Windows Analysis Report
Refund_Document_Protected.pdf

Phishing

Source: https://www.google.com/sorry/index?continue=https://google.com/&q=EgRRtTk0GKSN-7AGIjAN8wKH2tLR0iCf20s48pf8elJFhPJ6XKQKrKMNrVaxME6IhLq5_5pU_REk0yz-ppwyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://google.com/&q=EgRRtTk0GKSN-7AGIjAN8wKH2tLR0iCf20s48pf8elJFhPJ6XKQKrKMNrVaxME6IhLq5_5pU_REk0yz-ppwyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://google.com/&q=EgRRtTk0GKSN-7AGIjAN8wKH2tLR0iCf20s48pf8elJFhPJ6XKQKrKMNrVaxME6IhLq5_5pU_REk0yz-ppwyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=nI1Jr-gaEoIrUiJ__Co_RjbywBTTWFKrGZWDKjV-FagawKBnerz5hSEVW1Q9I8VeS6VPGsFQvGgqOfNfP4XfWjcGkUZbqsCzNsxL3HBhoXv8ZAR-Ix-pOmjKGoyKaWiioq40GnnxiXBW1S0kSX4aW_3a2qwq6B5OjR0jztYOujPxGCtIhOoIRd-1fhmrVYcqcf9gGbgBnKsfEL_1ueuyy7VJAYQxFFnV6VS923ItbDONvjM7rZVIPZmWhIDnfC-pA8IXHajdFQ96qML6RHsPcCAsyjfhcZc&cb=7n0ridkp0lj1	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=nI1Jr-gaEoIrUiJ__Co_RjbywBTTWFKrGZWDKjV-FagawKBnerz5hSEVW1Q9I8VeS6VPGsFQvGgqOfNfP4XfWjcGkUZbqsCzNsxL3HBhoXv8ZAR-Ix-pOmjKGoyKaWiioq40GnnxiXBW1S0kSX4aW_3a2qwq6B5OjR0jztYOujPxGCtIhOoIRd-1fhmrVYcqcf9gGbgBnKsfEL_1ueuyy7VJAYQxFFnV6VS923ItbDONvjM7rZVIPZmWhIDnfC-pA8IXHajdFQ96qML6RHsPcCAsyjfhcZc&cb=7n0ridkp0lj1	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://ogs.google.com/widget/callout?prid=19037050&pgid=19037049&puid=9ceb59a7585b55bd&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com&cn=callout&pid=1&spid=538&hl=en	HTTP Parser: No favicon

Compliance

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49716 version: TLS 1.2

Source:	Binary string: _.ODb=new _.mn;_.ODb.oa=!0;_.PDb=!1; source: chromecache_219.16.dr
Source:	Binary string: 5);case 5:e=g=h.oa;case 4:if(e&&!c){var k=e,l=d&&d.has("ved")?d.get("ved"):"";k=_.z(k.header,1);k=_.tn(k).Kc("sqi","17");l&&k.Kc("refv",l);k.log()}case 2:return h.return({xBa:f,nva:e})}})};var UHb=function(a,b,c){a=Error.call(this,a);this.message=a.message;"stack"in a&&(this.stack=a.stack);a={};this.details=(a.req=b,a.res=c,a)};_.C(UHb,Error);var WHb=!1,$Hb=0;var hIb=function(a){this.Ea=_.n(a)};_.C(hIb,_.q);_.PDb=!0; source: chromecache_219.16.dr
Source:	Binary string: _.$Cb=!!(_.hh[24]&8192);_.aDb=!!(_.hh[24]>>14&1);_.bDb=!!(_.hh[24]>>17&1);_.cDb=!!(_.hh[24]>>18&1);_.dDb=!!(_.hh[24]>>21&1);_.eDb=!!(_.hh[24]>>25&1);_.fDb=!!(_.hh[25]&1);_.gDb=!!(_.hh[25]&128);_.hDb=!!(_.hh[25]&256);_.iDb=!!(_.hh[25]&512);_.jDb=!!(_.hh[25]&1024);_.kDb=!!(_.hh[24]>>15&1);_.lDb=!!(_.hh[24]>>19&1);_.mDb=!!(_.hh[25]&64);_.nDb=!!(_.hh[24]>>23&1);_.oDb=!!(_.hh[24]>>24&1);_.pDb=!!(_.hh[24]>>29&1);_.qDb=!!(_.hh[24]>>27&1);_.rDb=!!(_.hh[25]&16);_.sDb=!!(_.hh[25]&8);_.tDb=!!(_.hh[24]>>16&1); source: chromecache_219.16.dr
Source:	Binary string: oHb=function(){var a,b,c,d,e,f,g,h,k;return _.fh(function(l){if(1==l.ka){a=(0,_.Yb.cast)(window.google.aipf,_.aHa);window.google.aipf={push:function(){_.md(Error("rf"))}};_.mHb={};b=_.Ta(a);for(c=b.next();!c.done;c=b.next())d=c.value,_.mHb[d.id]=d;var p=l.yield;nHb||(_.PDb?nHb=Promise.resolve(_.ODb.Pg()):(_.QDb=new _.Bg,nHb=_.QDb.promise));return p.call(l,nHb,2)}e=l.oa;f=(0,_.Yb.zd)(e.Tjd,"Registered RequestFactory implementation does not support hydrating inline prefetches.");g=_.Ta(a);for(h=g.next();!h.done;h= source: chromecache_219.16.dr
Source:	Binary string: var vdb;_.pdb=function(a){this.Ea=_.n(a)};_.C(_.pdb,_.q);_.qdb=function(a){return _.r(a,_.pdb,3)};_.rdb=function(a){this.Ea=_.n(a)};_.C(_.rdb,_.q);_.sdb=[0,_.G,_.$cb,[0,_.G],_.Gk,[0,_.jk,-1],_.G,-1];_.tdb=[0,_.kdb,_.Gk,_.vk,_.nk];_.udb=[0,_.G,-1,_.Lr,_.G,_.F,_.jk,-1,_.G,[0,_.F,_.jk,_.F]]; source: chromecache_219.16.dr

