=csn=MC42MzYzMTk1MzQxMzE3MDYz&itct=CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D&lact=50&pbis=3&prefetch_reason=hc_pbis&vis=0&autonav=1&endpoint=%7B%22clickTrackingParams%22%3A%22CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D%22%2C%22commandMetadata%22%3A%7B%22webCommandMetadata%22%3A%7B%22url%22%3A%22%2Fwatch%3Fv%3D9SwFwTrwS9I%26pp%3DQAFIAQ%253D%253D%22%2C%22webPageType%22%3A%22WEB_PAGE_TYPE_WATCH%22%2C%22rootVe%22%3A3832%7D%7D%2C%22watchEndpoint%22%3A%7B%22videoId%22%3A%229SwFwTrwS9I%22%2C%22params%22%3A%22EAEYAdoBBAgBKgA%253D%22%2C%22playerParams%22%3A%22QAFIAQ%253D%253D%22
Source: global traffic HTTP traffic detected: GET /vi/PhAWyOuIedc/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLD4RJtmGLu40UtKaWB3eJQyV8YcuQ HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/A1UhABiAfVk/hqdefault.jpg?sqp=-oaymwE1CKgBEF5IVfKriqkDKAgBFQAAiEIYAXABwAEG8AEB-AH-CYAC0AWKAgwIABABGHIgSyhBMA8=&rs=AOn4CLBY0QeauuWCoxmjyiPaa36eAlVtJg HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/a0uQnWAmf-k/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLBaerH-yRqCgB990a0q_118JlobhQ HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/snHWQSCItwo/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLCxV6w5MeAjBb3i4NrgcAo_QjJ4sA HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pagead/adview?ai=CFt-9fhAGZor8HdXjo9kPqN-H0A2aoYjkddzxvbTuErCQHxABIABgyYaAgICA9A-CARdjYS1wdWItNjIxOTgxMTc0NzA0OTM3MaAB6IDv0AOoAwSqBI4DT9CnfleWQR6tptCKJ8xIg_piFus0ziAYsO29nhsV8gp7xHUCK3oCRa9TZhAGqF7cmfD13vK1wV4QKF-FLMPJADmn4VSilpTV9AeglOQYeaWCtp4LLSa0c5wdcZv26wlQOdPcENBkbMqeQ7io6Y94vfX2aZCzZkWxQ3gjVOaC20QRyaDXxLQGN1lddzCjfLpu43J4_9NyWJROZRMai0vux69yKT1ztEtCVDgpjzQZ1WyAAvmKMK1K3XsOQeNXxRLeBdNi6Gbhf4au0Drd0adrWsfINHR5lb7ONIAhCT7KaSkAOjerMvG7Ts5P3epgGczDU0tdWSzddbdJeayV5zshziQGgwm3DL1C-9aQsTVFlJNhEGZwB3WwzHfPF_rGt1AqE0VxeTk4_ocstviCFBcB-YmHv45urmOdYfvKz0Yr6YORr_5N7fu6JhQKpKGkJb3iacTCjoOJmoEiyIebDOOpogTBGXmZ0_9kZvtx-dlZs2-mCQEu604X_av1cl9FpdI3sFAcxVfvEXOl61Qgn3DABPS_sOefBIgF9s7dzDaSBQQIAxACoAZUgAeA_5AvkAcEqAfrtrECqAf5sbECqAeAurECqAfttbECqAfnnbECqAfonbECqAfqt7ECqAentbECqAfvtbECqAfwtbECqAeCqrECqAe2ubECqAeQv7ECqAeECKgHqNIbqAe2B6gHpJqxAqgHkZ-xAqgHsJuxAqgHrrGxAqgH5ryxAqgHpqqxAqgH_bKxAqgHqL2xAqgHw72xAqgH97ixAqgH-LixAqgHgcYbqAf8r7ECqAerxRuoB-PZG6gHt6mxAqgHl7qxAqgH6auxApIIC2JJZWtLdXduVW9vqAgB0gglCIBBEAEYXjICggI6CIBjgMCAgIAgSNmg0jVQFFiIhLjJoJiFA_IIH2NhLXl0LWhvc3QtcHViLTk5NTM0NjA1MzM0MDk0MzPICRjICY8ByAmQAaELwH62dAosIQ26C0YIARABGAUgASgBMBBAAUgBYABoAHACiAEAmAEBogESCgAYACAAWAFgAHABqAIB2AICqAEB2AEBgAIBiAIGqAIAtQKFryRCuBP___________8BiBQDsBQBwBXJgIBAkBYBihcYCAMYASABKAEwATgBQAFIAVABWAFgAnABoBcBqRcVDjRWmNhGa7oXBCgAMADSFxAKBOjWsioSAvBZGIIBIgEA&sigh=F3QN_2k9Ru0&cid=CAASFeRo_JUCE_unXs8dg4No52FgbZPMnQ&ad_cpn=u2CvPOl5gYyTxfLm&lact=3727 HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-YouTube-Device: cbr=Chrome&cbrver=117.0.0.0&ceng=WebKit&cengver=537.36&cos=Windows&cosver=10.0&cplatform=DESKTOPX-YouTube-Page-Label: youtube.desktop.web_20240327_00_RC00sec-ch-ua-arch: "x86"X-YouTube-Page-CL: 619251461sec-ch-ua-platform-version: "10.0.0"X-YouTube-Utc-Offset: 60sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""X-YouTube-Time-Zone: Europe/Zurichsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-full-version: "117.0.5938.132"X-YouTube-Client-Name: 1X-YouTube-Client-Version: 2.20240327.00.00X-Goog-Visitor-Id: CgstXzcta0RXRDRERSjooJiwBjIKCgJVUxIEGgAgUg%3D%3DX-YouTube-Ad-Signals: dt=1711673452314&flash=0&frm&u_tz=60&u_his=2&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=870&biw=1017&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=2&wgl=true&ca_type=imageAccept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/watch?v=9SwFwTrwS9IAccept-Encoding: gzip, deflate, brAccept-Lan
Source: global traffic HTTP traffic detected: GET /ytc/AIdro_n58AzmUwydoAhiZFw9tUbwmZisUsSfbpGXLGD-1A=s176-c-k-c0x00ffffff-no-rj HTTP/1.1Host: yt3.ggpht.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /api/stats/ads?ver=2&ns=1&event=2&device=1&content_v=9SwFwTrwS9I&el=detailpage&ei=fhAGZvjyG8WM_9EPloyC0A0&devicever=2.20240327.00.00&bti=9477942&format=15_2_1&break_type=1&conn=0&cpn=Ifd28Q9FCiFBrPR_&lact=3727&m_pos=0&mt=0&p_h=360&p_w=640&rwt=[RWT]&sdkv=h.3.0.0&slot_pos=0&slot_len=2&vis=3&vol=100&wt=1711673473460&ad_cpn=u2CvPOl5gYyTxfLm&ad_id=%2C648113256668&ad_len=30000&ad_mt=0&ad_sys=YT%3AAdSense-Viral%2CAdSense-Viral&ad_v=bIekKuwnUoo&aqi=fhAGZor8HdXjo9kPqN-H0A0&ad_rmp=1&sli=1&slfs=1&loginael=1 HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-YouTube-Device: cbr=Chrome&cbrver=117.0.0.0&ceng=WebKit&cengver=537.36&cos=Windows&cosver=10.0&cplatform=DESKTOPX-YouTube-Page-Label: youtube.desktop.web_20240327_00_RC00sec-ch-ua-arch: "x86"X-YouTube-Page-CL: 619251461sec-ch-ua-platform-version: "10.0.0"X-YouTube-Utc-Offset: 60sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""X-YouTube-Time-Zone: Europe/Zurichsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-full-version: "117.0.5938.132"X-YouTube-Client-Name: 1X-YouTube-Client-Version: 2.20240327.00.00X-Goog-Visitor-Id: CgstXzcta0RXRDRERSjooJiwBjIKCgJVUxIEGgAgUg%3D%3DX-YouTube-Ad-Signals: dt=1711673452314&flash=0&frm&u_tz=60&u_his=2&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=870&biw=1017&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=2&wgl=true&ca_type=imageAccept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/watch?v=9SwFwTrwS9IAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70; ST-lbf88v=csn=MC42MzYzMTk1MzQxMzE3MDYz&itct=CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D&lact=50&pbis=3&prefetch_reason=hc_pbis&vis=0&autonav=1&endpoint=%7B%22clickTrackingParams%22%3A%22CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D%22%2C%22commandMetadata%22%3A%7B%22webCommandMetadata%22%3A%7B%22url%22%3A%22%2Fwatch%3Fv%3D9SwFwTrwS9I%26pp%3DQAFIAQ%253D%253D%22%2C%22webPageType%22%3A%22WEB_PAGE_TYPE_WATCH%22%2C%22rootVe%22%3A3832%7D%7D%2C%22watchEndpoint%22%3A%7B%22videoId%22%3A%229SwFwTrwS9I%22%2C%22params%22%3A%22EAEYAdoBBA
Source: global traffic HTTP traffic detected: GET /vi/7Ii0iz3lwFI/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLAOWsAN0tT34RzuWEMH2XPKmzUn5Q HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/9SwFwTrwS9I/mqdefault.jpg HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pcs/activeview?xai=AKAOjssyEPizXs2Cw6socfNor-5iDvku7HYZ2Zqe96OtPxAodssTTDD_p3BOBBiFggnjihuBr3Z-AFoQUUwyEfBFV2gJMot5SSpj44UHhFZ87DtbHq95va-0Na3frskhEjmhATncEQ_ktKsan3FjVho&sig=Cg0ArKJSzM1MmLsM0N-5EAE&ad_cpn=u2CvPOl5gYyTxfLm&id=lidarv&acvw=sv%3D961%26v%3D20240326%26cb%3Dyw%26e%3D15%26nas%3D1%26sdk%3Db%26p%3D80,24,440,664%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D1017,2199%26scs%3D1280,1024%26bs%3D1017,870%26vht%3D3%26mut%3D0%26a%3D1%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D1%26vpt%3D0%26gmm%3D4%26efpf%3D2%26vmmk%3D20%26nmt%3D0%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D30000%26vmtime%3D0%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D67108918%26i0%3D67108918%26ic%3D0%26cs%3D67108918%26mc%3D0%26nc%3D0%26mv%3D1%26nv%3D1%26lte%3D0%26ces%26tth%3D9%26avms%3Dgeo%26qi%3DiITaXvsvlpUiIkMN%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D1%26ptlt%3D21153%26pngs%3D9,14,15%26veid%3Dfmd%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0%26co%3D760627302&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1711673473449&avm=1 HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-YouTube-Device: cbr=Chrome&cbrver=117.0.0.0&ceng=WebKit&cengver=537.36&cos=Windows&cosver=10.0&cplatform=DESKTOPX-YouTube-Page-Label: youtube.desktop.web_20240327_00_RC00sec-ch-ua-arch: "x86"X-YouTube-Page-CL: 619251461sec-ch-ua-platform-version: "10.0.0"X-YouTube-Utc-Offset: 60sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""X-YouTube-Time-Zone: Europe/Zurichsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-full-version: "117.0.5938.132"X-YouTube-Client-Name: 1X-YouTube-Client-Version: 2.20240327.00.00X-Goog-Visitor-Id: CgstXzcta0RXRDRERSjooJiwBjIKCgJVUxIEGgAgUg%3D%3DX-YouTube-Ad-Signals: dt=1711673452314&flash=0&frm&u_tz=60&u_his=2&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=870&biw=1017&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=2&wgl=true&ca_type=imageAccept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/watch?v=9SwFwTrwS9IAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70; ST-lbf88v=csn=MC42MzYzMTk1MzQxMzE3MDYz&itct=CAAQg2ciEwiSm4W_oJiFAxXh1nIJH
Source: global traffic HTTP traffic detected: GET /api/stats/playback?ns=yt&el=detailpage&cpn=gXakwPHLqBLlswIF&ver=2&cmt=0.004&fmt=396&fs=0&rt=2.416&euri&lact=2462&cl=619202668&mos=0&volume=100&cbr=Chrome&cbrver=117.0.0.0&c=WEB&cver=2.20240327.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&hl=en_US&cr=US&len=9.621&fexp=v1%2C23983296%2C2730%2C12811%2C5807%2C76094%2C54572%2C73455%2C230596%2C84737%2C464%2C25896%2C9958%2C6271%2C133212%2C26306282%2C4054%2C7111%2C9369%2C10825%2C1265%2C395%2C14489%2C9954%2C1192%2C7913%2C1991%2C16592%2C1598%2C2549%2C911%2C1908%2C2%2C4747%2C1942%2C880%2C1127%2C5975%2C2%2C3095%2C3440%2C5%2C9073%2C592%2C39%2C2%2C2%2C2%2C2%2C171%2C5951%2C194%2C601%2C644%2C57%2C186%2C2840%2C2556%2C416%2C3%2C2373%2C2%2C1066%2C6894&rtn=11&afmt=251&muted=0&docid=a0uQnWAmf-k&ei=fxAGZtijBuC2_9EP_uSg8Aw&plid=AAYUwgk4D955Nhmt&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y&of=wbAUJoLFDaeeOSJrHXH1sg&vm=CAEQABgEOjJBSHFpSlRKbTZmZ05nT1NHYkEtRVE1d2lrRVJLNl9EZE4zc0JqLWEwSFBVR0o5WnhSd2JiQVBta0tES0VESmVoeWFjOWhZVDVCZXpXVXNCOXN0OVU4bmh4QllTdnY5a181SDE2S1IyNEs0eF9xRXEyM1NUMnlCbFRGZVZOVERWYnpxR3F0OUdxOGNEY0gySk5raVlONkFoAg HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-YouTube-Device: cbr=Chrome&cbrver=117.0.0.0&ceng=WebKit&cengver=537.36&cos=Windows&cosver=10.0&cplatform=DESKTOPX-YouTube-Page-Label: youtube.desktop.web_20240327_00_RC00sec-ch-ua-arch: "x86"X-Goog-Request-Time: 1711673473633X-YouTube-Page-CL: 619251461X-Goog-Event-Time: 1711673473633X-YouTube-Utc-Offset: 60sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""X-YouTube-Time-Zone: Europe/Zurichsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-full-version: "117.0.5938.132"X-YouTube-Client-Name: 1X-YouTube-Client-Version: 2.20240327.00.00X-Goog-Visitor-Id: CgstXzcta0RXRDRERSj_oJiwBjIKCgJVUxIEGgAgUg%3D%3DX-YouTube-Ad-Signals: dt=1711673471330&flash=0&frm&u_tz=60&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=870&biw=1017&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&wgl=true&ca_type=imageAccept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/watch?v=a0uQnWAmf-k&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y&index=230Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-n
Source: global traffic HTTP traffic detected: GET /ddm/trackimp/N1087876.2805603GOOGLEPREFERRED-/B25462951.388983259;dc_trk_aid=580346077;dc_trk_cid=211251669;ord=3471876107;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_tdv=1;dc_rui=1;dc_exteid=6510874264711640196;dc_av=536;dc_sk=1;dc_ctype=84;dc_ref=http://www.youtube.com/video/9SwFwTrwS9I;dc_eps=AHas8cC-r0GfDeAmsmLz4s1TGsR5bFO0o1EXZL30C3Ra9OS885KXlWWGJVWDEAPvnudXqjCL5BLPlM_I-sxz;dc_pubid=2;dc_btype=23?gclid=EAIaIQobChMIirO4yaCYhQMV1fEoBR2o7wHaEAEYASAAEgKa8fD_BwE&ase=2 HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Attribution-Reporting-Eligible: event-source;trigger;navigation-sourcesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.youtube.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi/bIekKuwnUoo/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLDcGJ-YEWVppQmNdK8oO_qpLapH2g HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ptracking?html5=1&video_id=a0uQnWAmf-k&cpn=gXakwPHLqBLlswIF&ei=fxAGZtijBuC2_9EP_uSg8Aw&ptk=youtube_none&pltype=contentugc&m=AxT1yhdc75C4zllVBqikZI9I1BT5K6OtKMbsnQ6PI3ul3E1aX-Ki9ZAi7_hv6gIViuYNHV6qQ3Lu8o9pr8sgEk3O HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-YouTube-Device: cbr=Chrome&cbrver=117.0.0.0&ceng=WebKit&cengver=537.36&cos=Windows&cosver=10.0&cplatform=DESKTOPX-YouTube-Page-Label: youtube.desktop.web_20240327_00_RC00sec-ch-ua-arch: "x86"X-YouTube-Page-CL: 619251461sec-ch-ua-platform-version: "10.0.0"X-YouTube-Utc-Offset: 60sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""X-YouTube-Time-Zone: Europe/Zurichsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-full-version: "117.0.5938.132"X-YouTube-Client-Name: 1X-YouTube-Client-Version: 2.20240327.00.00X-Goog-Visitor-Id: CgstXzcta0RXRDRERSj_oJiwBjIKCgJVUxIEGgAgUg%3D%3DX-YouTube-Ad-Signals: dt=1711673471139&flash=0&frm&u_tz=60&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=870&biw=1017&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&wgl=true&ca_type=imageAccept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/watch?v=a0uQnWAmf-k&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y&index=230Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=OkfD2ZjtaAg; VISITOR_INFO1_LIVE=-_7-kDWD4DE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUg%3D%3D; PREF=tz=Europe.Zurich; CONSISTENCY=AKreu9vVeDmgNoH-1J_00DTuIrgYYvlQIzAfG9KeJGbxULXNDUlCK-r-nvPMQlJzafwEIPWgzyJ-T8PHSfOG3IzR-aKyrtZZ86cu1Oi0U7qtw3yrJ89X-4udpOxEWLttCTStrXz4PrRFEXDUn121-70; ST-lbf88v=csn=MC42MzYzMTk1MzQxMzE3MDYz&itct=CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D&lact=50&pbis=3&prefetch_reason=hc_pbis&vis=0&autonav=1&endpoint=%7B%22clickTrackingParams%22%3A%22CAAQg2ciEwiSm4W_oJiFAxXh1nIJHbDECR4yDHJlbGF0ZWQtYXV0b0iAq7Tyic6_okSaAQUIAxD4HQ%3D%3D%22%2C%22commandMetadata%22%3A%7B%22webCommandMetadata%22%3A%7B%22url%22%3A%22%2Fwatch%3Fv%3D9SwFwTrwS9I%26pp%3DQAFIAQ%253D%253D%22%2C%22webPageType%22%3A%22WEB_PAGE_TYPE_WATCH%22%2C%22rootVe%22%3A3832%7D%7D%2C%22watchEndpoint%22%3A%7B%22videoId%22%3A%229SwFwTrwS9I%22%2C%22params%22%3A%22EAEYAdoBBAgBKgA%253D%22%2C%22playerParams%22%3A%22QAFIAQ%253D%253D%22%2C%22watchEndpointSupportedPrefetchConfig%22%3A%7B%22prefetchHintConfig%22%3A%7B%22prefetchPriority%22%3A0%2C%22countdownUiRelativeSecondsPrefetchCondition%22%3A-3%7D%7D%7D%7D; S
Source: global traffic HTTP traffic detected: GET /api/stats/playback?ns=yt&el=adunit&cpn=u2CvPOl5gYyTxfLm&ver=2&cmt=0.089&fmt=396&fs=0&rt=1.902&adformat=15_2_1&content_v=9SwFwTrwS9I&euri&lact=4023&cl=619202668&mos=0&volume=100&cbr=Chrome&cbrver=117.0.0.0&c=WEB&cver=2.20240327.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&autoplay=1&delay=28&hl=en_US&cr=US&len=30.061&fexp=v1%2C23983296%2C2730%2C12811%2C5807%2C76094%2C54572%2C73455%2C230596%2C84737%2C464%2C25896%2C9958%2C6271%2C133212%2C26306282%2C4054%2C7111%2C9369%2C10825%2C1265%2C395%2C14489%2C9954%2C1192%2C7913%2C1991%2C16592%2C1598%2C2549%2C911%2C1908%2C2%2C4747%2C1942%2C880%2C1127%2C5975%2C2%2C3095%2C3440%2C5%2C9073%2C592%2C39%2C2%2C2%2C2%2C2%2C171%2C5951%2C194%2C601%2C644%2C57%2C186%2C2840%2C2556%2C416%2C3%2C2373%2C3%2C1065%2C6894&rtn=4&afmt=251&muted=0&vis=3&cc=.en&docid=bIekKuwnUoo&ei=fxAGZvOKBcWM_9EPloyC0A0&plid=AAYUwgk3SztzxXkJ&referrer=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DRET-cJ5NFYA&sdetail=rv%3ARET-cJ5NFYA&sourceid=yw&adcontext=CAESEwiKs7jJoJiFAxXV8SgFHajvAdogASgFMAE&aqi=fhAGZor8HdXjo9kPqN-H0A0&of=wbAUJoLFDaeeOSJrHXH1sg&vm=CAEQABgEOjJBSHFpSlRLWUJrckMwNDBfbWxocVlxQWZMcVl3WFJ0YTdMSl9EeTFpNTBHQUh5N3Rzd2JnQVBta0tESnltbVpRLXo4UWY5OHZ5M0dRaFhxOHBHaGZfb3VXX2dPSGlicFdadkd4X1JIOXFhTUROS0MwTG5nNEJLNUZ3bjF6bEdFdEpkUVVVVXNZLUFPVTFRQ3Ewb1NBYkZ3cU93d2gC&host_cpn=Ifd28Q9FCiFBrPR_ HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-YouTube-Device: cbr=Chrome&cbrver=117.0.0.0&ceng=WebKit&cengver=537.36&cos=Windows&cosver=10.0&cplatform=DESKTOPX-YouTube-Page-Label: youtube.desktop.web_20240327_00_RC00sec-ch-ua-arch: "x86"X-Goog-Request-Time: 1711673473757X-YouTube-Page-CL: 619251461X-Goog-Event-Time: 1711673473757X-YouTube-Utc-Offset: 60sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""X-YouTube-Time-Zone: Europe/Zurichsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-full-version: "117.0.5938.132"X-YouTube-Client-Name: 1X-YouTube-Client-Version: 2.20240327.00.00X-Goog-Visitor-Id: CgstXzcta0RXRDRERSjooJiwBjIKCgJVUxIEGgAgUg%3D%3DX-YouTube-Ad-Signals: dt=1711673452595&flash=0&frm&u_tz=60&u_his=2&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&bc=31&bih=870&biw=1017&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=2&wgl=true&ca_type=imageAccept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/watch?v=9SwFwTrwS9IAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1;
Source: global traffic HTTP traffic detected: GET /search?q=free+google+play+cards+no+survey+2017 HTTP/1.1Host: google.co.ckConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /search?q=how+to+make+a+sandwich HTTP/1.1Host: google.co.ckConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /search?q=cats&tbm=isch HTTP/1.1Host: google.co.ckConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /search?q=cats&tbm=isch HTTP/1.1Host: www.google.co.ckConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /search?q=how+to+move+to+north+korea HTTP/1.1Host: google.co.ckConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: chromecache_239.13.dr String found in binary or memory: "&label=videoskipped&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+hb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],closePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=adclose&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}],progressPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: "&uga="+eb+"&vm="+gd},videostatsDelayplayUrl:{baseUrl:"https://s.youtube.com/api/stats/delayplay?cl="+lc+"&docid="+y+"&ei="+Y+"&feature="+m+"&fexp="+Ze+"&ns="+Ia+"&plid="+L+"&referrer=https%3A%2F%2Fwww.youtube.com%2F&sdetail=p%3A%2F&sourceid="+Jc+"&el="+nd+"&len="+Vb+"&of="+Hb+"&uga="+eb+"&vm="+gd},videostatsWatchtimeUrl:{baseUrl:"https://s.youtube.com/api/stats/watchtime?cl="+lc+"&docid="+y+"&ei="+Y+"&feature="+m+"&fexp="+Ze+"&ns="+Ia+"&plid="+L+"&referrer=https%3A%2F%2Fwww.youtube.com%2F&sdetail=p%3A%2F&sourceid="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: "=",adInfoRenderer:{adHoverTextButtonRenderer:{button:{buttonRenderer:{style:"STYLE_UNKNOWN",size:"SIZE_DEFAULT",isDisabled:!1,icon:{iconType:"INFO_OUTLINE"},navigationEndpoint:{clickTrackingParams:Hc,openPopupAction:{popup:{aboutThisAdRenderer:{url:(ae.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue="https://www.youtube.com/aboutthisad?pf=web&source=youtube&reasons=A"+T+"&hl="+Ia+"&origin=www.youtube.com&ata_theme="+Be,ae),trackingParams:gb+"="}},popupType:"DIALOG"}},trackingParams:gb+"="}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: "="},trackingParams:gb+"="}},adLayoutLoggingData:{serializedAdServingDataEntry:ud},skipPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=videoskipped&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+hb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],layoutId:"1ID7Gdwk2vV7OZ1A"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: "="}},hoverText:{runs:[{text:Kc}]},trackingParams:gb+"="}},adVideoId:Kc,impressionPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=video_companion_reshow_tracking"}],adLayoutLoggingData:{serializedAdServingDataEntry:Nd},isContentVideoCompanion:!0,associatedCompositePlayerBytesLayoutId:Yc}},adSlotLoggingData:{serializedSlotAdServingDataEntry:Kc}}}],adBreakHeartbeatParams:"Q0FBJTNE",frameworkUpdates:{entityBatchUpdate:{mutations:[{entityKey:$e, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: "AxAA&ase=2&num="+la+"&cid="+na+"&ad_cpn=%5BAD_CPN%5D&sig="+ca+"&adurl="+ad+"&label=video_click_to_advertiser_site&ctype="+Ib+"&ms=[CLICK_MS]",target:"TARGET_NEW_WINDOW",attributionSrcMode:"ATTRIBUTION_SRC_MODE_LABEL_CHROME"}},trackingParams:gb+"=",backgroundImage:{thumbnail:{thumbnails:[{url:""}]},trackingParams:gb+"="},abandonCommands:{commands:[{clickTrackingParams:Hc,loggingUrls:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=video_abandon&ad_mt=[AD_MT]&ad_tos=[AD_TOS]&ad_wat=[AD_WAT]&final=[FINAL]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: "https://www.youtube.com/aboutthisad?pf=web&source=youtube&reasons=A"+T+"&hl="+Ia+"&origin=www.youtube.com&ata_theme="+Be,ch),trackingParams:gb+"="}},popupType:"DIALOG"}},trackingParams:gb+"="}},hoverText:{runs:[{text:Rd}]},trackingParams:gb+"="}},adVideoId:Kc,impressionPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=video_companion_impression_tracking"}],adLayoutLoggingData:{serializedAdServingDataEntry:Kc},associatedCompositePlayerBytesLayoutId:Yc}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: "https://www.youtube.com/aboutthisad?pf=web&source=youtube&reasons=A"+T+"&hl="+Ia+"&origin=www.youtube.com&ata_theme="+Be,dg),trackingParams:gb+"="}},popupType:"DIALOG"}},icon:{iconType:"INFO_OUTLINE"},trackingParams:gb+"="}},hoverText:{runs:[{text:Nd}]},trackingParams:gb+"="}},flyoutCtaRenderer:{flyoutCtaRenderer:{image:{thumbnail:{thumbnails:[{url:"https://yt3.ggpht.com/ytc/"+Ke+"=s176-c-k-c0x00ffffff-no-rj"}]},trackingParams:gb+"="},headline:{text:Xd,isTemplated:!1,trackingParams:gb+"="},description:{text:Kc, equals www.youtube.com (Youtube)
Source: chromecache_423.13.dr String found in binary or memory: (g.Jo(c,"redirector.googlevideo.com"),d=c.toString()):c.j.match("rr?[1-9].*\\.c\\.youtube\\.com$")?(g.Jo(c,"www.youtube.com"),d=c.toString()):(c=oBa(d),HJ(c)&&(d=c));c=new g.DP(d);c.set("cmo=pf","1");e&&c.set("cmo=td","a1.googlevideo.com");return c}; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: BQc.idomCompat=!0;var CQc={LIKE:"LIKE",NOTIFICATION_BELL:"NOTIFICATION_BELL"};function DQc(a){var b=a.animatedIconType,c=a.active,d=a.themeOverride,e=void 0===a.animationRef?{}:a.animationRef,h=a.staticIconFn,l=function(){a:{var L=b();var T=null==d?void 0:d(),Y;T=(null==T?void 0:T.useDarkTheme)||(null==(Y=Qp().resolve(Pp(nF)))?void 0:Y());switch(L){case"LIKE":L=T?"animated_like_icon_v2_dark":"animated_like_icon_v2_light";L={lottiePlayerProps:{animationConfig:{name:L,path:"https://www.gstatic.com/youtube/img/lottie/animated_like_icon/"+L+".json",loop:!1,autoplay:!1,rendererSettings:{viewBoxOnly:!0, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&ad_cpn=[AD_CPN]&lact=[LACT]"},{baseUrl:"https://www.youtube.com/api/stats/ads?ver="+la+"&ns="+la+"&event="+la+"&device="+la+"&content_v="+y+"&el="+nd+"&ei="+Y+"&devicever="+c+"&bti="+hb+"&format="+fc+"&break_type="+la+"&conn=[CONN]&cpn=[CPN]&lact=[LACT]&m_pos="+la+"&mt=[MT]&p_h=[P_H]&p_w=[P_W]&rwt=[RWT]&sdkv="+rb+"&slot_pos="+la+"&slot_len="+la+"&vis=[VIS]&vol=[VOL]&wt=[WT]&ad_cpn=[AD_CPN]&ad_id="+zd+"&ad_len="+Rb+"&ad_mt=[AD_MT]&ad_sys=YT%3AAdSense-Viral%2CAdSense-Viral&ad_v="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=videoskipped&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+hb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],closePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=adclose&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}], equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=adpause&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+eb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],rewindPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=adrewind&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}], equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: DC&&DC.snapshotAndFlush()}},b),(c.flush_logs={callback:function(){aq()}},c))}},OBb);var QBb={},RBb=(QBb.rendered={priority:0,callback:function(){var a=new qJa;a.increment("STARTED");if(hl("LOGGED_IN")&&"test"!==hl("SERVER_VERSION")&&"dev"!==hl("SERVER_VERSION")&&!Aja()&&!zja()){a.increment("EXECUTING");var b=document.createElement("iframe");b.style.display="none";Eca(b,3,Pb("https://accounts.youtube.com/RotateCookiesPage?origin=https://www.youtube.com&yt_pid="+hl("INNERTUBE_CONTEXT_CLIENT_NAME")));document.body&&document.body.appendChild(b);a.increment("DONE")}}},QBb);var SBb={},TBb=(SBb.rendered={callback:function(){Hxb().resume()}},SBb);var UBb={acknowledgeChannelTouStrikeCommand:$C(II),addToPlaylistServiceEndpoint:$C(EJ),addToPlaylistEndpoint:$C(EJ),addUpcomingEventReminderEndpoint:$C(XI),browseEndpoint:$C(lxb),channelCreationFormEndpoint:$C(sI),channelCreationServiceEndpoint:$C(tI),claimLegacyYoutubeChannelEndpoint:$C(fI),clearSearchHistoryEndpoint:$C(PI),clearWatchHistoryEndpoint:$C(QI),commerceActionCommand:aD(aK),createBackstagePostEndpoint:$C($H),createCommentEndpoint:$C(oI),createCommentReplyEndpoint:$C(nI),createLiveChatPollEndpoint:$C(YI), equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: EC.prototype.remove=function(a){this.expiringStorage.remove(a)};var keb=da(["https://www.youtube.com/",""]),leb=da(["https://studio.youtube.com/",""]);function meb(){var a=neb;a||(a=document.querySelector("#persist_identity"));return a} equals www.youtube.com (Youtube)
Source: chromecache_423.13.dr String found in binary or memory: EQa=function(a,b){if(!a.j["0"]){var c=new HK("0","fakesb",{video:new DK(0,0,0,void 0,void 0,"auto")});a.j["0"]=b?new HQ(new g.DP("http://www.youtube.com/videoplayback"),c,"fake"):new TQ(new g.DP("http://www.youtube.com/videoplayback"),c,new qQ(0,0),new qQ(0,0))}}; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: E_.prototype.navigateToAboutTheseResultsPage=function(){var a=zba("https://www.youtube.com/howyoutubeworks/product-features/search/");a?Sc(window,a,"_blank"):ll(Error("Could not get url for 'About These Results' help center"))}; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: I("div",{class:"mini-app-splash-screen-view-model-wiz__loading-icon"},I(vt,null,function(){var E="loading_animation_"+c.value;zmb({className:"mini-app-splash-screen-view-model-wiz__loading-icon-animation",lottiePlayerProps:{animationRef:d,animationConfig:{name:E,path:"https://www.gstatic.com/youtube/img/lottie/playables_loading_animation/"+E+".json",loop:!0,autoplay:!0}}})})),I("div",{class:"mini-app-splash-screen-view-model-wiz__timeout-message-container"},b.title&&I("h3",{class:"mini-app-splash-screen-view-model-wiz__timeout-heading"}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: Jc+"&el="+nd+"&len="+Vb+"&of="+Hb+"&uga="+eb+"&vm="+gd},ptrackingUrl:{baseUrl:"https://www.youtube.com/ptracking?ei="+Y+"&m="+wb+"&oid="+Hb+"&plid="+L+"&pltype="+Mc+"&ptchn="+Hb+"&ptk="+H+"&video_id="+y},qoeUrl:{baseUrl:"https://s.youtube.com/api/stats/qoe?cl="+lc+"&docid="+y+"&ei="+Y+"&event="+Rd+"&feature="+m+"&fexp="+Ze+"&ns="+Ia+"&plid="+L+"&referrer=https%3A%2F%2Fwww.youtube.com%2F&sdetail=p%3A%2F&sourceid="+Jc},atrUrl:{baseUrl:"https://s.youtube.com/api/stats/atr?docid="+y+"&ei="+Y+"&feature="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: Kc+"&aqi="+Y+"&ad_rmp="+la+"&sli="+la}],errorPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=videoplayfailed[ERRORCODE]"}],mutePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=admute&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: OG.prototype.getUrl=function(a,b){return"https://www.gstatic.com/youtube/img/icons/web/"+b.style+"/"+a+"/v"+b.version+"/"+b.size+"px.svg"}; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: Object.assign({},{name:"INCORRECT",path:"https://www.gstatic.com/youtube/img/creator/posts/Lottie_QuizIncorrect_LightTheme_01a.json",renderer:"svg"},t8b,{rendererSettings:{viewBoxOnly:!0,viewBoxSize:"26 26 80 80"}});a.correctnessAnimationProps=[];a.correctnessAnimationRefs=[];return a}; equals www.youtube.com (Youtube)
Source: chromecache_138.13.dr String found in binary or memory: _.k.fJ=function(a,b){this.trigger(_.eF,{button:""});_.Ou(a,{target:b?"_blank":"_self"});iuc(this,"fwibVc")};_.k.tob=function(){var a={url:this.url};this.H&&this.H.length&&(a.text=this.H);a=_.fM("https://www.twitter.com/share",a);this.fJ(a,!0)};_.k.yob=function(){var a=_.fM("https://api.whatsapp.com/send",{text:(this.H&&this.H.length?this.H+" ":"")+this.url});this.fJ(a,!0)};_.k.mnb=function(){var a=_.fM("https://www.facebook.com/sharer/sharer.php",{u:this.url});this.fJ(a,!0)}; equals www.facebook.com (Facebook)
Source: chromecache_138.13.dr String found in binary or memory: _.k.fJ=function(a,b){this.trigger(_.eF,{button:""});_.Ou(a,{target:b?"_blank":"_self"});iuc(this,"fwibVc")};_.k.tob=function(){var a={url:this.url};this.H&&this.H.length&&(a.text=this.H);a=_.fM("https://www.twitter.com/share",a);this.fJ(a,!0)};_.k.yob=function(){var a=_.fM("https://api.whatsapp.com/send",{text:(this.H&&this.H.length?this.H+" ":"")+this.url});this.fJ(a,!0)};_.k.mnb=function(){var a=_.fM("https://www.facebook.com/sharer/sharer.php",{u:this.url});this.fJ(a,!0)}; equals www.twitter.com (Twitter)
Source: chromecache_423.13.dr String found in binary or memory: a))):this.Xd(g.lW(a.errorMessage)):this.Xd(nW(this,"HTML5_NO_AVAILABLE_FORMATS_FALLBACK_WITH_LINK_SHORT","//www.youtube.com/supported_browsers")):(a=d.hostLanguage,c="//support.google.com/youtube/?p=player_error1",a&&(c=g.dn(c,{hl:a})),this.Xd(nW(this,"GENERIC_WITH_LINK_AND_CPN",c,!0)),d.Kc&&!d.D&&PYa(this,function(e){if(g.SU(e,b.api,!cS(b.api.U()))){e={as3:!1,html5:!0,player:!0,cpn:b.api.getVideoData().clientPlaybackNonce};var f=b.api;f.Bc("onFeedbackArticleRequest",{articleId:3037019,helpContext:"player_error", equals www.youtube.com (Youtube)
Source: chromecache_423.13.dr String found in binary or memory: a.BASE_YT_URL)||"")||fBa(this.Vf)||this.protocol+"://www.youtube.com/";h=b?b.eventLabel:a.el;d="detailpage";"adunit"===h?d=this.D?"embedded":"detailpage":"embedded"===h||this.N?d=dC(d,h,FRa):h&&(d="embedded");this.Na=d;Vta();h=null;d=b?b.playerStyle:a.ps;f=g.Fb(GRa,d);!d||f&&!this.N||(h=d);this.playerStyle=h;this.oa=(this.K=g.Fb(GRa,this.playerStyle))&&"play"!==this.playerStyle&&"jamboard"!==this.playerStyle;this.pp=!this.oa;this.Xa=cC(!1,a.disableplaybackui);this.disablePaidContentOverlay=cC(!1, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: a.content.firstChild);var b=a.content,c=b.insertBefore;void 0===EMc&&(EMc=document.createElement("template"));var d=EMc;c.call(b,d.content.cloneNode(!0),a.content.firstChild);return FMc=a},{mode:B("main_app_sink_wrapper_batch_4")?3:V()?0:1});var HMc;var IMc;var E1=function(){var a=M.apply(this,arguments)||this;a.dark=!1;a.headerBackgroundLight="https://www.gstatic.com/youtube/img/labs/early_access_web_background_expanded_ai_2x.jpg";a.headerBackgroundDark="https://www.gstatic.com/youtube/img/labs/early_access_web_background_expanded_ai_2x.jpg";a.actionMap={"yt-dark-mode-toggled-action":"onDarkModeToggledAction"};return a}; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: a.content.firstChild);var b=a.content,c=b.insertBefore;void 0===Frc&&(Frc=document.createElement("template"));var d=Frc;c.call(b,d.content.cloneNode(!0),a.content.firstChild);return Grc=a},{mode:B("main_app_sink_wrapper_batch_4")?3:V()?0:1});var Jrc;var Krc;var Lrc=function(){var a=M.apply(this,arguments)||this;a.rightSquigglyDark="https://www.gstatic.com/youtube/img/handles/handles_squiggle_1_dark_v1.svg";a.rightSquigglyLight="https://www.gstatic.com/youtube/img/handles/handles_squiggle_1_light_v1.svg";a.leftSquigglyDark="https://www.gstatic.com/youtube/img/handles/handles_squiggle_2_dark_v1.svg";a.leftSquigglyLight="https://www.gstatic.com/youtube/img/handles/handles_squiggle_2_light_v1.svg";a.leftSquiggly=a.leftSquigglyLight;a.rightSquiggly=a.rightSquigglyLight; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: a.content.firstChild);var b=a.content,c=b.insertBefore;void 0===Jrc&&(Jrc=document.createElement("template"));var d=Jrc;c.call(b,d.content.cloneNode(!0),a.content.firstChild);return Krc=a},{mode:B("main_app_sink_wrapper_batch_4")?3:V()?0:1});var Mrc;var Nrc;var Orc=function(){var a=M.apply(this,arguments)||this;a.actionMap={"yt-dark-mode-toggled-action":"onDarkModeToggledAction"};a.image0DarkSquigglyBackground="https://www.gstatic.com/youtube/img/handles/handles_squiggle_4_dark.svg";a.image0LightSquigglyBackground="https://www.gstatic.com/youtube/img/handles/handles_squiggle_4_light.svg";a.image1DarkSquigglyBackground="https://www.gstatic.com/youtube/img/handles/handles_squiggle_6_dark.svg";a.image1LightSquigglyBackground="https://www.gstatic.com/youtube/img/handles/handles_squiggle_6_light.svg"; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: a.content.firstChild);var b=a.content,c=b.insertBefore;void 0===ayc&&(ayc=document.createElement("template"));var d=ayc;c.call(b,d.content.cloneNode(!0),a.content.firstChild);return byc=a},{mode:B("main_app_sink_wrapper_batch_6")?3:V()?0:1});var dyc;var eyc;var fyc=EB(gA("DELETE_FROM_DOWNLOADS",{},"Delete from downloads"));var gyc={url:"https://www.gstatic.com/youtube/img/useredu/smart_downloads_optin_banner.svg"}; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: a.content.firstChild);var b=a.content,c=b.insertBefore;void 0===q8b&&(q8b=document.createElement("template"));var d=q8b;c.call(b,d.content.cloneNode(!0),a.content.firstChild);return r8b=a},{mode:B("main_app_sink_wrapper_batch_11")?3:1});var t8b={autoplay:!1,loop:!1},u8b={simpleText:""},v8b=function(){var a=M.apply(this,arguments)||this;a.isLoading=!1;a.usesPanelLockup=!1;a.enableRefreshWeb=B("enable_cairo_refresh_web");a.selectedItemIndex=-1;a.baseCorrectLottiePlayerAnimationConfig=Object.assign({},{name:"CORRECT",path:"https://www.gstatic.com/youtube/img/creator/posts/Lottie_QuizCorrect_LightTheme_01a.json",renderer:"svg"},t8b,{rendererSettings:{viewBoxOnly:!0,viewBoxSize:"12 20 80 80"}});a.baseIncorrectLottiePlayerAnimationConfig= equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: a.content.insertBefore(W().content.cloneNode(!0),a.content.firstChild);var b=a.content,c=b.insertBefore;void 0===Prc&&(Prc=document.createElement("template"));var d=Prc;c.call(b,d.content.cloneNode(!0),a.content.firstChild);return Qrc=a},{mode:B("main_app_sink_wrapper_batch_4")?3:V()?0:1});var Src;var Trc;var Urc=function(){var a=M.apply(this,arguments)||this;a.JSC$15414_squigglyBackgroundDark="https://www.gstatic.com/youtube/img/handles/handles_curl_section_illustration_dark_v1.svg";a.JSC$15414_squigglyBackgroundLight="https://www.gstatic.com/youtube/img/handles/handles_curl_section_illustration_light_v1.svg";a.actionMap={"yt-dark-mode-toggled-action":"onDarkModeToggledAction"};a.squigglyBackground=a.JSC$15414_squigglyBackgroundLight;return a}; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: a.content.insertBefore(W().content.cloneNode(!0),a.content.firstChild);var b=a.content,c=b.insertBefore;void 0===Src&&(Src=document.createElement("template"));var d=Src;c.call(b,d.content.cloneNode(!0),a.content.firstChild);return Trc=a},{mode:B("main_app_sink_wrapper_batch_4")?3:1});var Vrc;var Wrc;var Xrc=function(){var a=M.apply(this,arguments)||this;a.JSC$15417_squigglyBackgroundDark="https://www.gstatic.com/youtube/img/handles/handles_squiggle_3_dark.svg";a.JSC$15417_squigglyBackgroundLight="https://www.gstatic.com/youtube/img/handles/handles_squiggle_3_light.svg";a.squigglyBackground=a.JSC$15417_squigglyBackgroundLight;a.actionMap={"yt-dark-mode-toggled-action":"onDarkModeToggledAction"};return a}; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: a.image3DarkSquigglyBackground="https://www.gstatic.com/youtube/img/handles/handles_squiggle_5_dark.svg";a.image3LightSquigglyBackground="https://www.gstatic.com/youtube/img/handles/handles_squiggle_5_light_v2.svg";a.image0SquigglyBackground=a.image0LightSquigglyBackground;a.image1SquigglyBackground=a.image1LightSquigglyBackground;a.image3SquigglyBackground=a.image3LightSquigglyBackground;return a}; equals www.youtube.com (Youtube)