Networking

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GGEx2SZstFUBUPx&MD=ME+UflSz HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GGEx2SZstFUBUPx&MD=ME+UflSz HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?nmOVboGWs HTTP/1.1Host: funded-service.shantishamdasani.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4pTSD2e?nmOVboGWs HTTP/1.1Host: jembawuk.bru-ray.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://google.com/&q=EgRRtTk0GKSN-7AGIjAN8wKH2tLR0iCf20s48pf8elJFhPJ6XKQKrKMNrVaxME6IhLq5_5pU_REk0yz-ppwyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/sorry/index?continue=https://google.com/&q=EgRRtTk0GKSN-7AGIjAN8wKH2tLR0iCf20s48pf8elJFhPJ6XKQKrKMNrVaxME6IhLq5_5pU_REk0yz-ppwyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=nI1Jr-gaEoIrUiJ__Co_RjbywBTTWFKrGZWDKjV-FagawKBnerz5hSEVW1Q9I8VeS6VPGsFQvGgqOfNfP4XfWjcGkUZbqsCzNsxL3HBhoXv8ZAR-Ix-pOmjKGoyKaWiioq40GnnxiXBW1S0kSX4aW_3a2qwq6B5OjR0jztYOujPxGCtIhOoIRd-1fhmrVYcqcf9gGbgBnKsfEL_1ueuyy7VJAYQxFFnV6VS923ItbDONvjM7rZVIPZmWhIDnfC-pA8IXHajdFQ96qML6RHsPcCAsyjfhcZc&cb=7n0ridkp0lj1 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://google.com/&q=EgRRtTk0GKSN-7AGIjAN8wKH2tLR0iCf20s48pf8elJFhPJ6XKQKrKMNrVaxME6IhLq5_5pU_REk0yz-ppwyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI
Source: global traffic	HTTP traffic detected: GET /js/bg/KTA1qoE7ZDz05UuzGBms7CVmuC34sZ4nnXwNjg065Po.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=nI1Jr-gaEoIrUiJ__Co_RjbywBTTWFKrGZWDKjV-FagawKBnerz5hSEVW1Q9I8VeS6VPGsFQvGgqOfNfP4XfWjcGkUZbqsCzNsxL3HBhoXv8ZAR-Ix-pOmjKGoyKaWiioq40GnnxiXBW1S0kSX4aW_3a2qwq6B5OjR0jztYOujPxGCtIhOoIRd-1fhmrVYcqcf9gGbgBnKsfEL_1ueuyy7VJAYQxFFnV6VS923ItbDONvjM7rZVIPZmWhIDnfC-pA8IXHajdFQ96qML6RHsPcCAsyjfhcZc&cb=7n0ridkp0lj1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm- HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=nI1Jr-gaEoIrUiJ__Co_RjbywBTTWFKrGZWDKjV-FagawKBnerz5hSEVW1Q9I8VeS6VPGsFQvGgqOfNfP4XfWjcGkUZbqsCzNsxL3HBhoXv8ZAR-Ix-pOmjKGoyKaWiioq40GnnxiXBW1S0kSX4aW_3a2qwq6B5OjR0jztYOujPxGCtIhOoIRd-1fhmrVYcqcf9gGbgBnKsfEL_1ueuyy7VJAYQxFFnV6VS923ItbDONvjM7rZVIPZmWhIDnfC-pA8IXHajdFQ96qML6RHsPcCAsyjfhcZc&cb=7n0ridkp0lj1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/sorry/index?continue=https://google.com/&q=EgRRtTk0GKSN-7AGIjAN8wKH2tLR0iCf20s48pf8elJFhPJ6XKQKrKMNrVaxME6IhLq5_5pU_REk0yz-ppwyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://google.com/&q=EgRRtTk0GKSN-7AGIjAN8wKH2tLR0iCf20s48pf8elJFhPJ6XKQKrKMNrVaxME6IhLq5_5pU_REk0yz-ppwyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AH0dGfRTBgEKa_-fknTF4d-6zGK0nZXojfx2pgX9sSY0jCyL9vPhF2PfsCMzayInPAxcJkSarmDfMuGilwvxgb0; 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA7RrKgOVa2jhxprJN8ecpnroaD6BBUTisx7hYqNOpJ5cLQFsO9YNX7zUTO1kNvxzDZ1skrIsxE1dpAoSOul4c8WyfbkoUprOKCn5zFU5AZ-0AAfLKjBIUKvVKg6gHldquAp7nhEdOWmynk5kY6BUau5vFfBIm1F1avQEegaZnF-Fr4iiPUJjWPdkyU7yX5JgBZDlyPi&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AH0dGfRTBgEKa_-fknTF4d-6zGK0nZXojfx2pgX9sSY0jCyL9vPhF2PfsCMzayInPAxcJkSarmDfMuGilwvxgb0; 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA7RrKgOVa2jhxprJN8ecpnroaD6BBUTisx7hYqNOpJ5cLQFsO9YNX7zUTO1kNvxzDZ1skrIsxE1dpAoSOul4c8WyfbkoUprOKCn5zFU5AZ-0AAfLKjBIUKvVKg6gHldquAp7nhEdOWmynk5kY6BUau5vFfBIm1F1avQEegaZnF-Fr4iiPUJjWPdkyU7yX5JgBZDlyPi&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AH0dGfRTBgEKa_-fknTF4d-6zGK0nZXojfx2pgX9sSY0jCyL9vPhF2PfsCMzayInPAxcJkSarmDfMuGilwvxgb0; 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/userverify?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AH0dGfRTBgEKa_-fknTF4d-6zGK0nZXojfx2pgX9sSY0jCyL9vPhF2PfsCMzayInPAxcJkSarmDfMuGilwvxgb0; 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI
Source: global traffic	HTTP traffic detected: GET /?google_abuse=GOOGLE_ABUSE_EXEMPTION%3DID%3Dd1c1f7cbf6db3c94:TM%3D1713292983:C%3Dr:IP%3D81.181.57.52-:S%3Dh96y2G5DpfW5dEiFoBO7LY4%3B+path%3D/%3B+domain%3Dgoogle.com%3B+expires%3DTue,+16-Apr-2024+21:43:03+GMT HTTP/1.1Host: google.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: google.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4
Source: global traffic	HTTP traffic detected: GET /xjs/_/ss/k=xjs.hd.8L4846zfxoM.L.W.O/am=cAEAAAAAAMAAAAAAAAAAAAAAAAAAgAAAAgAAAAAgAHzCAQLAhgAAAEAAAIAAACAAAACCAAAAACAIABgAABAAAAAAgRAACIAACSAJQQYCAIhgAgFSAYABAAAAIAEAAAACAhAwAAHAQwQAAAQ6AQEgAABkgBAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABQAAAAAAAAAAAAAAAAAAAC/d=1/ed=1/br=1/rs=ACT90oHfcSzw4WMS-4IUcR0A8_PbW5cCEQ/m=cdos,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_272x92dp.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.DstIhYEqY00.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAkgAIAAAoAACAAAAAAgMAQACAAIACLAEgEBCAIABgAQhCAhzIBgIAJAAAACAAIAQgCAIAAAABAAQAAAAAAAAAAgAECBAAAAAAAAAAAAAA6AQAIAIBggBAAgAAAAADkAQgOwCAFAQAAAAAAAAAAAAACkCCYCxJQEAABAAAAAAAAAAAAAJBKJxbG/d=1/ed=1/dg=2/br=1/rs=ACT90oEaiyiS4RoDAnQw5r8UJKy_tlb-dg/ee=ALeJib:B8gLwd;AfeaP:TkrAjf;Afksuc:wMx0R;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DM55c:imLrKe;DULqB:RKfG5c;Dkk6ge:wJqrrd;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;Erl4fe:FloWmf,FloWmf;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;HqeXPd:cmbnH;IBADCc:RYquRb;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KeeMUb:HiPxjc;KpRAue:Tia57b;LBgRLc:XVMNvd;LEikZe:byfTOb,lsjVmc;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;Oj465e:KG2eXe,KG2eXe;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;Q1Ow7b:x5CSu;Q6C5kf:pfdZCe;QGR0gd:Mlhmy;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO,fTfGO;SNUn3:ZwDk9d,x8cHvb;ShpF6e:N0pvGc;TxfV6d:YORN0b;U96pRd:FsR04;UDrY1c:eps46d;UVmjEd:EesRsb;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YV5bee:IvPZ6d;YkQtAf:rx8ur;ZMvdv:PHFPjb;ZWEUA:afR4Cf;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aZ61od:arTwJ;bDXwRe:UsyOtc;bFZ6gf:RsDQqe;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;daB6be:lMxGPd;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:VruDBd;eHDfl:ofjVkb;eO3lse:nFClrf;fWLTFc:TVBJbf;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;heHB1:sFczq;hjRo6e:F62sG;hsLsYc:Vl118;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;io8t5d:sgY6Zb;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kMFpHd:OTA3Ae;kbAm9d:MkHyGd;lkq0A:JyBE3e;nAFL3:NTMZac,s39S4;oGtAuc:sOXFj;oSUNyd:fTfGO,fTfGO;oUlnpc:RagDlc;okUaUd:wItadb;p2tIDb:tp1Cx;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:mg5CW;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;sP4Vbe:VwDzFe;sTsDMc:kHVSUb;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uY49fb:COQbmf;uuQkY:u2V3ud;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:TtcOte;wV5Pjc:L8KGxe;whEZac:F4AmNb;xBbsrc:NEW1Qc;yGxLoc:FmAr0c;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=cdos,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_272x92dp.png HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs
Source: global traffic	HTTP traffic detected: GET /images/searchbox/desktop_searchbox_sprites318_hr.webp HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs
Source: global traffic	HTTP traffic detected: GET /images/searchbox/desktop_searchbox_sprites318_hr.webp HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs
Source: global traffic	HTTP traffic detected: GET /complete/search?q&cp=0&client=gws-wiz&xssi=t&gs_pcrt=2&hl=en&authuser=0&psi=ucYeZoqbAcTckPIP6uKXyAE.1713292985568&dpr=1&nolsbt=1 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/md=3/k=xjs.hd.en.DstIhYEqY00.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAkgAIAAAoAACAAAAAAgMAQACAAIACLAEgEBCAIABgAQhCAhzIBgIAJAAAACAAIAQgCAIAAAABAAQAAAAAAAAAAgAECBAAAAAAAAAAAAAA6AQAIAIBggBAAgAAAAADkAQgOwCAFAQAAAAAAAAAAAAACkCCYCxJQEAABAAAAAAAAAAAAAJBKJxbG/rs=ACT90oEaiyiS4RoDAnQw5r8UJKy_tlb-dg HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.DstIhYEqY00.O/ck=xjs.hd.8L4846zfxoM.L.W.O/am=cAEAAAAAAMAAAAAAAAAAAAAAAAAAgAAAAgAAAAAkgH7CAQrAhiAAAEAAgMAQACAAIACLAEgEBCAIABgAQhCAhzIBgZAJCIAACSAJQQ4CAIhgAgFSAYABAAAAIAEAgAECBhAwAAHAQwQAAAQ6AQEoAIBkgBAAgAAAAADkAQgOwCAFAQAAAAAAAAAAAAACkCCYCxJQEAABAAAAAAAAAAAAAJBKJxbG/d=1/exm=SNUn3,cEt90b,cdos,csi,d,dtl0hd,eHDfl,hsm,jsa,mb4ZUb,qddgKe,sTsDMc/ed=1/dg=2/br=1/ujg=1/rs=ACT90oEYGSwh0z5eGAX-FOg445Y0zifOZQ/ee=ALeJib:B8gLwd;AfeaP:TkrAjf;Afksuc:wMx0R;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DM55c:imLrKe;DULqB:RKfG5c;Dkk6ge:wJqrrd;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;Erl4fe:FloWmf;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;HqeXPd:cmbnH;IBADCc:RYquRb;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KeeMUb:HiPxjc;KpRAue:Tia57b;LBgRLc:XVMNvd;LEikZe:byfTOb,lsjVmc;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;Oj465e:KG2eXe;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;Q1Ow7b:x5CSu;Q6C5kf:pfdZCe;QGR0gd:Mlhmy;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO;SNUn3:ZwDk9d,x8cHvb;ShpF6e:N0pvGc;TxfV6d:YORN0b;U96pRd:FsR04;UDrY1c:eps46d;UVmjEd:EesRsb;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YV5bee:IvPZ6d;YkQtAf:rx8ur;ZMvdv:PHFPjb;ZWEUA:afR4Cf;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aZ61od:arTwJ;bDXwRe:UsyOtc;bFZ6gf:RsDQqe;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;daB6be:lMxGPd;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:VruDBd;eHDfl:ofjVkb;eO3lse:nFClrf;fWLTFc:TVBJbf;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;heHB1:sFczq;hjRo6e:F62sG;hsLsYc:Vl118;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;io8t5d:sgY6Zb;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kMFpHd:OTA3Ae;kbAm9d:MkHyGd;lkq0A:JyBE3e;nAFL3:NTMZac,s39S4;oGtAuc:sOXFj;oSUNyd:fTfGO;oUlnpc:RagDlc;okUaUd:wItadb;p2tIDb:tp1Cx;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:mg5CW;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;sP4Vbe:VwDzFe;sTsDMc:kHVSUb;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uY49fb:COQbmf;uuQkY:u2V3ud;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:TtcOte;wV5Pjc:L8KGxe;whEZac:F4AmNb;xBbsrc:NEW1Qc;yGxLoc:FmAr0c;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=B2qlPe,DhPYme,GU4Gab,MpJwZc,NzU6V,UUJqVe,Wo3n8,aa,abd,async,epYOx,ifl,ms4mZb,pHXghd,q0xTif,s39S4,sOXFj,sb_wiz,sf,sonic,spch?xjs=s1 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version:
Source: global traffic	HTTP traffic detected: GET /client_204?atyp=i&biw=1280&bih=907&ei=ucYeZoqbAcTckPIP6uKXyAE&opi=89978449 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.dCBC8e6ENbg.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo8oB7UmguRctpg6togRivSNxNKjzQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs
Source: global traffic	HTTP traffic detected: GET /complete/search?q&cp=0&client=gws-wiz&xssi=t&gs_pcrt=2&hl=en&authuser=0&psi=ucYeZoqbAcTckPIP6uKXyAE.1713292985568&dpr=1&nolsbt=1 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs
Source: global traffic	HTTP traffic detected: GET /images/hpp/ic_wahlberg_product_core_48.png8.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ogs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/md=3/k=xjs.hd.en.DstIhYEqY00.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAkgAIAAAoAACAAAAAAgMAQACAAIACLAEgEBCAIABgAQhCAhzIBgIAJAAAACAAIAQgCAIAAAABAAQAAAAAAAAAAgAECBAAAAAAAAAAAAAA6AQAIAIBggBAAgAAAAADkAQgOwCAFAQAAAAAAAAAAAAACkCCYCxJQEAABAAAAAAAAAAAAAJBKJxbG/rs=ACT90oEaiyiS4RoDAnQw5r8UJKy_tlb-dg HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs; OGPC=19037049-1:
Source: global traffic	HTTP traffic detected: GET /xjs/_/ss/k=xjs.hd.8L4846zfxoM.L.W.O/am=cAEAAAAAAMAAAAAAAAAAAAAAAAAAgAAAAgAAAAAgAHzCAQLAhgAAAEAAAIAAACAAAACCAAAAACAIABgAABAAAAAAgRAACIAACSAJQQYCAIhgAgFSAYABAAAAIAEAAAACAhAwAAHAQwQAAAQ6AQEgAABkgBAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABQAAAAAAAAAAAAAAAAAAAC/d=0/dg=2/br=1/rs=ACT90oHfcSzw4WMS-4IUcR0A8_PbW5cCEQ/m=syk1?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs; OGPC=19037049-1:
Source: global traffic	HTTP traffic detected: GET /images/hpp/ic_wahlberg_product_core_48.png8.png HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs; OGPC=19037049-1:
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.DstIhYEqY00.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAkgAIAAAoAACAAAAAAgMAQACAAIACLAEgEBCAIABgAQhCAhzIBgIAJAAAACAAIAQgCAIAAAABAAQAAAAAAAAAAgAECBAAAAAAAAAAAAAA6AQAIAIBggBAAgAAAAADkAQgOwCAFAQAAAAAAAAAAAAACkCCYCxJQEAABAAAAAAAAAAAAAJBKJxbG/d=0/dg=2/br=1/rs=ACT90oEaiyiS4RoDAnQw5r8UJKy_tlb-dg/m=sy18y,P10Owf,syo5,sy17k,sy17m,gSZvdb,sytl,sytr,syts,WlNQGd,syo3,syu9,syub,nabPbb,syo4,syo6,syo7,syo8,syoa,DPreE,syk1,sytk,sytm,CnSW2d,kQvlef,syua,fXO0xe?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs; OGPC=19037049-1:
Source: global traffic	HTTP traffic detected: GET /client_204?cs=1&opi=89978449 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs; OGPC=19037049-1:
Source: global traffic	HTTP traffic detected: GET /async/hpba?vet=10ahUKEwjK25LesceFAxVELkQIHWrxBRkQj-0KCB0..i&ei=ucYeZoqbAcTckPIP6uKXyAE&opi=89978449&yv=3&cs=0&async=isImageHp:false,_ck:xjs.hd.8L4846zfxoM.L.W.O,_k:xjs.hd.en.DstIhYEqY00.O,_am:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAkgAIAAAoAACAAAAAAgMAQACAAIACLAEgEBCAIABgAQhCAhzIBgIAJAAAACAAIAQgCAIAAAABAAQAAAAAAAAAAgAECBAAAAAAAAAAAAAA6AQAIAIBggBAAgAAAAADkAQgOwCAFAQAAAAAAAAAAAAACkCCYCxJQEAABAAAAAAAAAAAAAJBKJxbG,_cssam:cAEAAAAAAMAAAAAAAAAAAAAAAAAAgAAAAgAAAAAgAHzCAQLAhgAAAEAAAIAAACAAAACCAAAAACAIABgAABAAAAAAgRAACIAACSAJQQYCAIhgAgFSAYABAAAAIAEAAAACAhAwAAHAQwQAAAQ6AQEgAABkgBAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABQAAAAAAAAAAAAAAAAAAAC,_csss:ACT90oHfcSzw4WMS-4IUcR0A8_PbW5cCEQ,_fmt:prog,_id:a3JU5b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs; OGPC=19037049-1:
Source: global traffic	HTTP traffic detected: GET /xjs/_/ss/k=xjs.hd.8L4846zfxoM.L.W.O/am=cAEAAAAAAMAAAAAAAAAAAAAAAAAAgAAAAgAAAAAgAHzCAQLAhgAAAEAAAIAAACAAAACCAAAAACAIABgAABAAAAAAgRAACIAACSAJQQYCAIhgAgFSAYABAAAAIAEAAAACAhAwAAHAQwQAAAQ6AQEgAABkgBAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABQAAAAAAAAAAAAAAAAAAAC/d=0/dg=2/br=1/rs=ACT90oHfcSzw4WMS-4IUcR0A8_PbW5cCEQ/m=syk1?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; NID=513=kUhTI4y3AwamEkj16fUK5l5LNvwRaxgl248FqNTBX2OCA4VHCetx-SSwszMbWzI_XyP0Snnlxgopg9De7KusIQri8HxEne1rDgm_U8f4ANnkkDHEm-FIpRTSYJTl1RRpWeME3Bun7EDEuBNnyBNEtE8v7OEOWrVsL1gzCml8JOs; OGPC=19037049-1:
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; OGPC=19037049-1:; NID=513=ijEJ8iXvO4WOudfdMvzTSjoQEGl_umhRb3_F9hC--w_L3ucuasEV8TgnerT3pmGe3iYiM6NQQXRXHzMWctJoj7iSLrJ-MpCRZTlEQpdgvO-CcewakhGcCb4_yPd_tQsCfUSXsUFpIS1qwPgoqrmU5adjCkmtc_gt1TekOAkmKpRIr97I9LIb