Source: chromecache_423.13.dr String found in binary or memory: a.severity,e,sK(a.details),f)}else this.qa.ra("nonfatalerror",a),d=/^pp/.test(this.videoData.clientPlaybackNonce),this.Be(a.errorCode,a.details),d&&"manifest.net.connect"===a.errorCode&&(a="https://www.youtube.com/generate_204?cpn="+this.videoData.clientPlaybackNonce+"&t="+(0,g.gD)(),mU(a,"manifest",function(h){b.G=!0;b.ma("pathprobe",h)},function(h){b.Be(h.errorCode,h.details)}))}}; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"LigQMVuP3nAx3LwQfSGhgYmqsEWANi"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"65",offsetEndMilliseconds:"30"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"51",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"LigQMVuP3nAx3LwQfSGhgYmqsEWANi"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_START",adTimeOffset:{offsetStartMilliseconds:"330100",offsetEndMilliseconds:"594666"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"0",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"by"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"73",offsetEndMilliseconds:"64"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"67",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"cn"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"59",offsetEndMilliseconds:"8"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"26",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"fp"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"66",offsetEndMilliseconds:"35"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"98",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"go"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"14",offsetEndMilliseconds:"87"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"79",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"nh"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_END",adTimeOffset:{offsetStartMilliseconds:"25",offsetEndMilliseconds:"13"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"32",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"nl"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"50",offsetEndMilliseconds:"67"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"96",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"ov"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"13",offsetEndMilliseconds:"2"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"52",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"ti"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"47",offsetEndMilliseconds:"84"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"10",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"uc"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"10",offsetEndMilliseconds:"zo"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"22",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"wg"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"56",offsetEndMilliseconds:"86"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"25",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"wi"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"34",offsetEndMilliseconds:"12"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"27",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"wz"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"84",offsetEndMilliseconds:"90"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"92",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: animationConfig:{name:"animated-actions-foreground",autoplay:!1,loop:!1,path:"https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_sparkle_"+(w9b()?"dark":"light")+".json"}}})}))} equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: autoplay:!1,loop:!1,path:"https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_container_"+(w9b()?"dark":"light")+".json"}}})}),d),ls(e,function(){return I(v9b,{lottiePlayerProps:{animationRef:c, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: b.includes("/YouTubeCenter.js")||b.includes("/mytube.js")||b.includes("JSON.parseWrapper")||b.includes("/inj_js/common.js")||b.includes("firebug-lite")||b.includes(".repl.co/")||b.includes("linkfix")||a.message.includes("Access is denied for this document")&&b.includes("<anonymous>")||a.message.includes("cannot be created in a document with origin 'https://www.youtube.com' and URL 'about:blank'")&&b.includes("<anonymous>"))return!0;if(b.includes("https://www.youtube.com"))return!1;a=b.split("\n"); equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: b:{d=/api\/stats\/ads/;var p,q,u,x;e=null==(m=VF().objectRepresentation.adPlacements)?void 0:null==(p=m[0])?void 0:null==(q=p.adPlacementRenderer)?void 0:null==(u=q.renderer)?void 0:null==(x=u.linearAdSequenceRenderer)?void 0:x.linearAds;if(null!=e&&e.length&&(m=F(e[0],D_a))&&(m=m.pings,null!=m&&m.impressionPings))for(p=[].concat(fa(m.impressionPings)),m.progressPings&&(p=[].concat(fa(p),fa(m.progressPings))),m=g(p),p=m.next();!p.done;p=m.next())if(p=p.value,p.baseUrl&&d.test(p.baseUrl)){m=p.baseUrl.replace("https://www.youtube.com", equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: c+"&m_pos_ms="+fc}},adSlotLoggingData:{serializedSlotAdServingDataEntry:$a}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:fc,offsetEndMilliseconds:fc},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"10000",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei="+Y+"&m_pos="+Ib+"&token=ALHj"+ma+"&index="+la+"&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: c+"&m_pos_ms="+fc}},adSlotLoggingData:{serializedSlotAdServingDataEntry:Mc}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:fc,offsetEndMilliseconds:fc},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"10000",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei="+Y+"&m_pos="+Ib+"&token=ALHj"+ma+"&index="+la+"&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: c+"&m_pos_ms="+fc}},adSlotLoggingData:{serializedSlotAdServingDataEntry:Yc}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_END",adTimeOffset:{offsetStartMilliseconds:eb,offsetEndMilliseconds:eb},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"10000",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei="+Y+"&m_pos="+eb+"&token=ALHj"+ma+"&index="+la+"&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: c+"&m_pos_ms="+fc}},adSlotLoggingData:{serializedSlotAdServingDataEntry:Yc}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:fc,offsetEndMilliseconds:eb},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"10000",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei="+Y+"&m_pos="+Ib+"&token=ALHj"+ma+"&index="+la+"&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: className:"animated-like-icon"}}},totalFrames:119,lazyLoad:!0};break a;case"NOTIFICATION_BELL":L={lottiePlayerProps:{animationConfig:{name:T?"notification_bell_dark":"notification_bell_light",path:"https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_bell_icon_"+(T?"dark":"light")+".json",loop:!1,autoplay:!1,rendererSettings:{className:"animated-subscribe-icon"}}},totalFrames:79,lazyLoad:!1};break a;}L=void 0}return L},m=function(){var L,T; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: completePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=videoplaytime100&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+eb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],activeViewTracking:{trafficType:"ACTIVE_VIEW_TRAFFIC_TYPE_VIDEO"}},clickthroughEndpoint:{clickTrackingParams:Hc, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: endFullscreenPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=vast_exit_fullscreen&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}],activeViewMeasurablePings:[{baseUrl:"https://www.youtube.com/pcs/activeview?xai="+q+"&sig="+gc+"&ad_cpn=[AD_CPN]&id="+Lc+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]&avm="+la},{baseUrl:"https://pagead2.googlesyndication.com/activeview_ext?id="+Lc+"&avm="+la+"&dc_pubid="+la+"&dc_exteid="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: f.created=function(){this.embedHost_=Azd[hl("INNERTUBE_CLIENT_NAME")]||"www.youtube.com"}; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: f.maybeInitializeQuizLotties=function(a){var b=this;this.isDarkTheme&&(this.baseCorrectLottiePlayerAnimationConfig.path="https://www.gstatic.com/youtube/img/creator/posts/Lottie_QuizCorrect_DarkTheme_01a.json",this.baseIncorrectLottiePlayerAnimationConfig.path="https://www.gstatic.com/youtube/img/creator/posts/Lottie_QuizIncorrect_DarkTheme_01a.json");this.correctnessAnimationProps=a.map(function(c){return{animationConfig:c.isCorrect?b.baseCorrectLottiePlayerAnimationConfig:b.baseIncorrectLottiePlayerAnimationConfig, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: function $Xb(a){if(a.urlEndpoint){if(a=ol(a.urlEndpoint.url),a.adurl)return dd(a.adurl)}else if(a.watchEndpoint)return"//www.youtube.com/watch?v="+a.watchEndpoint.videoId;return null} equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: function jrb(){var a,b,c,d,e,h,l,m,p,q,u;return r(function(x){switch(x.nextAddress){case 1:ka(x,2),a=g(yrb()),b=a.next();case 4:if(b.done)return x.return(1);d=c=b.value;e=d.jsonRepresentation;h=d.objectRepresentation;l=btoa(e);m="data:application/json;base64,"+l;p=new Request(m);Object.defineProperty(p,"url",{get:function(){return"https://www.youtube.com/youtubei/v1/player?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8&prettyPrint=false"}}); equals www.youtube.com (Youtube)
Source: chromecache_423.13.dr String found in binary or memory: g.Va("Goog_AdSense_Lidar_getUrlSignalsList",Nib);var YAa=oa(["//tpc.googlesyndication.com/sodar/",""]);var KMa={k5a:0,h5a:1,e5a:2,f5a:3,g5a:4,j5a:5,i5a:6};var lpa=(new Date).getTime();var Vka="://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav".split(" "),Wka=/\bocr\b/;var Yka=/(?:\[|%5B)([a-zA-Z0-9_]+)(?:\]|%5D)/g;g.x(Ku,g.Ld);Ku.prototype.dispose=function(){window.removeEventListener("offline",this.C);window.removeEventListener("online",this.C);this.Sn.Uj(this.G);delete Ku.instance}; equals www.youtube.com (Youtube)
Source: chromecache_423.13.dr String found in binary or memory: g.aS=function(a){a=ZR(a.Fa);return"www.youtube-nocookie.com"===a?"www.youtube.com":a}; equals www.youtube.com (Youtube)
Source: chromecache_423.13.dr String found in binary or memory: g.k.getVideoUrl=function(a,b,c,d,e,f){b={list:b};c&&(e?b.time_continue=c:b.t=c);c=g.aS(this);e="www.youtube.com"===c;!f&&d&&e?f="https://youtu.be/"+a:g.UR(this)?(f="https://"+c+"/fire",b.v=a):(f&&e?(f=this.protocol+"://"+c+"/shorts/"+a,d&&(b.feature="share")):(f=this.protocol+"://"+c+"/watch",b.v=a),wD&&(a=apa())&&(b.ebc=a));return g.dn(f,b)}; equals www.youtube.com (Youtube)
Source: chromecache_423.13.dr String found in binary or memory: g.lS=function(a){var b=g.aS(a);VRa.includes(b)&&(b="www.youtube.com");return a.protocol+"://"+b}; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: hoverText:{runs:[{text:nd}]},trackingParams:gb+"="}},adVideoId:Kc,impressionPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=video_companion_impression_tracking"}],adLayoutLoggingData:{serializedAdServingDataEntry:Rd},associatedCompositePlayerBytesLayoutId:Yc}},adSlotLoggingData:{serializedSlotAdServingDataEntry:Mc}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_SELF_START"}},renderer:{actionCompanionAdRenderer:{headline:{text:Yc, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: if(b){var c=Flb.get(b);c||(c=[],Flb.set(b,c));var d=hl("ELEMENT_POOL_CONFIG")||{};c.length>=(void 0!==d[b]?d[b]:hl("ELEMENT_POOL_DEFAULT_CAP",0))||c.push(a)}else eq(new mm("Element pool should only handle custom elements:",a.nodeName))},Flb=new Map,Hlb=0,Glb=0;var IE=new Map([["FACE_HAPPY",{name:"animated_face_happy_light",nameDarkTheme:"animated_face_happy_dark",path:"https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/light_mode/face_happy.json",pathDarkTheme:"https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/dark_mode/face_happy.json",lottiePlayerProps:{animationConfig:{loop:!1,autoplay:!1}},type:"FACE_HAPPY",totalFrames:121,lazyLoad:!1}],["FACE_MEH",{name:"animated_face_meh_light",nameDarkTheme:"animated_face_meh_dark", equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: isTemplated:!0,trackingParams:gb+"="}},trackingParams:gb+"="}},adInfoRenderer:{adHoverTextButtonRenderer:{button:{buttonRenderer:{style:"STYLE_UNKNOWN",size:"SIZE_DEFAULT",isDisabled:!1,serviceEndpoint:{clickTrackingParams:Hc,openPopupAction:{popup:{aboutThisAdRenderer:{url:(Pf.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue="https://www.youtube.com/aboutthisad?pf=web&source=youtube&reasons=A"+T+"&hl="+Ia+"&origin=www.youtube.com&ata_theme="+Be,Pf),trackingParams:gb+"="}},popupType:"DIALOG"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: k(E2b,M);E2b.prototype.maybeLoadAnimationBackground=function(){this.useAnimationBackground?this.lottieAnimation||(this.lottieAnimation=lottie.loadAnimation({container:this.animationBackground,loop:!0,renderer:"svg",path:"https://www.gstatic.com/youtube/img/livestream/live_chat/lottie_animation/shimmer_background.json",autoplay:!0})):this.lottieAnimation&&this.lottieAnimation.destroy()}; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: k(HEd,M);f=HEd.prototype;f.created=function(){var a=Qp();B("kevlar_clear_duplicate_pref_cookie")&&qm(Ai,function(){var b=di.get("PREF");b&&!/f\d=/.test(b)&&(b=wl("kevlar_duplicate_pref_cookie_domain_override"),document.cookie=b?"PREF=null;domain="+b+";expires=Thu, 01 Jan 1970 00:00:01 GMT":"PREF=null;domain=.www.youtube.com;expires=Thu, 01 Jan 1970 00:00:01 GMT")}); equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: kb+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]?"}],abandonPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=video_abandon&ad_mt=[AD_MT]&ad_tos=[AD_TOS]&ad_wat=[AD_WAT]&final=[FINAL]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+eb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],activeViewFullyViewableAudibleHalfDurationPings:[{baseUrl:"https://www.youtube.com/pcs/activeview?xai="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: lAb.prototype.openToast=function(){var a;null!=(a=this.currentToast)&&a.opened||(this.queue.length?(this.currentToast=this.queue.shift(),this.currentToast.open()):this.currentPersistentToast&&this.currentPersistentToast.open())};var oAb=new Op("TOAST_MANAGER_TOKEN");var pAb=["https://fonts.gstatic.com","https://tv.youtube.com","https://www.gstatic.com","https://www.youtube.com"],qAb=vl("wil_icon_max_concurrent_fetches",Infinity),rAb=["clip-path","fill","mask"],MK=function(a,b){var c=this;this.iconSet=a;this.appDirection=b;this.responsePromises={};this.iconCache={};this.queuedResponseResolvers={};this.numFetches=this.counter=0;this.cacheStorageAvailable=!!Ba.caches;this.cacheStorageAsync=Promise.resolve(void 0);this.cacheStorageSync=void 0;this.requestAninmationFrameResolver= equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+eb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],thirdQuartilePings:[{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+fc+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],completePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=videoplaytime100&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+eb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],unmutePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=adunmute&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+fc+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}], equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: la+";etm1="+la+";eid1="+eb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],unmutePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=adunmute&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+fc+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],pausePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: la+"="+la+";etm1="+la+";eid1="+eb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],pingingEndpoint:{hack:!0}}]},adRendererCommands:{impressionCommand:{clickTrackingParams:Hc,commandExecutorCommand:{commands:[{clickTrackingParams:Hc,loggingUrls:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=video_card_endcap_impression"}],pingingEndpoint:{hack:!0}}]}}},skipButton:{skipButtonRenderer:{message:{text:Lc,isTemplated:!1,trackingParams:gb+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: lazyLoad:!1}],["FACE_VERY_HAPPY",{name:"animated_face_very_happy_light",nameDarkTheme:"animated_face_very_happy_dark",path:"https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/light_mode/face_very_happy.json",pathDarkTheme:"https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/dark_mode/face_very_happy.json",lottiePlayerProps:{animationConfig:{loop:!1,autoplay:!1}},type:"FACE_VERY_HAPPY",totalFrames:121,lazyLoad:!1}],["LIKE",{name:"animated_like_light",nameDarkTheme:"animated_like_dark", equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: lc+";dc_dbm_token="+x+";dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;ltd=;dc_tdv="+la+";ord="+lc+";dc_rui="+la+";dc_exteid="+kb+";dc_av="+la+";dc_sk="+la+";dc_ctype="+eb+";dc_pubid="+la+";dc_btype=3?gclid="+Oa+"&ase=2"},{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=video_card_endcap_action_headline_click"}],commandMetadata:{webCommandMetadata:{url:"https://www.googleadservices.com/pagead/aclk?sa=L&ai=C"+C+"____________"+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: lc+";dc_trk_cid="+lc+";dc_dbm_token="+x+";dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;ltd=;dc_tdv="+la+";ord="+lc+";dc_rui="+la+";dc_exteid="+nc+";dc_av="+la+";dc_sk="+la+";dc_ctype="+eb+";dc_pubid="+la+";dc_btype=3?gclid="+Oa+"&ase=2",attributionSrcMode:"ATTRIBUTION_SRC_MODE_LABEL_CHROME"}],fullscreenPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=adfullscreen&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: lottiePlayerProps:{animationConfig:{loop:!1,autoplay:!1}},type:"FACE_SAD",totalFrames:121,lazyLoad:!1}],["FACE_UNHAPPY",{name:"animated_face_unhappy_light",nameDarkTheme:"animated_face_unhappy_dark",path:"https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/light_mode/face_unhappy.json",pathDarkTheme:"https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/dark_mode/face_unhappy.json",lottiePlayerProps:{animationConfig:{loop:!1,autoplay:!1}},type:"FACE_UNHAPPY",totalFrames:121, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: lottiePlayerProps:{animationRef:l,animationConfig:{name:e.uniqueId+"-background",autoplay:!1,loop:!1,path:"https://www.gstatic.com/youtube/img/lottie/smartimations/smartimation_container_"+(r5b()?"dark":"light")+".json"}}}))}),I("div",{class:"smartimation__content"},a))} equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: loudnessDb:-3.7800007}]},playerAds:[{playerLegacyDesktopWatchAdsRenderer:{playerAdParams:{showContentThumbnail:!0,enabledEngageTypes:"3,6,4,5,17,1"},gutParams:{tag:"\\4061\\ytpwmpu"},showCompanion:!0,showInstream:!0,useGut:!0}}],playbackTracking:{videostatsPlaybackUrl:{baseUrl:"https://s.youtube.com/api/stats/playback?cl="+lc+"&docid="+y+"&ei="+Y+"&feature="+m+"&fexp="+Ze+"&ns="+Ia+"&plid="+L+"&referrer=https%3A%2F%2Fwww.youtube.com%2F&sdetail=p%3A%2F&sourceid="+Jc+"&el="+nd+"&len="+Vb+"&of="+Hb+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: m+"&len="+Vb+"&ns="+Ia+"&plid="+L+"&ver="+la,elapsedMediaTimeSeconds:5},videostatsScheduledFlushWalltimeSeconds:[10,20,30],videostatsDefaultFlushIntervalSeconds:40},captions:{playerCaptionsTracklistRenderer:{captionTracks:[{baseUrl:"https://www.youtube.com/api/timedtext?v="+y+"&caps="+dc+"&opi="+lc+"&xoaf="+la+"&hl="+Ia+"&ip="+rb+"&ipbits="+la+"&expire="+Cb+"&sparams=ip,ipbits,expire,v,caps,opi,xoaf&signature="+rb+"&key="+dc+"&lang="+Ea,name:{simpleText:Mc},vssId:".en-US",languageCode:"en-US",isTranslatable:!0, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: na+"&label=adrewind&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}],resumePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=adresume&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+eb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],skipPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: offsetMilliseconds:15E3}],fullscreenPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=adfullscreen&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+eb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],activeViewViewablePings:[{baseUrl:"https://www.youtube.com/pcs/activeview?xai="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: p.ptrackingUrl)?void 0:H.baseUrl);var L;q.push(null==p?void 0:null==(L=p.qoeUrl)?void 0:L.baseUrl);var T;q.push(null==p?void 0:null==(T=p.atrUrl)?void 0:T.baseUrl);y=g(q);for(C=y.next();!C.done;C=y.next())if((C=C.value)&&m.test(C)){y=C.replace("https://www.youtube.com","").replace("https://s.youtube.com","");break b}}y=void 0}y&&c.push({testUrl:""+Ba.location.origin+y,baseUrl:Ba.location.origin+"/feed/download",method:"GET"})}c=0!==c.length?c[Math.floor(Math.random()*c.length)]:void 0;return(a=c)? equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: pQ.prototype.publish=function(a,b){return this.isDisposed()?!1:this.pubSub_.publish.apply(this.pubSub_,arguments)};var VXb=da(["https://www.youtube.com/iframe_api"]),qQ=function(){this.playerResolver_=cj();this.playerPromise_=this.playerResolver_.promise;this.playerVars_=null;this.playbackEndedCallback_=Kg;this.playbackDurationSeconds_=0},WXb=function(a){var b=function(){return window.YT&&"function"===typeof window.YT.ready}; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: path:"https://www.gstatic.com/youtube/img/lottie/animated_like_icon/animated_like_icon_v2_light.json",pathDarkTheme:"https://www.gstatic.com/youtube/img/lottie/animated_like_icon/animated_like_icon_v2_dark.json",lottiePlayerProps:{animationConfig:{loop:!1,autoplay:!1}},type:"LIKE",totalFrames:119,lazyLoad:B("web_animated_like_lazy_load")}],["NOTIFICATION_BELL",{name:"notification_bell_light",nameDarkTheme:"notification_bell_dark",path:"https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_bell_icon_light.json", equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: path:"https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/light_mode/face_meh.json",pathDarkTheme:"https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/dark_mode/face_meh.json",lottiePlayerProps:{animationConfig:{loop:!1,autoplay:!1}},type:"FACE_MEH",totalFrames:121,lazyLoad:!1}],["FACE_SAD",{name:"animated_face_sad_light",nameDarkTheme:"animated_face_sad_dark",path:"https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/light_mode/face_sad.json",pathDarkTheme:"https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/dark_mode/face_sad.json", equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: pathDarkTheme:"https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_bell_icon_dark.json",lottiePlayerProps:{animationConfig:{loop:!1,autoplay:!1}},type:"NOTIFICATION_BELL",totalFrames:79,lazyLoad:!1}]]);var Jlb=da(["https://www.gstatic.com/external_hosted/lottie/lottie_light.js"]),Klb=Rg(Jlb),JE;function Llb(){return JE?JE:window.lottie?JE=Promise.resolve(window.lottie):JE=new Promise(function(a,b){var c=document.createElement("script");c.addEventListener("load",function(){a(lottie)}); equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: pausePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=adpause&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+eb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],rewindPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: pingingEndpoint:{hack:!0}}]}}},skipButton:{skipButtonRenderer:{message:{text:Lc,isTemplated:!1,trackingParams:gb+"="},trackingParams:gb+"="}},adLayoutLoggingData:{serializedAdServingDataEntry:ud},skipPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=videoskipped&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: pings:{impressionPings:[{baseUrl:"https://ad.doubleclick.net/ddm/trackimp/N444803.2428500DBMSITEID/B30029229.368252041;dc_trk_aid="+lc+";dc_trk_cid="+lc+";dc_dbm_token="+x+";ord="+Cb+";dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;ltd=;dc_tdv="+la+";dc_rui="+la+";dc_exteid="+kb+";dc_av="+Ib+";dc_sk="+la+";dc_ctype="+eb+";dc_ref=http://www.youtube.com/video/"+Kc+";dc_pubid="+la+";dc_btype=23?gclid="+Oa+"&ase=2",attributionSrcMode:"ATTRIBUTION_SRC_MODE_LABEL_CHROME"},{baseUrl:"https://www.youtube.com/pagead/adview?ai=C"+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: progressPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=video_skip_shown&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]",offsetMilliseconds:5E3},{baseUrl:"https://www.googleadservices.com/pagead/aclk?sa=L&ai=C"+C+"____________"+E+"AxAA&ase=2&num="+la+"&cid="+na+"&ad_cpn=%5BAD_CPN%5D&sig="+ca+"&adurl="+ad+"&ctype="+Ib+"&ms=[CLICK_MS]&label=video_10s_engaged_view&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=",offsetMilliseconds:1E4, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: q+"&sig="+gc+"&ad_cpn=[AD_CPN]&id="+Lc+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://pagead2.googlesyndication.com/activeview_ext?id="+Lc+"&dc_pubid="+la+"&dc_exteid="+kb+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]?"}],endFullscreenPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=vast_exit_fullscreen&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}],activeViewMeasurablePings:[{baseUrl:"https://www.youtube.com/pcs/activeview?xai="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: q+"&sig="+gc+"&ad_cpn=[AD_CPN]&id="+Lc+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]&avm="+la},{baseUrl:"https://pagead2.googlesyndication.com/activeview_ext?id="+Lc+"&avm="+la+"&dc_pubid="+la+"&dc_exteid="+kb+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]?"}],abandonPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=video_abandon&ad_mt=[AD_MT]&ad_tos=[AD_TOS]&ad_wat=[AD_WAT]&final=[FINAL]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}, equals www.youtube.com (Youtube)
Source: chromecache_423.13.dr String found in binary or memory: r;this.uj=b?b.hl||"en_US":fC("en_US",a.hl);this.region=b?b.contentRegion||"US":fC("US",a.cr);this.hostLanguage=b?b.hostLanguage||"en":fC("en",a.host_language);this.So=!this.Zc&&Math.random()<g.cJ(this.experiments,"web_player_api_logging_fraction");this.gb=!this.Zc;this.enabledEngageTypes=new Set;this.deviceIsAudioOnly=!(null==b||!b.deviceIsAudioOnly);this.Ld=eC(this.Ld,a.ismb);this.pp?(r=a.vss_host||"s.youtube.com","s.youtube.com"===r&&(r=ZR(this.Fa)||"www.youtube.com")):r="video.google.com";this.cn= equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"10000",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei="+Y+"&m_pos="+eb+"&token=ALHj"+ma+"&index="+la+"&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver="+c+"&m_pos_ms="+Rb}},adSlotLoggingData:{serializedSlotAdServingDataEntry:nd}}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: resumePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=adresume&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+eb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],skipPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: return I("yt-smartimation",{class:t5b(p,u,e)},ls(e.experimentEnabled,function(){return I("div",{class:"smartimation__border"},I(rmb,{className:"smartimation__border-gradient",lottiePlayerProps:{animationRef:h,animationConfig:{name:e.uniqueId+"-border",autoplay:!1,loop:!1,path:"https://www.gstatic.com/youtube/img/lottie/smartimations/smartimation_border_"+(r5b()?"dark":"light")+".json"}}}))}),ls(e.experimentEnabled&&B("smartimation_background")&&u,function(){return I("div",{class:"smartimation__background"}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: rootVe:83769}},urlEndpoint:{url:"https://www.googleadservices.com/pagead/aclk?sa=L&ai=C"+C+"____________"+E+"AxAA&ase=2&num="+la+"&cid="+na+"&ad_cpn=%5BAD_CPN%5D&sig="+ca+"&adurl="+ad+"&label=video_click_to_advertiser_site&ctype="+Ib+"&ms=[CLICK_MS]",target:"TARGET_NEW_WINDOW",attributionSrcMode:"ATTRIBUTION_SRC_MODE_LABEL_CHROME"}},trackingParams:gb+"="}},durationMilliseconds:7E3,countdownRenderer:{timedPieCountdownRenderer:{trackingParams:gb+"="}},navigationEndpoint:{clickTrackingParams:Hc,loggingUrls:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+ equals www.youtube.com (Youtube)
Source: chromecache_423.13.dr String found in binary or memory: this.W.Ca&&(a.authuser=this.W.Ca);this.W.pageId&&(a.pageid=this.W.pageId);isNaN(this.cryptoPeriodIndex)||(a.cpi=this.cryptoPeriodIndex.toString());var e=(e=/_(TV|STB|GAME|OTT|ATV|BDP)_/.exec(g.pc()))?e[1]:"";"ATV"===e&&(a.cdt=e);this.G=a;this.G.session_id=d;this.oa=!0;"widevine"===this.B.flavor&&(this.G.hdr="1");"playready"===this.B.flavor&&(b=Number(uR(b.experiments,"playready_first_play_expiration")),!isNaN(b)&&0<=b&&(this.G.mfpe=""+b),this.oa=!1);b="";g.nR(this.B)?mR(this.B)?(d=c.B)&&(b="https://www.youtube.com/api/drm/fps?ek="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: trackName:""},{baseUrl:"https://www.youtube.com/api/timedtext?v="+y+"&caps="+dc+"&opi="+lc+"&xoaf="+la+"&hl="+Ia+"&ip="+rb+"&ipbits="+la+"&expire="+Cb+"&sparams=ip,ipbits,expire,v,caps,opi,xoaf&signature="+rb+"&key="+dc+"&kind="+dc+"&lang="+Ia,name:{simpleText:Rd},vssId:"a.it",languageCode:"it",kind:"asr",isTranslatable:!0,trackName:""}],audioTracks:[{captionTrackIndices:[0,1],defaultCaptionTrackIndex:0,visibility:"UNKNOWN",hasDefaultTrack:!0,captionsInitialState:"CAPTIONS_INITIAL_STATE_OFF_RECOMMENDED"}], equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: trackingParams:gb+"=",adInfoRenderer:{adHoverTextButtonRenderer:{button:{buttonRenderer:{style:"STYLE_UNKNOWN",size:"SIZE_DEFAULT",isDisabled:!1,icon:{iconType:"INFO_OUTLINE"},navigationEndpoint:{clickTrackingParams:Hc,openPopupAction:{popup:{aboutThisAdRenderer:{url:(Rh.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue="https://www.youtube.com/aboutthisad?pf=web&source=youtube&reasons=A"+T+"&hl="+Ia+"&origin=www.youtube.com&ata_theme="+Be,Rh),trackingParams:gb+"="}},popupType:"DIALOG"}},trackingParams:gb+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: trackingParams:gb+"=",backgroundImage:{thumbnail:{thumbnails:[{url:""}]},trackingParams:gb+"="},abandonCommands:{commands:[{clickTrackingParams:Hc,loggingUrls:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+y+"&cid="+na+"&label=video_abandon&ad_mt=[AD_MT]&ad_tos=[AD_TOS]&ad_wat=[AD_WAT]&final=[FINAL]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+ equals www.youtube.com (Youtube)