Source: global traffic	HTTP traffic detected: GET /async/hpba?vet=10ahUKEwjK25LesceFAxVELkQIHWrxBRkQj-0KCB0..i&ei=ucYeZoqbAcTckPIP6uKXyAE&opi=89978449&yv=3&cs=0&async=isImageHp:false,_ck:xjs.hd.8L4846zfxoM.L.W.O,_k:xjs.hd.en.DstIhYEqY00.O,_am:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAkgAIAAAoAACAAAAAAgMAQACAAIACLAEgEBCAIABgAQhCAhzIBgIAJAAAACAAIAQgCAIAAAABAAQAAAAAAAAAAgAECBAAAAAAAAAAAAAA6AQAIAIBggBAAgAAAAADkAQgOwCAFAQAAAAAAAAAAAAACkCCYCxJQEAABAAAAAAAAAAAAAJBKJxbG,_cssam:cAEAAAAAAMAAAAAAAAAAAAAAAAAAgAAAAgAAAAAgAHzCAQLAhgAAAEAAAIAAACAAAACCAAAAACAIABgAABAAAAAAgRAACIAACSAJQQYCAIhgAgFSAYABAAAAIAEAAAACAhAwAAHAQwQAAAQ6AQEgAABkgBAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABQAAAAAAAAAAAAAAAAAAAC,_csss:ACT90oHfcSzw4WMS-4IUcR0A8_PbW5cCEQ,_fmt:prog,_id:a3JU5b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; OGPC=19037049-1:; NID=513=fNxDw8P7EY8wHYXimEoQOtGHBccNNCw3t5kWzc0Lt-f9voqVRwoO0OEFA10IU_vxH4Ol2l3E2iL03YgjrLGVMBxlZg9VIxXXmSk66BeE9F2r5kMYpTjIOgfeO13B-OeVWLCnEgrYZtImF8TNetggxQdR9_mXrWTs6gNHjLYvWu3y09ai_9ao5Jc
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.DstIhYEqY00.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAkgAIAAAoAACAAAAAAgMAQACAAIACLAEgEBCAIABgAQhCAhzIBgIAJAAAACAAIAQgCAIAAAABAAQAAAAAAAAAAgAECBAAAAAAAAAAAAAA6AQAIAIBggBAAgAAAAADkAQgOwCAFAQAAAAAAAAAAAAACkCCYCxJQEAABAAAAAAAAAAAAAJBKJxbG/d=0/dg=2/br=1/rs=ACT90oEaiyiS4RoDAnQw5r8UJKy_tlb-dg/m=syev,aLUfP?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; OGPC=19037049-1:; NID=513=fNxDw8P7EY8wHYXimEoQOtGHBccNNCw3t5kWzc0Lt-f9voqVRwoO0OEFA10IU_vxH4Ol2l3E2iL03YgjrLGVMBxlZg9VIxXXmSk66BeE9F2r5kMYpTjIOgfeO13B-OeVWLCnEgrYZtImF8TNetggxQdR9_mXrWTs6gNHjLYvWu3y09ai_9ao5Jc
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.DstIhYEqY00.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAkgAIAAAoAACAAAAAAgMAQACAAIACLAEgEBCAIABgAQhCAhzIBgIAJAAAACAAIAQgCAIAAAABAAQAAAAAAAAAAgAECBAAAAAAAAAAAAAA6AQAIAIBggBAAgAAAAADkAQgOwCAFAQAAAAAAAAAAAAACkCCYCxJQEAABAAAAAAAAAAAAAJBKJxbG/d=0/dg=2/br=1/rs=ACT90oEaiyiS4RoDAnQw5r8UJKy_tlb-dg/m=kMFpHd,sy8l,bm51tf?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; OGPC=19037049-1:; NID=513=fNxDw8P7EY8wHYXimEoQOtGHBccNNCw3t5kWzc0Lt-f9voqVRwoO0OEFA10IU_vxH4Ol2l3E2iL03YgjrLGVMBxlZg9VIxXXmSk66BeE9F2r5kMYpTjIOgfeO13B-OeVWLCnEgrYZtImF8TNetggxQdR9_mXrWTs6gNHjLYvWu3y09ai_9ao5Jc
Source: global traffic	HTTP traffic detected: GET /gen_204?atyp=i&ct=psnt&cad=&nt=navigate&ei=ucYeZoqbAcTckPIP6uKXyAE&zx=1713292988590&opi=89978449 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; OGPC=19037049-1:; NID=513=fNxDw8P7EY8wHYXimEoQOtGHBccNNCw3t5kWzc0Lt-f9voqVRwoO0OEFA10IU_vxH4Ol2l3E2iL03YgjrLGVMBxlZg9VIxXXmSk66BeE9F2r5kMYpTjIOgfeO13B-OeVWLCnEgrYZtImF8TNetggxQdR9_mXrWTs6gNHjLYvWu3y09ai_9ao5Jc
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; OGPC=19037049-1:; NID=513=gEu1TDO7YSiMoyZbndEGhEbRHf3HLN49nKYaszBeDJTBAUBiYIdJdkjVMuqIvxvOaqW9a9rXSzc0FQErtg_kdPSkcRlX_IXSgXTr0aoZ35zVb3jaPw_SjG5OgqqJOzO_Sc2E9veQUwIlk-S52UIyDmFNJaPkJ9L2hDqHOQGa8DW2Vm_IhXjm5Vd7NJ7CUtE
Source: global traffic	HTTP traffic detected: GET /4pTSD2e?nmOVboGWs HTTP/1.1Host: jembawuk.bru-ray.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7e66d6ead87b3ab9146189a3cb128af7
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; OGPC=19037049-1:; NID=513=gEu1TDO7YSiMoyZbndEGhEbRHf3HLN49nKYaszBeDJTBAUBiYIdJdkjVMuqIvxvOaqW9a9rXSzc0FQErtg_kdPSkcRlX_IXSgXTr0aoZ35zVb3jaPw_SjG5OgqqJOzO_Sc2E9veQUwIlk-S52UIyDmFNJaPkJ9L2hDqHOQGa8DW2Vm_IhXjm5Vd7NJ7CUtE; 1P_JAR=2024-04-16-18
Source: global traffic	HTTP traffic detected: GET /complete/search?q&cp=0&client=gws-wiz&xssi=t&gs_pcrt=2&hl=en&authuser=0&psi=zMYeZoWhOOigkPIPi5WMwAE.1713293004461&dpr=1&nolsbt=1 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; OGPC=19037049-1:; NID=513=gEu1TDO7YSiMoyZbndEGhEbRHf3HLN49nKYaszBeDJTBAUBiYIdJdkjVMuqIvxvOaqW9a9rXSzc0FQErtg_kdPSkcRlX_IXSgXTr0aoZ35zVb3jaPw_SjG5OgqqJOzO_Sc2E9veQUwIlk-S52UIyDmFNJaPkJ9L2hDqHOQGa8DW2Vm_IhXjm5Vd7NJ7CUtE