Source: chromecache_423.13.dr String found in binary or memory: var J3={};var Qeb=/[&\?]action_proxy=1/,Peb=/[&\?]token=([\w-]*)/,Reb=/[&\?]video_id=([\w-]*)/,Seb=/[&\?]index=([\d-]*)/,Teb=/[&\?]m_pos_ms=([\d-]*)/,Veb=/[&\?]vvt=([\w-]*)/,Heb="ca_type dt el flash u_tz u_his u_h u_w u_ah u_aw u_cd u_nplug u_nmime frm u_java bc bih biw brdim vis wgl".split(" "),Ueb="www.youtube-nocookie.com youtube-nocookie.com www.youtube-nocookie.com:443 youtube.googleapis.com www.youtubeedu.com www.youtubeeducation.com video.google.com redirector.gvt1.com".split(" "),Keb={android:"ANDROID", equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: var Jwb={url:"https://www.gstatic.com/youtube/img/useredu/smart_downloads_optin_banner.gif"}; equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: weight:500},{callback:function(a){if(!a.stack)return!1;var b=a.stack.trim().split("\n");b.length&&b[0].endsWith("Error: "+a.message)&&b.shift();b.length&&b[b.length-1].includes("at window.onerror (")&&b.pop();if(!b.length)return!0;if("Script error."===a.message)return b[0].includes("www.youtube.com")||2<=b.length&&b[0].startsWith("at new")&&b[1].startsWith("at window.onerror");if("Unexpected token"===a.message)return!0;a=g(b);for(b=a.next();!b.done;b=a.next())if(b=b.value,!(b.includes("<anonymous>")|| equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: weight:500},{messageRegExp:/.*Wanteeed.*/,weight:0},{messageRegExp:/.*WtdRoot*/,weight:0},{messageRegExp:/.*Constructing wtd-root:*/,weight:0},{messageRegExp:/.*WtdDiv.*/,weight:0},{messageRegExp:/.*Failed to execute 'appendChild'.*/,weight:0},{messageRegExp:/.*TypeError: a is not a constructor'.*/,weight:0},{messageRegExp:/.*Readwise.*/,weight:0},{messageRegExp:/.*Form is either loading or already opened*/,weight:0},{messageRegExp:/.*wtd-div.*/,weight:0},{messageRegExp:/.*Blocked a frame with origin "https:\/\/www.youtube.com" from accessing a cross-origin frame.*/, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: y+"/maxresdefault.jpg",width:1280,height:720}]},embed:{iframeUrl:"https://www.youtube.com/embed/"+Kc,width:1280,height:720},title:{simpleText:Nd},description:{simpleText:Re},lengthSeconds:"1156",ownerProfileUrl:"http://www.youtube.com/@"+Mc,externalChannelId:Lb,isFamilySafe:!0,availableCountries:"AD AE AF AG AI AL AM AO AQ AR AS AT AU AW AX AZ BA BB BD BE BF BG BH BI BJ BL BM BN BO BQ BR BS BT BV BW BY BZ CA CC CD CF CG CH CI CK CL CM CN CO CR CU CV CW CX CY CZ DE DJ DK DM DO DZ EC EE EG EH ER ES ET FI FJ FK FM FO FR GA GB GD GE GF GG GH GI GL GM GN GP GQ GR GS GT GU GW GY HK HM HN HR HT HU ID IE IL IM IN IO IQ IR IS IT JE JM JO JP KE KG KH KI KM KN KP KR KW KY KZ LA LB LC LI LK LR LS LT LU LV LY MA MC MD ME MF MG MH MK ML MM MN MO MP MQ MR MS MT MU MV MW MX MY MZ NA NC NE NF NG NI NL NO NP NR NU NZ OM PA PE PF PG PH PK PL PM PN PR PS PT PW PY QA RE RO RS RU RW SA SB SC SD SE SG SH SI SJ SK SL SM SN SO SR SS ST SV SX SY SZ TC TD TF TG TH TJ TK TL TM TN TO TR TT TV TW TZ UA UG UM US UY UZ VA VC VE VG VI VN VU WF WS YE YT ZA ZM ZW".split(" "), equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: y,target:"TARGET_NEW_WINDOW"}},trackingParams:gb+"="}},trackingParams:gb+"="}}}},endscreen:{endscreenRenderer:{elements:[{endscreenElementRenderer:{style:"CHANNEL",image:{thumbnails:[{url:"https://yt3.ggpht.com/"+Wa+"=s250-c-k-c0x00ffffff-no-rj",width:250,height:250},{url:"https://yt3.ggpht.com/"+Wa+"=s400-c-k-c0x00ffffff-no-rj",width:400,height:400}]},icon:{thumbnails:[{url:"https://www.gstatic.com/youtube/img/annotations/youtube.png"}]},left:.030214407,width:.15438597,top:.37587035,aspectRatio:1, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: zd+"&ad_len="+Rb+"&ad_mt=[AD_MT]&ad_sys=YT%3AAdSense-Viral%2CAdSense-Viral&ad_v="+Kc+"&aqi="+Y+"&ad_rmp="+la+"&sli="+la}],errorPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=videoplayfailed[ERRORCODE]"}],mutePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=admute&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: {adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:fc,offsetEndMilliseconds:fc},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"10000",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei="+Y+"&m_pos="+Ib+"&token=ALHj"+ma+"&index="+la+"&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: {adPlacementRenderer:{config:{adPlacementConfig:{kind:"zf",adTimeOffset:{offsetStartMilliseconds:"63",offsetEndMilliseconds:"83"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"59",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: {baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+eb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],activeViewFullyViewableAudibleHalfDurationPings:[{baseUrl:"https://www.youtube.com/pcs/activeview?xai="+q+"&sig="+gc+"&ad_cpn=[AD_CPN]&id="+Lc+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]&avgm="+la},{baseUrl:"https://pagead2.googlesyndication.com/activeview_ext?id="+Lc+"&dc_pubid="+la+"&dc_exteid="+kb+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]?"}], equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: {baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+eb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],activeViewViewablePings:[{baseUrl:"https://www.youtube.com/pcs/activeview?xai="+q+"&sig="+gc+"&ad_cpn=[AD_CPN]&id="+Lc+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://pagead2.googlesyndication.com/activeview_ext?id="+Lc+"&dc_pubid="+la+"&dc_exteid="+kb+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]?"}], equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: {baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+la+";dc_exteid="+kb+";met="+la+";ecn"+la+"="+la+";etm1="+la+";eid1="+eb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],pingingEndpoint:{hack:!0}}]},adRendererCommands:{impressionCommand:{clickTrackingParams:Hc,commandExecutorCommand:{commands:[{clickTrackingParams:Hc,loggingUrls:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&label=video_card_endcap_impression"}], equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: {baseUrl:"https://www.youtube.com/pagead/adview?ai=C"+C+"____________"+E+"AxAA&sigh="+Kc+"&cid="+na+"&ad_cpn=[AD_CPN]&lact=[LACT]"},{baseUrl:"https://www.youtube.com/api/stats/ads?ver="+la+"&ns="+la+"&event="+la+"&device="+la+"&content_v="+y+"&el="+nd+"&ei="+Y+"&devicever="+c+"&bti="+hb+"&format="+fc+"&break_type="+la+"&conn=[CONN]&cpn=[CPN]&lact=[LACT]&m_pos="+la+"&mt=[MT]&p_h=[P_H]&p_w=[P_W]&rwt=[RWT]&sdkv="+rb+"&slot_pos="+la+"&slot_len="+la+"&vis=[VIS]&vol=[VOL]&wt=[WT]&ad_cpn=[AD_CPN]&ad_id="+ equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: {instreamVideoAdRenderer:{skipOffsetMilliseconds:5E3,pings:{impressionPings:[{baseUrl:"https://ad.doubleclick.net/ddm/trackimp/N1957659.127733GOOGLE-YOUTUBE/B29940965.366940103;dc_trk_aid="+lc+";dc_trk_cid="+lc+";ord="+Cb+";dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;ltd=;dc_tdv="+la+";dc_rui="+la+";dc_exteid="+kb+";dc_av="+Ib+";dc_sk="+la+";dc_ctype="+eb+";dc_ref=http://www.youtube.com/video/"+Kc+";dc_pubid="+la+";dc_btype=23?gclid="+Oa+"&ase=2",attributionSrcMode:"ATTRIBUTION_SRC_MODE_LABEL_CHROME"}, equals www.youtube.com (Youtube)
Source: chromecache_239.13.dr String found in binary or memory: {query:a.browseEndpoint.query})),e&&a.browseEndpoint.params&&(e=iA(e,{params:a.browseEndpoint.params}));else{if(a.urlEndpoint)return a.urlEndpoint.url;a.signInEndpoint?(e="https://accounts.google.com/ServiceLogin",d={},sc.extend(d,b||{},{"continue":window.location.href.split("#")[0],action_handle_signin:!0,passive:!0}),b=d):a.uploadEndpoint?e="//www.youtube.com/upload":a.liveChatEndpoint?(e=a.liveChatEndpoint,d=sc.clone(e),La(e.continuation)&&(h=Object.keys(e.continuation)[0],d.continuation=e.continuation[h].continuation), equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: google.co.ck
Source: unknown HTTP traffic detected: POST /videoplayback?expire=1711695048&ei=aBAGZtm5Kaucy_sPwdSC6AY&ip=102.165.48.43&id=o-AIf_e0Sd-rg8QncPYBBTfcMcEZFjvlw1oLSvnlTmCSd2&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&mh=s6&mm=31%2C29&mn=sn-p5qs7nzy%2Csn-p5qlsnrr&ms=au%2Crdu&mv=m&mvi=4&pl=25&initcwndbps=770000&spc=UWF9f4ttxaLCRuHFN7djI1Z4mYwYIl8HYy2Obq2dRr81skg&svpuc=1&ns=-FkLrOMuFBDXTr4oiFJ8HUoQ&sabr=1&mt=1711673094&fvip=1&keepalive=yes&fexp=51141542&c=WEB&smc=1&n=eM8Xskx1ibC5AQ&sparams=expire%2Cei%2Cip%2Cid%2Csource%2Crequiressl%2Cxpc%2Cspc%2Csvpuc%2Cns%2Csabr&sig=AJfQdSswRgIhALhZ2-D8FMdjBPuHuTa2Ajks6aNHLkJeyiJvEfECkgv9AiEA5wqJknaeF9lBiiPVYbXhJYDg7JbIY2-oAmKBQ3xI08E%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=ALClDIEwRAIgEaOjNGpZb3buqaycxgJ6KbMJv9detd4K2q8lHx8xqLwCICtv8PHelCCVP7MIvKZpdFK1ZcjIEb3adNDR3E_UVRV1&cpn=f-fLtixrB5CGYAkV&cver=2.20240327.00.00&rn=1 HTTP/1.1Host: rr4---sn-p5qs7nzy.googlevideo.comConnection: keep-aliveContent-Length: 1520sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.youtube.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://downloadmoreram.com
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://e621.net
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=1080p
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=Go
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=bad
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=betaarchive
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=bing
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=blender&tbm=isch
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=bonzi
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=can
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=cats&tbm=isch
Source: WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2410595587.0000000000A03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.co.ck/search?q=cats&tbm=isch00
Source: WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2410595587.0000000000A03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.co.ck/search?q=cats&tbm=isch006=
Source: WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2486119062.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2429775290.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2503722266.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2418457852.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2453371500.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2499458387.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2410595587.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2467277198.0000000000A03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.co.ck/search?q=cats&tbm=ischch
Source: WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2410595587.0000000000A03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.co.ck/search?q=cats&tbm=ischh
Source: WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2547482253.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2562029669.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2486119062.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2523817715.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2503722266.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2467277198.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2453371500.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2418457852.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2513704363.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2499458387.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2429775290.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2410595587.00000000009DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.co.ck/search?q=cats&tbm=ischj
Source: WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2486119062.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2708762310.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2578417493.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2429775290.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2503722266.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2418457852.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2453371500.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2499458387.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2523817715.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2690912452.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2754683090.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2410595587.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2513704363.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2562029669.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2467277198.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2547482253.0000000000A03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.co.ck/search?q=cats&tbm=ischl:E
Source: WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2453371500.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2418457852.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2429775290.00000000009DA000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2410595587.00000000009DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.co.ck/search?q=cats&tbm=ischz
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=chromebook
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=chromeos
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=comcast&tbm=isch
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=communism
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=covfefe
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=define
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=does
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=doggo&tbm=isch
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=donald
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=download
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=facebook
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=follow
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=free
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=get
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=goggle.com
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=google
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=grand
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=gwx.exe
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=half
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=help
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=hey
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=how
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=i
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=install
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=internet
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=is
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=kkk
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=mcafee
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=memz
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=microsoft
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=minecraft
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=miranda
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=my
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=north
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=norton
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=ok
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=shrek
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=smash
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=somebody
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=staper
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=staper&tbm=isch
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=sudo
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=the
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=this
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=twiter
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=upgrade
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=utube
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=vinesauce&tbm=isch
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=virus
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=what
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=who
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=window&tbm=isch
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=windows
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=winrar
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=woman
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.co.ck/search?q=you
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://google.com
Source: chromecache_239.13.dr String found in binary or memory: http://hammerjs.github.io/