Source: global traffic	HTTP traffic detected: GET /async/hpba?vet=10ahUKEwiFt9HnsceFAxVoEEQIHYsKAxgQj-0KCB0..i&ei=zMYeZoWhOOigkPIPi5WMwAE&opi=89978449&yv=3&cs=0&async=isImageHp:false,_ck:xjs.hd.8L4846zfxoM.L.W.O,_k:xjs.hd.en.DstIhYEqY00.O,_am:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAkgAIAAAoAACAAAAAAgMAQACAAIACLAEgEBCAIABgAQhCAhzIBgIAJAAAACAAIAQgCAIAAAABAAQAAAAAAAAAAgAECBAAAAAAAAAAAAAA6AQAIAIBggBAAgAAAAADkAQgOwCAFAQAAAAAAAAAAAAACkCCYCxJQEAABAAAAAAAAAAAAAJBKJxbG,_cssam:cAEAAAAAAMAAAAAAAAAAAAAAAAAAgAAAAgAAAAAgAHzCAQLAhgAAAEAAAIAAACAAAACCAAAAACAIABgAABAAAAAAgRAACIAACSAJQQYCAIhgAgFSAYABAAAAIAEAAAACAhAwAAHAQwQAAAQ6AQEgAABkgBAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABQAAAAAAAAAAAAAAAAAAAC,_csss:ACT90oHfcSzw4WMS-4IUcR0A8_PbW5cCEQ,_fmt:prog,_id:a3JU5b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; OGPC=19037049-1:; NID=513=gEu1TDO7YSiMoyZbndEGhEbRHf3HLN49nKYaszBeDJTBAUBiYIdJdkjVMuqIvxvOaqW9a9rXSzc0FQErtg_kdPSkcRlX_IXSgXTr0aoZ35zVb3jaPw_SjG5OgqqJOzO_Sc2E9veQUwIlk-S52UIyDmFNJaPkJ9L2hDqHOQGa8DW2Vm_IhXjm5Vd7NJ7CUtE
Source: global traffic	HTTP traffic detected: GET /client_204?atyp=i&biw=1280&bih=907&dpr=1&ei=zMYeZoWhOOigkPIPi5WMwAE&opi=89978449 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; OGPC=19037049-1:; NID=513=gEu1TDO7YSiMoyZbndEGhEbRHf3HLN49nKYaszBeDJTBAUBiYIdJdkjVMuqIvxvOaqW9a9rXSzc0FQErtg_kdPSkcRlX_IXSgXTr0aoZ35zVb3jaPw_SjG5OgqqJOzO_Sc2E9veQUwIlk-S52UIyDmFNJaPkJ9L2hDqHOQGa8DW2Vm_IhXjm5Vd7NJ7CUtE
Source: global traffic	HTTP traffic detected: GET /async/hpba?vet=10ahUKEwiFt9HnsceFAxVoEEQIHYsKAxgQj-0KCB0..i&ei=zMYeZoWhOOigkPIPi5WMwAE&opi=89978449&yv=3&cs=0&async=isImageHp:false,_ck:xjs.hd.8L4846zfxoM.L.W.O,_k:xjs.hd.en.DstIhYEqY00.O,_am:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAkgAIAAAoAACAAAAAAgMAQACAAIACLAEgEBCAIABgAQhCAhzIBgIAJAAAACAAIAQgCAIAAAABAAQAAAAAAAAAAgAECBAAAAAAAAAAAAAA6AQAIAIBggBAAgAAAAADkAQgOwCAFAQAAAAAAAAAAAAACkCCYCxJQEAABAAAAAAAAAAAAAJBKJxbG,_cssam:cAEAAAAAAMAAAAAAAAAAAAAAAAAAgAAAAgAAAAAgAHzCAQLAhgAAAEAAAIAAACAAAACCAAAAACAIABgAABAAAAAAgRAACIAACSAJQQYCAIhgAgFSAYABAAAAIAEAAAACAhAwAAHAQwQAAAQ6AQEgAABkgBAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABQAAAAAAAAAAAAAAAAAAAC,_csss:ACT90oHfcSzw4WMS-4IUcR0A8_PbW5cCEQ,_fmt:prog,_id:a3JU5b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; OGPC=19037049-1:; NID=513=gEu1TDO7YSiMoyZbndEGhEbRHf3HLN49nKYaszBeDJTBAUBiYIdJdkjVMuqIvxvOaqW9a9rXSzc0FQErtg_kdPSkcRlX_IXSgXTr0aoZ35zVb3jaPw_SjG5OgqqJOzO_Sc2E9veQUwIlk-S52UIyDmFNJaPkJ9L2hDqHOQGa8DW2Vm_IhXjm5Vd7NJ7CUtE
Source: global traffic	HTTP traffic detected: GET /complete/search?q&cp=0&client=gws-wiz&xssi=t&gs_pcrt=2&hl=en&authuser=0&psi=zMYeZoWhOOigkPIPi5WMwAE.1713293004461&dpr=1&nolsbt=1 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; OGPC=19037049-1:; NID=513=gEu1TDO7YSiMoyZbndEGhEbRHf3HLN49nKYaszBeDJTBAUBiYIdJdkjVMuqIvxvOaqW9a9rXSzc0FQErtg_kdPSkcRlX_IXSgXTr0aoZ35zVb3jaPw_SjG5OgqqJOzO_Sc2E9veQUwIlk-S52UIyDmFNJaPkJ9L2hDqHOQGa8DW2Vm_IhXjm5Vd7NJ7CUtE
Source: global traffic	HTTP traffic detected: GET /gen_204?atyp=i&ct=psnt&cad=&nt=navigate&ei=zMYeZoWhOOigkPIPi5WMwAE&zx=1713293005229&opi=89978449 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; OGPC=19037049-1:; NID=513=gEu1TDO7YSiMoyZbndEGhEbRHf3HLN49nKYaszBeDJTBAUBiYIdJdkjVMuqIvxvOaqW9a9rXSzc0FQErtg_kdPSkcRlX_IXSgXTr0aoZ35zVb3jaPw_SjG5OgqqJOzO_Sc2E9veQUwIlk-S52UIyDmFNJaPkJ9L2hDqHOQGa8DW2Vm_IhXjm5Vd7NJ7CUtE
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; GOOGLE_ABUSE_EXEMPTION=ID=d1c1f7cbf6db3c94:TM=1713292983:C=r:IP=81.181.57.52-:S=h96y2G5DpfW5dEiFoBO7LY4; OGPC=19037049-1:; NID=513=gEu1TDO7YSiMoyZbndEGhEbRHf3HLN49nKYaszBeDJTBAUBiYIdJdkjVMuqIvxvOaqW9a9rXSzc0FQErtg_kdPSkcRlX_IXSgXTr0aoZ35zVb3jaPw_SjG5OgqqJOzO_Sc2E9veQUwIlk-S52UIyDmFNJaPkJ9L2hDqHOQGa8DW2Vm_IhXjm5Vd7NJ7CUtE; 1P_JAR=2024-04-16-18