Source: chromecache_239.13.dr String found in binary or memory: http://i1.ytimg.com/vi/
Source: chromecache_239.13.dr String found in binary or memory: http://mathiasbynens.be/
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape
Source: chromecache_239.13.dr String found in binary or memory: http://mths.be/fromcodepoint
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://nyan.cat
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://pcoptimizerpro.com
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://play.clubpenguin.com
Source: chromecache_239.13.dr, chromecache_286.13.dr String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_239.13.dr, chromecache_286.13.dr String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_239.13.dr, chromecache_286.13.dr String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_239.13.dr, chromecache_286.13.dr String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://softonic.com
Source: chromecache_423.13.dr, chromecache_239.13.dr String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://virustotal.com
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: http://windows93.net/
Source: chromecache_239.13.dr, chromecache_408.13.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_239.13.dr, chromecache_321.13.dr, chromecache_375.13.dr String found in binary or memory: http://www.broofa.com
Source: chromecache_239.13.dr String found in binary or memory: http://www.youtube.com/
Source: chromecache_239.13.dr String found in binary or memory: http://www.youtube.com/video/
Source: chromecache_423.13.dr String found in binary or memory: http://www.youtube.com/videoplayback
Source: chromecache_423.13.dr String found in binary or memory: http://youtube.com/drm/2012/10/10
Source: chromecache_423.13.dr String found in binary or memory: http://youtube.com/streaming/metadata/segment/102015
Source: chromecache_423.13.dr String found in binary or memory: http://youtube.com/streaming/otf/durations/112015
Source: chromecache_423.13.dr String found in binary or memory: http://youtube.com/yt/2012/10/10
Source: chromecache_239.13.dr String found in binary or memory: https://accounts.google.com/AddSession
Source: chromecache_239.13.dr String found in binary or memory: https://accounts.google.com/ServiceLogin
Source: chromecache_468.13.dr String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_468.13.dr String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_239.13.dr String found in binary or memory: https://accounts.youtube.com/RotateCookiesPage?origin=https://www.youtube.com&yt_pid=
Source: chromecache_239.13.dr String found in binary or memory: https://ad.doubleclick.net/ddm/trackclk/N444803.2428500DBMSITEID/B30029229.368252041;dc_trk_aid=
Source: chromecache_239.13.dr String found in binary or memory: https://ad.doubleclick.net/ddm/trackimp/N1957659.127733GOOGLE-YOUTUBE/B29940965.366940103;dc_trk_aid
Source: chromecache_239.13.dr String found in binary or memory: https://ad.doubleclick.net/ddm/trackimp/N444803.2428500DBMSITEID/B30029229.368252041;dc_trk_aid=
Source: chromecache_239.13.dr String found in binary or memory: https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid=
Source: chromecache_423.13.dr String found in binary or memory: https://admin.youtube.com
Source: chromecache_417.13.dr, chromecache_316.13.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/spf/2.4.0/LICENSE
Source: chromecache_239.13.dr String found in binary or memory: https://angular.io/license
Source: chromecache_138.13.dr String found in binary or memory: https://api.whatsapp.com/send
Source: chromecache_468.13.dr, chromecache_239.13.dr, chromecache_375.13.dr String found in binary or memory: https://apis.google.com
Source: chromecache_239.13.dr String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_239.13.dr String found in binary or memory: https://b.corp.google.com/issues/new?component=1382089&template=1853465
Source: chromecache_239.13.dr String found in binary or memory: https://clients2.google.com/gr/gr_sync.js
Source: chromecache_468.13.dr String found in binary or memory: https://clients6.google.com
Source: chromecache_196.13.dr String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_196.13.dr String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_468.13.dr String found in binary or memory: https://content.googleapis.com
Source: chromecache_468.13.dr String found in binary or memory: https://csp.withgoogle.com/csp/lcreport/
Source: chromecache_196.13.dr String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_196.13.dr String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_196.13.dr String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_423.13.dr String found in binary or memory: https://docs.google.com/get_video_info
Source: chromecache_239.13.dr String found in binary or memory: https://docs.google.com/picker
Source: chromecache_468.13.dr String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_239.13.dr String found in binary or memory: https://embeddedassistant-clients6.youtube.com/google.assistant.embedded.v1.EmbeddedAssistant/YTAssi
Source: chromecache_239.13.dr String found in binary or memory: https://embeddedassistant-frontend-clients6.youtube.com/google.assistant.embedded.v1.EmbeddedAssista
Source: chromecache_239.13.dr String found in binary or memory: https://embeddedassistant-frontend-webchannel.googleapis.com/google.assistant.embedded.v1.EmbeddedAs
Source: chromecache_239.13.dr String found in binary or memory: https://embeddedassistant-webchannel.googleapis.com/google.assistant.embedded.v1.EmbeddedAssistant/Y
Source: chromecache_170.13.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSCPfrEubmEwvcYpJgurKDCPrH4sq1UrVC1jg&amp;usqp=
Source: chromecache_473.13.dr String found in binary or memory: https://encrypted-tbn2.gstatic.com/faviconV2?url=https://
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_239.13.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto
Source: chromecache_239.13.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:300italic
Source: chromecache_239.13.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: chromecache_239.13.dr String found in binary or memory: https://fonts.gstatic.com
Source: chromecache_239.13.dr String found in binary or memory: https://fonts.gstatic.com/s/i/
Source: chromecache_239.13.dr, chromecache_375.13.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_239.13.dr, chromecache_375.13.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_239.13.dr, chromecache_375.13.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_239.13.dr, chromecache_375.13.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_329.13.dr String found in binary or memory: https://fonts.gstatic.com/s/youtubesans/v29/Qw38ZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3
Source: chromecache_239.13.dr String found in binary or memory: https://gamesnacks.com
Source: chromecache_239.13.dr String found in binary or memory: https://garlo.com/enapa2%3Fgc_id%3D20599670093&label=video_click_to_advertiser_site&ctype=110
Source: chromecache_239.13.dr String found in binary or memory: https://github.com/dmoscrop/fold-case
Source: chromecache_239.13.dr String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: chromecache_423.13.dr, chromecache_239.13.dr String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: chromecache_463.13.dr String found in binary or memory: https://goto.google.com/sherlog-framework-link
Source: chromecache_239.13.dr String found in binary or memory: https://i.ytimg.com/an/
Source: chromecache_239.13.dr String found in binary or memory: https://i.ytimg.com/sb/
Source: chromecache_239.13.dr String found in binary or memory: https://i.ytimg.com/vi/
Source: chromecache_239.13.dr String found in binary or memory: https://i.ytimg.com/vi/AERLXaPKn_U/mqdefault.jpg
Source: chromecache_423.13.dr String found in binary or memory: https://jnn-pa.googleapis.com
Source: chromecache_311.13.dr String found in binary or memory: https://lens.google.com
Source: chromecache_159.13.dr String found in binary or memory: https://lens.google.com/gen204
Source: chromecache_239.13.dr String found in binary or memory: https://mathiasbynens.be/
Source: chromecache_239.13.dr String found in binary or memory: https://myaccount-autopush.corp.google.com
Source: chromecache_239.13.dr String found in binary or memory: https://myaccount-dev.corp.google.com
Source: chromecache_239.13.dr String found in binary or memory: https://myaccount-staging.corp.google.com
Source: chromecache_239.13.dr String found in binary or memory: https://myaccount.google.com
Source: chromecache_239.13.dr String found in binary or memory: https://oauth-redirect-sandbox.googleusercontent.com
Source: chromecache_239.13.dr String found in binary or memory: https://oauth-redirect-test.googleusercontent.com
Source: chromecache_239.13.dr String found in binary or memory: https://oauth-redirect.googleusercontent.com
Source: chromecache_239.13.dr String found in binary or memory: https://pagead2.googlesyndication.com/activeview_ext?id=
Source: chromecache_239.13.dr String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=dv&
Source: chromecache_239.13.dr String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=error&bin=17
Source: chromecache_239.13.dr String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fetch&later&lidartos
Source: chromecache_239.13.dr String found in binary or memory: https://play.google.com
Source: chromecache_375.13.dr String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_468.13.dr String found in binary or memory: https://plus.google.com
Source: chromecache_468.13.dr String found in binary or memory: https://plus.googleapis.com
Source: chromecache_138.13.dr String found in binary or memory: https://policies.google.com/privacy
Source: chromecache_473.13.dr String found in binary or memory: https://policies.google.com/privacy?hl=
Source: chromecache_138.13.dr String found in binary or memory: https://policies.google.com/terms
Source: chromecache_473.13.dr String found in binary or memory: https://policies.google.com/terms?hl=
Source: chromecache_196.13.dr String found in binary or memory: https://recaptcha.net
Source: chromecache_239.13.dr String found in binary or memory: https://redux.js.org/api/store#subscribelistener
Source: chromecache_423.13.dr, chromecache_239.13.dr String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers
Source: chromecache_423.13.dr, chromecache_239.13.dr String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-4-store#middleware
Source: chromecache_423.13.dr, chromecache_239.13.dr String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-6-async-logic#using-the-redux-thunk-middleware
Source: chromecache_239.13.dr String found in binary or memory: https://rr3---sn-n4v7sns7.googlevideo.com/videoplayback?expire=1697267654&source=youtube&requiressl=
Source: chromecache_239.13.dr String found in binary or memory: https://s.youtube.com
Source: chromecache_239.13.dr String found in binary or memory: https://s.youtube.com/api/stats/atr?docid=
Source: chromecache_239.13.dr String found in binary or memory: https://s.youtube.com/api/stats/delayplay?cl=
Source: chromecache_239.13.dr String found in binary or memory: https://s.youtube.com/api/stats/playback?cl=
Source: chromecache_239.13.dr String found in binary or memory: https://s.youtube.com/api/stats/qoe?cl=
Source: chromecache_239.13.dr String found in binary or memory: https://s.youtube.com/api/stats/watchtime?cl=
Source: chromecache_239.13.dr String found in binary or memory: https://schema.org
Source: chromecache_239.13.dr String found in binary or memory: https://ssl.gstatic.com/docs/doclist/images/icon_10_generic_list.png
Source: chromecache_239.13.dr String found in binary or memory: https://studio.youtube.com/
Source: chromecache_239.13.dr String found in binary or memory: https://support.google.com
Source: chromecache_239.13.dr, chromecache_473.13.dr String found in binary or memory: https://support.google.com/
Source: chromecache_311.13.dr String found in binary or memory: https://support.google.com/chrome/?p=ui_voice_search
Source: chromecache_138.13.dr String found in binary or memory: https://support.google.com/legal/answer/3463239?hl=
Source: chromecache_196.13.dr String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_196.13.dr String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_196.13.dr String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_196.13.dr String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_138.13.dr String found in binary or memory: https://support.google.com/websearch/?p=image_info
Source: chromecache_443.13.dr String found in binary or memory: https://support.google.com/websearch/?p=m_ws_serp_gethelp
Source: chromecache_470.13.dr String found in binary or memory: https://support.google.com/websearch/answer/10622781
Source: chromecache_138.13.dr String found in binary or memory: https://support.google.com/websearch/answer/3338405
Source: chromecache_470.13.dr String found in binary or memory: https://support.google.com/websearch?&p=
Source: chromecache_470.13.dr String found in binary or memory: https://support.google.com/websearch?p=remove_image_rtr
Source: chromecache_443.13.dr String found in binary or memory: https://support.google.com/websearch?p=sge_image_gen
Source: chromecache_423.13.dr String found in binary or memory: https://support.google.com/youtube/?p=missing_quality
Source: chromecache_423.13.dr String found in binary or memory: https://support.google.com/youtube/?p=noaudio
Source: chromecache_423.13.dr String found in binary or memory: https://support.google.com/youtube/?p=report_playback
Source: chromecache_423.13.dr String found in binary or memory: https://support.google.com/youtube/answer/6276924
Source: chromecache_239.13.dr String found in binary or memory: https://support.google.com/youtube/bin/answer.py?answer=140536
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://thepiratebay.org
Source: chromecache_473.13.dr String found in binary or memory: https://translate.google.com/translate?u=
Source: chromecache_239.13.dr String found in binary or memory: https://tv.youtube.com
Source: chromecache_239.13.dr, chromecache_321.13.dr String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_423.13.dr String found in binary or memory: https://viacon.corp.google.com
Source: chromecache_468.13.dr String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_170.13.dr String found in binary or memory: https://www.forbes.com/advisor/pet-insurance/pet-care/how-much-does-a-cat-cost/
Source: chromecache_239.13.dr String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_239.13.dr, chromecache_473.13.dr String found in binary or memory: https://www.google.com
Source: chromecache_239.13.dr String found in binary or memory: https://www.google.com/get/videoqualityreport/
Source: chromecache_239.13.dr String found in binary or memory: https://www.google.com/get/videoqualityreport/?v=
Source: chromecache_454.13.dr, chromecache_321.13.dr String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: chromecache_239.13.dr String found in binary or memory: https://www.google.com/recaptcha/api.js?trustedtypes=true
Source: chromecache_196.13.dr, chromecache_293.13.dr String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_454.13.dr String found in binary or memory: https://www.google.com/search
Source: chromecache_239.13.dr, chromecache_473.13.dr String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_239.13.dr String found in binary or memory: https://www.googleadservices.com/pagead/aclk?sa=L&ai=C
Source: chromecache_239.13.dr String found in binary or memory: https://www.googleadservices.com/pagead/aclk?sa=L&ai=C3OQpfbUyZYWKL_Ken8RMFbClwAyRha6dc6fw7oP7EbaQHx
Source: chromecache_239.13.dr String found in binary or memory: https://www.googleadservices.com/pagead/managed/js/activeview/
Source: chromecache_468.13.dr String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_468.13.dr String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_423.13.dr String found in binary or memory: https://www.googleapis.com/certificateprovisioning/v1/devicecertificates/create?key=AIzaSyB-5OLKTx2i
Source: chromecache_239.13.dr String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-5KBDVVN
Source: chromecache_239.13.dr String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-TGBSZFB
Source: chromecache_196.13.dr String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__.
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com
Source: chromecache_170.13.dr String found in binary or memory: https://www.gstatic.com/_/mss/boq-search/_/js/k=boq-search.VisualFrontendUi.en_GB.eqKKRGeUVbs.es5.O/
Source: chromecache_184.13.dr, chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/external_hosted/lottie/lottie_light.js
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_375.13.dr String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_375.13.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_375.13.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chromecache_375.13.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/google_guarantee_grey600_48dp.png
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/local_shipping_grey600_48dp.png
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/location_on_grey600_48dp.png
Source: chromecache_375.13.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/search_black_24dp.png
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/undo_grey600_48dp.png
Source: chromecache_375.13.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chromecache_138.13.dr String found in binary or memory: https://www.gstatic.com/lens/cards/assets/multimodal_failure.png
Source: chromecache_153.13.dr, chromecache_293.13.dr String found in binary or memory: https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js
Source: chromecache_443.13.dr String found in binary or memory: https://www.gstatic.com/roam-web/regis_robot.jpg
Source: chromecache_473.13.dr String found in binary or memory: https://www.gstatic.com/save/icons/light/empty_collection_24px.svg
Source: chromecache_473.13.dr String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/annotations/youtube.png
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/creator/posts/Lottie_QuizCorrect_DarkTheme_01a.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/creator/posts/Lottie_QuizCorrect_LightTheme_01a.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/creator/posts/Lottie_QuizIncorrect_DarkTheme_01a.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/creator/posts/Lottie_QuizIncorrect_LightTheme_01a.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/handles/handles_curl_section_illustration_dark_v1.svg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/handles/handles_curl_section_illustration_light_v1.svg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/handles/handles_squiggle_1_dark_v1.svg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/handles/handles_squiggle_1_light_v1.svg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/handles/handles_squiggle_2_dark_v1.svg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/handles/handles_squiggle_2_light_v1.svg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/handles/handles_squiggle_3_dark.svg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/handles/handles_squiggle_3_light.svg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/handles/handles_squiggle_4_dark.svg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/handles/handles_squiggle_4_light.svg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/handles/handles_squiggle_5_dark.svg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/handles/handles_squiggle_5_light_v2.svg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/handles/handles_squiggle_6_dark.svg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/handles/handles_squiggle_6_light.svg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/icons/web/
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/labs/early_access_web_background_expanded_ai_2x.jpg
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/livestream/live_chat/lottie_animation/shimmer_background.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/lottie/animated_like_icon/
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/lottie/animated_like_icon/animated_like_icon_v2_dark.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/lottie/animated_like_icon/animated_like_icon_v2_light.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/lottie/playables_loading_animation/
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/lottie/smartimations/smartimation_border_
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/lottie/smartimations/smartimation_container_
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_bell_icon_
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_bell_icon_dark.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_bell_icon_light.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_container_
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_sparkle_
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/dark_mode/face_happy.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/dark_mode/face_meh.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/dark_mode/face_sad.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/dark_mode/face_unhappy.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/dark_mode/face_very_happy.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/light_mode/face_happy.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/light_mode/face_meh.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/light_mode/face_sad.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/light_mode/face_unhappy.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/surveys/lottie/animated_smileys/light_mode/face_very_happy.json
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/useredu/smart_downloads_optin_banner.gif
Source: chromecache_239.13.dr String found in binary or memory: https://www.gstatic.com/youtube/img/useredu/smart_downloads_optin_banner.svg
Source: chromecache_423.13.dr String found in binary or memory: https://www.gstatic.com/ytlr/img/sign_in_avatar_default.png?rn=
Source: chromecache_138.13.dr String found in binary or memory: https://www.iptc.org/
Source: chromecache_170.13.dr String found in binary or memory: https://www.nbcnews.com/think/opinion/cats-cute-furry-cuddly-invasive-alien-species-rcna41768
Source: chromecache_138.13.dr String found in binary or memory: https://www.twitter.com/share
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com/
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com/aboutthisad?pf=web&source=youtube&reasons=A
Source: chromecache_423.13.dr String found in binary or memory: https://www.youtube.com/api/drm/fps?ek=
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com/api/stats/ads?ver=
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com/api/timedtext?v=
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com/embed/
Source: chromecache_423.13.dr String found in binary or memory: https://www.youtube.com/generate_204?cpn=
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com/get_midroll_info?ei=
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVx
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com/howyoutubeworks/product-features/search/
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com/iframe_api
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com/pagead/adview?ai=C
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com/pagead/interaction/?ai=C
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com/pcs/activeview?xai=
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com/ptracking?ei=
Source: chromecache_239.13.dr String found in binary or memory: https://www.youtube.com/youtubei/v1/player?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8&prettyPrint=f
Source: chromecache_423.13.dr String found in binary or memory: https://youtu.be/
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.co.uk/watch?v=q6EoRBvdVPQ&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y
Source: chromecache_239.13.dr String found in binary or memory: https://youtube.com
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/
Source: chromecache_423.13.dr String found in binary or memory: https://youtube.com/api/drm/fps?ek=uninitialized
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=1pBdBcgMtiE
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=6s2iwMFZk_Q&index=24&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=6xDs_a2xmuE
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=8TCxE0bWQeQ&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y&index=183
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=8TCxE0bWQeQ&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y&index=183https://you
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=8ucCxtgN6sc
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=9zyThX4dZGk
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=AZdgxWV4SgU&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y&index=27
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=AZdgxWV4SgU&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y&index=27https://yout
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=C2u-2QAI888
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=FYhW2jTvvjg
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=Fn0edHX5xm8
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=HnrPR4mJ_Vc
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=Hv6RbEOlqRo
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=J3dlnRq6pnc
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=Kppx4bzfAaE
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=L-hDOiI0-6s
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=L_jWHffIx5E
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=LtLY94ZAsAQ
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=MaynOXm1X3Y
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=NsKaCS3CtsY
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=QH2-TGUlwu4
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=RET-cJ5NFYA
Source: WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2962092534.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2791648064.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2903980986.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2803611723.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2938270936.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2923014837.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2880801249.0000000000A03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/watch?v=RET-cJ5NFYA1002
Source: WaffMEMZ-1.0-Destructive.exe, 00000006.00000002.2996250088.0000000000969000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/watch?v=RET-cJ5NFYA4g
Source: WaffMEMZ-1.0-Destructive.exe, 00000006.00000002.3008134718.0000000002929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/watch?v=RET-cJ5NFYAC:
Source: WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2962092534.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2970419802.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2791648064.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2903980986.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2803611723.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2938270936.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2923014837.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2880801249.0000000000A03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/watch?v=RET-cJ5NFYAH=b
Source: WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2803413777.0000000003A01000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2903750490.0000000003A01000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/watch?v=RET-cJ5NFYAwa
Source: WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2803413777.0000000003A01000.00000004.00000020.00020000.00000000.sdmp, WaffMEMZ-1.0-Destructive.exe, 00000006.00000003.2903750490.0000000003A01000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/watch?v=RET-cJ5NFYAwaEQ
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=SAxpAs1Iaec&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y&index=285
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=SAxpAs1Iaec&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y&index=285https://you
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=TmUs5qVZJEQ
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=Z9LlEIDJL08
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=a0uQnWAmf-k&index=229&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=a0uQnWAmf-k&index=229&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5yhttps://you
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=afDZ9hZVwkg
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=bKgf5PaBzyg
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=cIEPbP6_Slk
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=dFdBLHSW_zI
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=g7_VlmEamUQ
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=jknOP21rywM
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=mKkLjJHwRec
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=q6EoRBvdVPQ&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=shCYA2J-De8&index=188&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=shCYA2J-De8&index=188&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5yhttps://you
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=sz2mmM-kN1I&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y&index=53
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=sz2mmM-kN1I&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y&index=53https://yout
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=t4LfU1f7evA
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=tn4D0g1Hs4I&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y&index=171
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=tn4D0g1Hs4I&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y&index=171https://you
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=uzrkmy9hEqM
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=vkqiC4KPeDs&index=133&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y
Source: WaffMEMZ-1.0-Destructive.exe String found in binary or memory: https://youtube.com/watch?v=vkqiC4KPeDs&index=133&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5yhttps://you
Source: chromecache_423.13.dr String found in binary or memory: https://youtubei.googleapis.com/youtubei/
Source: chromecache_239.13.dr String found in binary or memory: https://yt3.ggpht.com/
Source: chromecache_239.13.dr String found in binary or memory: https://yt3.ggpht.com/ytc/
Source: chromecache_423.13.dr String found in binary or memory: https://yurt.corp.google.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown Network traffic detected: HTTP traffic on port 50194 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50187
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50189
Source: unknown Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50222 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50192
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50195
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50194
Source: unknown Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50197
Source: unknown Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50196
Source: unknown Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50198
Source: unknown Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown Network traffic detected: HTTP traffic on port 50209 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown Network traffic detected: HTTP traffic on port 50226 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown Network traffic detected: HTTP traffic on port 50220 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50173
Source: unknown Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown Network traffic detected: HTTP traffic on port 50214 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50218
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50217
Source: unknown Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50219
Source: unknown Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50210
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50212
Source: unknown Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50211
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50214
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50213
Source: unknown Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50226
Source: unknown Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50221
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50220
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50222
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50225
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50224
Source: unknown Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50198 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown Network traffic detected: HTTP traffic on port 50167 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50192 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown Network traffic detected: HTTP traffic on port 50224 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50218 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50206 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50169 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50190 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown Network traffic detected: HTTP traffic on port 50212 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50200 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50179 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50207
Source: unknown Network traffic detected: HTTP traffic on port 50196 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50209
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50208
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50201
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50200
Source: unknown Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.52.162.98:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.52.162.98:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49770 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands
barindex
Yara detected KillMBR
Source: Yara match File source: 2.0.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: Process Memory Space: WaffMEMZ-1.0-Destructive.exe PID: 6684, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WaffMEMZ-1.0-Destructive.exe PID: 4208, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WaffMEMZ-1.0-Destructive.exe PID: 6688, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WaffMEMZ-1.0-Destructive.exe PID: 480, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WaffMEMZ-1.0-Destructive.exe PID: 2588, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WaffMEMZ-1.0-Destructive.exe PID: 7072, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WaffMEMZ-1.0-Destructive.exe PID: 7176, type: MEMORYSTR

Operating System Destruction
barindex
Yara detected KillMBR
Source: Yara match File source: 2.0.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.WaffMEMZ-1.0-Destructive.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: Process Memory Space: WaffMEMZ-1.0-Destructive.exe PID: 6684, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WaffMEMZ-1.0-Destructive.exe PID: 4208, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WaffMEMZ-1.0-Destructive.exe PID: 6688, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WaffMEMZ-1.0-Destructive.exe PID: 480, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WaffMEMZ-1.0-Destructive.exe PID: 2588, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WaffMEMZ-1.0-Destructive.exe PID: 7072, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WaffMEMZ-1.0-Destructive.exe PID: 7176, type: MEMORYSTR
Contains functionality to access PhysicalDrive, possible boot sector overwrite
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 0_2_003412A0 CreateFileA on filename \\.\PhysicalDrive0 0_2_003412A0
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 1_2_003412A0 CreateFileA on filename \\.\PhysicalDrive0 1_2_003412A0
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 0_2_00341030 Sleep,CreateThread,CreateThread,Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 0_2_00341030
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 0_2_00341120 LocalAlloc,LocalAlloc,GetCurrentProcess,GetProcessImageFileNameA,Sleep,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,LocalAlloc,GetProcessImageFileNameA,lstrcmpA,CloseHandle,LocalFree,Process32NextW,LocalAlloc,CloseHandle,Sleep,CreateThread,Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,Sleep,LocalAlloc, 0_2_00341120
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 0_2_00341189 CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,LocalAlloc,GetProcessImageFileNameA,lstrcmpA,CloseHandle,LocalFree,Process32NextW,LocalAlloc,CloseHandle,Sleep,CreateThread,Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,Sleep,LocalAlloc, 0_2_00341189
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 1_2_00341120 LocalAlloc,LocalAlloc,GetCurrentProcess,GetProcessImageFileNameA,K32GetProcessImageFileNameA,Sleep,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,LocalAlloc,GetProcessImageFileNameA,K32GetProcessImageFileNameA,lstrcmpA,FindCloseChangeNotification,LocalFree,Process32NextW,CloseHandle,Sleep,CreateThread,Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,Sleep,LocalAlloc, 1_2_00341120
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 1_2_00341030 Sleep,CreateThread,CreateThread,Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 1_2_00341030
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 1_2_00341189 CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,LocalAlloc,GetProcessImageFileNameA,K32GetProcessImageFileNameA,lstrcmpA,FindCloseChangeNotification,LocalFree,Process32NextW,CloseHandle,Sleep,CreateThread,Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,Sleep,LocalAlloc, 1_2_00341189
Tries to load missing DLLs
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: mmdevapi.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: ksuser.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: avrt.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: audioses.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: midimap.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: windows.shell.servicehostbuilder.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: mrmcorer.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: efswrt.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: msvcp110_win.dll Jump to behavior
Uses 32bit PE files
Source: WaffMEMZ-1.0-Destructive.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal63.rans.phis.evad.winEXE@66/317@47/15
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 0_2_00341030 Sleep,CreateThread,CreateThread,Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 0_2_00341030
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 0_2_00341120 LocalAlloc,LocalAlloc,GetCurrentProcess,GetProcessImageFileNameA,Sleep,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,LocalAlloc,GetProcessImageFileNameA,lstrcmpA,CloseHandle,LocalFree,Process32NextW,LocalAlloc,CloseHandle,Sleep,CreateThread,Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,Sleep,LocalAlloc, 0_2_00341120
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 0_2_00341189 CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,LocalAlloc,GetProcessImageFileNameA,lstrcmpA,CloseHandle,LocalFree,Process32NextW,LocalAlloc,CloseHandle,Sleep,CreateThread,Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,Sleep,LocalAlloc, 0_2_00341189
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 1_2_00341120 LocalAlloc,LocalAlloc,GetCurrentProcess,GetProcessImageFileNameA,K32GetProcessImageFileNameA,Sleep,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,LocalAlloc,GetProcessImageFileNameA,K32GetProcessImageFileNameA,lstrcmpA,FindCloseChangeNotification,LocalFree,Process32NextW,CloseHandle,Sleep,CreateThread,Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,Sleep,LocalAlloc, 1_2_00341120
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 1_2_00341030 Sleep,CreateThread,CreateThread,Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 1_2_00341030
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 1_2_00341189 CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,LocalAlloc,GetProcessImageFileNameA,K32GetProcessImageFileNameA,lstrcmpA,FindCloseChangeNotification,LocalFree,Process32NextW,CloseHandle,Sleep,CreateThread,Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,Sleep,LocalAlloc, 1_2_00341189
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: 0_2_00341120 LocalAlloc,LocalAlloc,GetCurrentProcess,GetProcessImageFileNameA,Sleep,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,LocalAlloc,GetProcessImageFileNameA,lstrcmpA,CloseHandle,LocalFree,Process32NextW,LocalAlloc,CloseHandle,Sleep,CreateThread,Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,Sleep,LocalAlloc, 0_2_00341120
Source: WaffMEMZ-1.0-Destructive.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: WaffMEMZ-1.0-Destructive.exe ReversingLabs: Detection: 80%
Source: WaffMEMZ-1.0-Destructive.exe Virustotal: Detection: 80%
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe File read: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe:Zone.Identifier Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess
Source: unknown Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe"
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /main
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\System32\notepad.exe" \note.txt
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://google.co.ck/search?q=free+google+play+cards+no+survey+2017
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2252,i,7463605335717451473,17823169971308070316,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://google.co.ck/search?q=how+to+make+a+sandwich
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=2004,i,4120550360188067905,17727113581807216450,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://google.co.ck/search?q=cats&tbm=isch
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1988,i,10331053170441700104,16618510580659716634,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://google.co.ck/search?q=how+to+move+to+north+korea
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1984,i,16072279555754838488,2084840952179057344,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://youtube.com/watch?v=RET-cJ5NFYA
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1956,i,15451710482569849955,1826618806102122458,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5612 --field-trial-handle=2252,i,7463605335717451473,17823169971308070316,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=2252,i,7463605335717451473,17823169971308070316,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /main Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\System32\notepad.exe" \note.txt Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://google.co.ck/search?q=free+google+play+cards+no+survey+2017 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://google.co.ck/search?q=how+to+make+a+sandwich Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://google.co.ck/search?q=cats&tbm=isch Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://google.co.ck/search?q=how+to+move+to+north+korea Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://youtube.com/watch?v=RET-cJ5NFYA Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2252,i,7463605335717451473,17823169971308070316,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=2252,i,7463605335717451473,17823169971308070316,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5612 --field-trial-handle=2252,i,7463605335717451473,17823169971308070316,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=2252,i,7463605335717451473,17823169971308070316,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=2004,i,4120550360188067905,17727113581807216450,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1988,i,10331053170441700104,16618510580659716634,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1984,i,16072279555754838488,2084840952179057344,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1956,i,15451710482569849955,1826618806102122458,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Automated click: OK
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: WaffMEMZ-1.0-Destructive.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: WaffMEMZ-1.0-Destructive.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: '">';h='<div class="'+_.B("GYd9oe")+'">';var l=e?136:152;b=_.bf(_.af(b));for(var n=b.length,p=0;p<n;p++){var q=b[p],r=void 0,w=void 0;h+=c?oDb(a,q,p,l+(null!=(r=g)?r:0)):_.pDb({pla:q,Ll:p,Zj:l+(null!=(w=g)?w:0),Hjb:e},a)}c=(0,_.M)(h+"</div>");d+=_.SB(a,c,void 0,void 0,void 0,"eaevp",void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,void 0,"tP1BTe LgD65d")+"</div>";a=(0,_.M)(d);return(0,_.M)(f+a+"</div>")}; source: chromecache_473.13.dr
Source: Binary string: 2)+"-"+_.Pj(_.Ql(g),3))+'"'+_.Fp(_.Zy(b))+">"+_.pDb({pla:g,Ll:g.Sd(),fw:!0,ew:!0,yr:!0,t2:c,Te:f.Ue()},b)+"</div></div>");return(0,_.M)(e)}); source: chromecache_473.13.dr
Source: Binary string: 0:_.Tz(ia))||1===r||w||z?"":'<div class="'+_.B("iXBThe")+'">'+_.dwb(a,_.eA(b))+"</div>")+"</div>";D+="<velog"+_.he(new _.Q(_.hA,null),!1)+">";D+=_.sDb(a,b,c,p,l,g,h);D=D+"</velog>"+((0<(null!=q?q:0)?_.oxb(a,q):"")+"</div></a>");return(0,_.M)(D+"</div>")};_.pDb=function(a,b){return _.zp("Oa")(a,b)}; source: chromecache_473.13.dr

Persistence and Installation Behavior
barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: EntryPoint,GetCommandLineW,CommandLineToArgvW,lstrcmpW,CreateThread,RegisterClassExA,CreateWindowExA,GetMessageW,GetMessageW,TranslateMessage,DispatchMessageW,TranslateMessage,DispatchMessageW,GetMessageW,CreateFileA,ExitProcess,LocalAlloc,WriteFile,WriteFile,ExitProcess,CloseHandle,CloseHandle,CreateFileA,ExitProcess,WriteFile,ExitProcess,CloseHandle,ShellExecuteA,Sleep,Sleep,CreateThread,Sleep,MessageBoxA,MessageBoxA,MessageBoxA,LocalAlloc,GetModuleFileNameW,ShellExecuteW,ShellExecuteW,ShellExecuteExW,SetPriorityClass,ExitProcess, \\.\PhysicalDrive0 0_2_003412A0
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: EntryPoint,GetCommandLineW,CommandLineToArgvW,lstrcmpW,CreateThread,RegisterClassExA,CreateWindowExA,GetMessageW,GetMessageW,TranslateMessage,DispatchMessageW,TranslateMessage,DispatchMessageW,GetMessageW,CreateFileA,ExitProcess,LocalAlloc,WriteFile,WriteFile,ExitProcess,CloseHandle,CloseHandle,CreateFileA,ExitProcess,WriteFile,ExitProcess,CloseHandle,ShellExecuteA,Sleep,Sleep,CreateThread,Sleep,MessageBoxA,MessageBoxA,MessageBoxA,LocalAlloc,GetModuleFileNameW,ShellExecuteW,ShellExecuteW,ShellExecuteExW,SetPriorityClass,ExitProcess, \\.\PhysicalDrive0 1_2_003412A0
Writes directly to the primary disk partition (DR0)
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe File written: \Device\Harddisk0\DR0 offset: 65536 length: 65536 Jump to behavior

Boot Survival
barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: EntryPoint,GetCommandLineW,CommandLineToArgvW,lstrcmpW,CreateThread,RegisterClassExA,CreateWindowExA,GetMessageW,GetMessageW,TranslateMessage,DispatchMessageW,TranslateMessage,DispatchMessageW,GetMessageW,CreateFileA,ExitProcess,LocalAlloc,WriteFile,WriteFile,ExitProcess,CloseHandle,CloseHandle,CreateFileA,ExitProcess,WriteFile,ExitProcess,CloseHandle,ShellExecuteA,Sleep,Sleep,CreateThread,Sleep,MessageBoxA,MessageBoxA,MessageBoxA,LocalAlloc,GetModuleFileNameW,ShellExecuteW,ShellExecuteW,ShellExecuteExW,SetPriorityClass,ExitProcess, \\.\PhysicalDrive0 0_2_003412A0
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Code function: EntryPoint,GetCommandLineW,CommandLineToArgvW,lstrcmpW,CreateThread,RegisterClassExA,CreateWindowExA,GetMessageW,GetMessageW,TranslateMessage,DispatchMessageW,TranslateMessage,DispatchMessageW,GetMessageW,CreateFileA,ExitProcess,LocalAlloc,WriteFile,WriteFile,ExitProcess,CloseHandle,CloseHandle,CreateFileA,ExitProcess,WriteFile,ExitProcess,CloseHandle,ShellExecuteA,Sleep,Sleep,CreateThread,Sleep,MessageBoxA,MessageBoxA,MessageBoxA,LocalAlloc,GetModuleFileNameW,ShellExecuteW,ShellExecuteW,ShellExecuteExW,SetPriorityClass,ExitProcess, \\.\PhysicalDrive0 1_2_003412A0
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Thread delayed: delay time: 1000000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Window / User API: threadDelayed 2235 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Window / User API: threadDelayed 2246 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Window / User API: threadDelayed 2220 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Window / User API: threadDelayed 2252 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Window / User API: threadDelayed 2245 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Window / User API: threadDelayed 5471 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Window / User API: threadDelayed 3696 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe API coverage: 8.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe TID: 6212 Thread sleep count: 2235 > 30 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe TID: 7092 Thread sleep count: 2246 > 30 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe TID: 6972 Thread sleep count: 2220 > 30 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe TID: 7000 Thread sleep count: 2252 > 30 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe TID: 7172 Thread sleep count: 2245 > 30 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe TID: 7180 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe TID: 7252 Thread sleep time: -54710s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe TID: 7180 Thread sleep time: -40000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe TID: 7180 Thread sleep time: -50000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe TID: 7288 Thread sleep time: -36960s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe TID: 7180 Thread sleep time: -55000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe TID: 7180 Thread sleep time: -11000000s >= -30000s Jump to behavior
Queries disk information (often used to detect virtual machines)
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe File opened: PhysicalDrive0 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Last function: Thread delayed
Sleep loop found (likely to delay execution)
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Thread sleep count: Count: 2235 delay: -10 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Thread sleep count: Count: 2246 delay: -10 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Thread sleep count: Count: 2220 delay: -10 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Thread sleep count: Count: 2252 delay: -10 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Thread sleep count: Count: 2245 delay: -10 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Thread sleep count: Count: 5471 delay: -10 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Thread sleep count: Count: 3696 delay: -10 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Thread delayed: delay time: 50000 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Thread delayed: delay time: 55000 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Thread delayed: delay time: 1000000 Jump to behavior
Source: WaffMEMZ-1.0-Destructive.exe, 00000000.00000002.1694193665.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: WaffMEMZ-1.0-Destructive.exe, 00000000.00000002.1694193665.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b};
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process information queried: ProcessInformation Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdog Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe "C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe" /main Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\System32\notepad.exe" \note.txt Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://google.co.ck/search?q=free+google+play+cards+no+survey+2017 Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://google.co.ck/search?q=how+to+make+a+sandwich Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://google.co.ck/search?q=cats&tbm=isch Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://google.co.ck/search?q=how+to+move+to+north+korea Jump to behavior
Source: C:\Users\user\Desktop\WaffMEMZ-1.0-Destructive.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://youtube.com/watch?v=RET-cJ5NFYA Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\notepad.exe Queries volume information: C:\note.txt VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1417345 Sample: WaffMEMZ-1.0-Destructive.exe Startdate: 29/03/2024 Architecture: WINDOWS Score: 63 48 rr3.sn-p5qlsn7s.googlevideo.com 2->48 50 rr3.sn-p5qddn7k.googlevideo.com 2->50 52 6 other IPs or domains 2->52 64 Antivirus / Scanner detection for submitted sample 2->64 66 Multi AV Scanner detection for submitted file 2->66 68 Phishing site detected (based on favicon image match) 2->68 70 Yara detected KillMBR 2->70 9 WaffMEMZ-1.0-Destructive.exe 1 2->9         started        signatures3 process4 signatures5 72 Contains functionality to access PhysicalDrive, possible boot sector overwrite 9->72 74 Contains functionality to infect the boot sector 9->74 12 WaffMEMZ-1.0-Destructive.exe 14 9->12         started        16 WaffMEMZ-1.0-Destructive.exe 9->16         started        18 WaffMEMZ-1.0-Destructive.exe 9->18         started        20 3 other processes 9->20 process6 file7 46 \Device\Harddisk0\DR0, DOS/MBR 12->46 dropped 76 Writes directly to the primary disk partition (DR0) 12->76 22 chrome.exe 1 12->22         started        25 chrome.exe 12->25         started        27 chrome.exe 12->27         started        29 3 other processes 12->29 signatures8 process9 dnsIp10 54 192.168.2.4, 443, 49723, 49724 unknown unknown 22->54 56 239.255.255.250 unknown Reserved 22->56 31 chrome.exe 22->31         started        34 chrome.exe 22->34         started        36 chrome.exe 6 22->36         started        38 chrome.exe 25->38         started        40 chrome.exe 27->40         started        42 chrome.exe 29->42         started        44 chrome.exe 29->44         started        process11 dnsIp12 58 142.251.16.105, 443, 49761 GOOGLEUS United States 31->58 60 142.251.16.106 GOOGLEUS United States 31->60 62 21 other IPs or domains 31->62
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.251.16.132
 photos-ugc.l.googleusercontent.com United States
15169 GOOGLEUS false
172.217.135.201
 rr4.sn-p5qlsn76.googlevideo.com United States
15169 GOOGLEUS false
173.194.53.41
 rr4.sn-p5qs7nzy.googlevideo.com United States
15169 GOOGLEUS false
142.251.167.94
 unknown United States
15169 GOOGLEUS false
172.253.115.99
 google.co.ck United States
15169 GOOGLEUS false
172.253.115.147
 unknown United States
15169 GOOGLEUS false
172.253.62.149
 static.doubleclick.net United States
15169 GOOGLEUS false
142.251.163.93
 youtube-ui.l.google.com United States
15169 GOOGLEUS false
142.251.16.105
 unknown United States
15169 GOOGLEUS false
142.251.167.119
 i.ytimg.com United States
15169 GOOGLEUS false
142.251.16.106
 unknown United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.251.16.94
 www.google.co.ck United States
15169 GOOGLEUS false
142.251.16.190
 youtube.com United States
15169 GOOGLEUS false

Private

IP
192.168.2.4

Contacted Domains

Name IP Active
www.google.co.ck 142.251.16.94 true
plus.l.google.com 142.251.163.139 true
i.ytimg.com 142.251.167.119 true
ad.doubleclick.net 172.253.122.149 true
google.co.ck 172.253.115.99 true
static.doubleclick.net 172.253.62.149 true
rr3.sn-p5qddn7k.googlevideo.com 173.194.7.136 true
youtube.com 142.251.16.190 true
youtube-ui.l.google.com 142.251.163.93 true
googleads.g.doubleclick.net 172.253.63.155 true
photos-ugc.l.googleusercontent.com 142.251.16.132 true
rr2.sn-p5qs7nzk.googlevideo.com 74.125.155.71 true
rr4.sn-p5qlsn76.googlevideo.com 172.217.135.201 true
rr4.sn-p5qs7nzy.googlevideo.com 173.194.53.41 true
www.google.com 142.251.111.99 true
rr3.sn-p5qlsn7s.googlevideo.com 172.217.135.168 true
rr2---sn-p5qs7nzk.googlevideo.com unknown unknown
yt3.ggpht.com unknown unknown
rr3---sn-p5qlsn7s.googlevideo.com unknown unknown
i.natgeofe.com unknown unknown
rr4---sn-p5qs7nzy.googlevideo.com unknown unknown
rr3---sn-p5qddn7k.googlevideo.com unknown unknown
www.youtube.com unknown unknown
apis.google.com unknown unknown
rr4---sn-p5qlsn76.googlevideo.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
about:blank false
  • Avira URL Cloud: safe
 low
https://www.google.co.ck/_/VisualFrontendUi/browserinfo?f.sid=3196530663577752641&bl=boq_visualfrontendserver_20240326.01_p0&hl=en-GB&authuser&opi=89978449&soc-app=162&soc-platform=1&soc-device=1&_reqid=6616&rt=j false
  • Avira URL Cloud: safe
 unknown
https://www.youtube.com/s/player/3b96d06c/player_ias.vflset/en_US/captions.js false
    		high
    https://www.youtube.com/s/desktop/accca349/img/favicon_32x32.png false
      		high
      https://www.youtube.com/s/desktop/accca349/jsbin/www-tampering.vflset/www-tampering.js false
        		high
        https://www.youtube.com/api/stats/watchtime?ns=yt&el=detailpage&cpn=f-fLtixrB5CGYAkV&ver=2&cmt=6.873&fmt=396&fs=0&rt=10.012&euri&lact=992&cl=619202668&state=playing&volume=100&cbr=Chrome&cbrver=117.0.0.0&c=WEB&cver=2.20240327.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&hl=en_US&cr=US&len=8.521&rtn=20&afmt=251&idpj=-3&ldpj=-11&rti=10&st=0&et=6.873&muted=0&docid=RET-cJ5NFYA&ei=aBAGZtm5Kaucy_sPwdSC6AY&plid=AAYUwgfiKhqy-R1g&of=hlQIrIH4TMnbBTYX3UuvGg&vm=CAEQARgEOjJBSHFpSlRLdkc2ZDdCNjk5XzZkSm5lSUxKaklKa29nM3pRYkZmbHNES29MbUhkaXZ6d2JiQVBta0tETC1OOS1OTEQxSWVYRGVFYnVaNVNJYjZzdkxoVnVWS1EwX3FFbXFhZWhqRzc3Y2ZsTGZEanVMQy1jRmVMd1FsQlZTSENYX2E4VzRiZ3c0MnBKRHlPbmZhUS1MeXdoAg false
          		high
          https://i.ytimg.com/vi/a0uQnWAmf-k/hqdefault.jpg false
            		high
            https://www.google.com/favicon.ico false
              		high
              https://www.google.co.ck/search?q=cats&tbm=isch&sfr=vfe#imgrc=huRXJHlMpmgP5M false
                		unknown
                https://www.youtube.com/app_shell false
                  		high
                  https://www.google.co.ck/_/VisualFrontendUi/data/batchexecute?rpcids=RQBMgb&source-path=%2Fsearch&viewertype=7&f.sid=3196530663577752641&bl=boq_visualfrontendserver_20240326.01_p0&hl=en-GB&authuser&opi=89978449&soc-app=162&soc-platform=1&soc-device=1&_reqid=206616&rt=c false
                  • Avira URL Cloud: safe
                  		 unknown
                  https://www.youtube.com/s/search/audio/success.mp3 false
                    		high
                    https://youtube.com/watch?v=a0uQnWAmf-k&index=229&list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y false
                      		high
                      https://i.ytimg.com/vi/8NArIVIQ4BI/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLCgMZ5Okoq5nWZzACduqMvECyC91g false
                        		high
                        http://google.co.ck/search?q=free+google+play+cards+no+survey+2017 false
                        • 0%, Virustotal, Browse
                        • Avira URL Cloud: safe
                        		 unknown
                        https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&s=S3woggdlKDNhk03qjYJLqs41XUZTODqiC9GZV7OYwRHG6m__DElQMnH-7O3bk-agOFSr33GgIao3TY09HmnFu3cWlSA49rYZEDM3L3qkQ2J0TS_FUMCuIN05Q6HQ2KrcvCihJs9s8MNF7HJJbTgd3N6LbF7nxjDK7rdgnpACvHlic1MJ6i0ffGPKIh9w5IkPIl8KvQ4mGhS-9CDY9sT-bXDgHIxj0XAv1ntFOs1El86lsUbA3oGtsaq-63fMsNpAMed7qxI1yniyVl4iEyoBtUJMUCdqkeE&cb=a41b0ezi7o34 false
                          		high
                          https://i.ytimg.com/vi/a0uQnWAmf-k/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLBaerH-yRqCgB990a0q_118JlobhQ false
                            		high
                            https://www.youtube.com/s/desktop/accca349/img/favicon.ico false
                              		high
                              https://yt3.ggpht.com/ytc/AIdro_lI-1fKvLog4cdgTzH3tSLXdDxIoXMKS-MVsE4EBQ=s48-c-k-c0x00ffffff-no-rj-mo false
                                		high
                                https://www.google.com/recaptcha/api.js false
                                  		high
                                  https://i.ytimg.com/vi/PhAWyOuIedc/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLD4RJtmGLu40UtKaWB3eJQyV8YcuQ false
                                    		high
                                    https://yt3.ggpht.com/ytc/AIdro_n58AzmUwydoAhiZFw9tUbwmZisUsSfbpGXLGD-1A=s176-c-k-c0x00ffffff-no-rj false
                                      		high
                                      https://i.ytimg.com/vi/bIekKuwnUoo/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLDcGJ-YEWVppQmNdK8oO_qpLapH2g false
                                        		high
                                        https://yt3.ggpht.com/a/default-user=s48-c-k-c0x00ffffff-no-rj false
                                          		high
                                          https://i.ytimg.com/vi/40KcrrfbJ6o/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLBlDaZBkJDbmlzk8MA7OH2a31nUDQ false
                                            		high
                                            https://www.youtube.com/s/desktop/accca349/jsbin/serviceworker-kevlar-appshell.vflset/serviceworker-kevlar-appshell.js false
                                              		high
                                              https://i.ytimg.com/vi/31pdm7lxe1c/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLCKogv-ZIutySpJLrqz_GqrYwzDFQ false
                                                		high
                                                https://www.youtube.com/s/player/3b96d06c/player_ias.vflset/en_US/remote.js false
                                                  		high
                                                  https://www.youtube.com/s/player/3b96d06c/player_ias.vflset/en_US/offline.js false
                                                    		high
                                                    https://www.google.com/pagead/lvz?evtid=ACd6Ktw72rPRS5UmcBC9F9QjmI1KHq1mThbZ5QQ2FY3MExYONnnNC3amgaY-FmIWiIFLcnbRywukbdHJMtRkx3ujnYz8j8VPIQ&req_ts=1711673449&pg=MainAppBootstrap%3AWatch&az=1&sigh=AB9vU40nqXX1Z6wjLbgJPZy5t8Bk1v7C3A false
                                                      		high
                                                      https://i.ytimg.com/vi/3GGg4XOsaRI/hqdefault.jpg?sqp=-oaymwEbCKgBEF5IVfKriqkDDggBFQAAiEIYAXABwAEG&rs=AOn4CLByxRMqSY8luKDN5QHN1jhuzVzPtQ false
                                                        		high
                                                        https://i.ytimg.com/vi/9SwFwTrwS9I/hqdefault.jpg?sqp=-oaymwEcCNACELwBSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLDHEl4H2Vg1jpYcY2mxBY3TnSYizQ false
                                                          		high
                                                          https://yt3.ggpht.com/ytc/AIdro_lRbnh76maj-l4rhy_6CKM6wLwnb5QaiDD-nNg=s88-c-k-c0x00ffffff-no-rj false
                                                            		high