Source: unknown

DNS traffic detected: queries for: jembawuk.bru-ray.com

Source: unknown

HTTP traffic detected: POST /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 7776sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-protobufferAccept: */*Origin: https://www.google.comX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-16-18; AEC=AQTF6HwxPXmNnu7Pqq2O38x6HhGI_ITNH_2sbtDIcNi11TMX47WGAqkmoz0; NID=513=UwHHOwkwkVkdSZoEWO7sDWEZd6utXDMOdagZu9h-E3aqoz4XATNoRWzEVFC8VsZBuoe8SFk-KO981Q4D--UtpYN12EgCuVPUqbqfxqJBfrx0gMbwu4hyjMqsf8mAO7A6kPBqj1b1RFeGFA2ZGvdKl10wHQgj-VWrdAkgPOIXicI

Source: chromecache_199.16.dr	String found in binary or memory: http://schema.org/WebPage
Source: chromecache_184.16.dr, chromecache_203.16.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_192.16.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_192.16.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_183.16.dr	String found in binary or memory: https://accounts.google.com/signin/v2/identifier%3Fec%3Dfutura_hpp_co_si_001_p%26continue%3Dhttps%25
Source: chromecache_184.16.dr, chromecache_203.16.dr, chromecache_199.16.dr, chromecache_192.16.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_210.16.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: f6568e70-f7a7-4df8-9de7-ad6357f7d4e0.tmp.3.dr, c0668cc5-9778-4cc1-bd3d-07c09685c35d.tmp.3.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: chromecache_192.16.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_236.16.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_236.16.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_219.16.dr	String found in binary or memory: https://content-push.googleapis.com/upload/
Source: chromecache_192.16.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_192.16.dr	String found in binary or memory: https://csp.withgoogle.com/csp/lcreport/
Source: chromecache_236.16.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_236.16.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_236.16.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_192.16.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_219.16.dr	String found in binary or memory: https://embeddedassistant-webchannel.googleapis.com/google.assistant.embedded.v1.EmbeddedAssistant/A
Source: chromecache_184.16.dr, chromecache_203.16.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_184.16.dr, chromecache_203.16.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_184.16.dr, chromecache_203.16.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_184.16.dr, chromecache_203.16.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_212.16.dr	String found in binary or memory: https://lens.google.com
Source: chromecache_219.16.dr	String found in binary or memory: https://lens.google.com/gen204
Source: chromecache_183.16.dr	String found in binary or memory: https://ogs.google.com/
Source: chromecache_199.16.dr	String found in binary or memory: https://ogs.google.com/widget/app/so?awwd=1
Source: chromecache_183.16.dr	String found in binary or memory: https://ogs.google.com/widget/callout
Source: chromecache_189.16.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_192.16.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_192.16.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_219.16.dr	String found in binary or memory: https://push.clients6.google.com/upload/
Source: chromecache_236.16.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_183.16.dr	String found in binary or memory: https://ssl.gstatic.com
Source: chromecache_182.16.dr, chromecache_193.16.dr	String found in binary or memory: https://ssl.gstatic.com/images/icons/material/system/1x/done_black_16dp.png)
Source: chromecache_182.16.dr, chromecache_193.16.dr	String found in binary or memory: https://ssl.gstatic.com/ui/v1/menu/checkmark2.png)
Source: chromecache_219.16.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_236.16.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_236.16.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_236.16.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_236.16.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_212.16.dr	String found in binary or memory: https://support.google.com/websearch/answer/106230
Source: chromecache_212.16.dr, chromecache_210.16.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_192.16.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_183.16.dr, chromecache_203.16.dr	String found in binary or memory: https://www.google.com
Source: chromecache_183.16.dr	String found in binary or memory: https://www.google.com"
Source: chromecache_183.16.dr	String found in binary or memory: https://www.google.com/images/hpp/ic_wahlberg_product_core_48.png8.png
Source: chromecache_199.16.dr	String found in binary or memory: https://www.google.com/intl/en/about/products
Source: chromecache_212.16.dr, chromecache_210.16.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: chromecache_205.16.dr, chromecache_236.16.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_219.16.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_183.16.dr	String found in binary or memory: https://www.google.com/url?q
Source: chromecache_183.16.dr	String found in binary or memory: https://www.google.com/url?q=https://accounts.google.com/signin/v2/identifier%3Fec%3Dfutura_hpp_co_s
Source: chromecache_192.16.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_192.16.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_236.16.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__.
Source: chromecache_183.16.dr	String found in binary or memory: https://www.gstatic.com
Source: chromecache_183.16.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.kIS1Dzh9gxA.
Source: chromecache_184.16.dr, chromecache_203.16.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_184.16.dr, chromecache_203.16.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_184.16.dr, chromecache_203.16.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chromecache_203.16.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chromecache_184.16.dr, chromecache_203.16.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chromecache_199.16.dr	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.oT1FwJRCVC4.2019.O/rt=j/m=qabr
Source: chromecache_199.16.dr	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.T5bVtXo12IQ.L.W.O/m=qcwid/excm=qaaw
Source: chromecache_220.16.dr, chromecache_205.16.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js
Source: chromecache_219.16.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49716 version: TLS 1.2

System Summary

Source: classification engine

Classification label: clean2.winPDF@38/154@16/10

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6284

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-16 20-41-39-285.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Refund_Document_Protected.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1588,i,1831920794384916685,15405165945631162394,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://funded-service.shantishamdasani.com/?nmOVboGWs
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1940,i,624201934020771725,3838327008599335046,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://funded-service.shantishamdasani.com/?nmOVboGWs
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2000,i,328581604167305358,816205230176040333,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://funded-service.shantishamdasani.com/?nmOVboGWs			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://funded-service.shantishamdasani.com/?nmOVboGWs			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1588,i,1831920794384916685,15405165945631162394,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1940,i,624201934020771725,3838327008599335046,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2000,i,328581604167305358,816205230176040333,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior

Source: Google Drive.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: _.ODb=new _.mn;_.ODb.oa=!0;_.PDb=!1; source: chromecache_219.16.dr
Source:	Binary string: 5);case 5:e=g=h.oa;case 4:if(e&&!c){var k=e,l=d&&d.has("ved")?d.get("ved"):"";k=_.z(k.header,1);k=_.tn(k).Kc("sqi","17");l&&k.Kc("refv",l);k.log()}case 2:return h.return({xBa:f,nva:e})}})};var UHb=function(a,b,c){a=Error.call(this,a);this.message=a.message;"stack"in a&&(this.stack=a.stack);a={};this.details=(a.req=b,a.res=c,a)};_.C(UHb,Error);var WHb=!1,$Hb=0;var hIb=function(a){this.Ea=_.n(a)};_.C(hIb,_.q);_.PDb=!0; source: chromecache_219.16.dr
Source:	Binary string: _.$Cb=!!(_.hh[24]&8192);_.aDb=!!(_.hh[24]>>14&1);_.bDb=!!(_.hh[24]>>17&1);_.cDb=!!(_.hh[24]>>18&1);_.dDb=!!(_.hh[24]>>21&1);_.eDb=!!(_.hh[24]>>25&1);_.fDb=!!(_.hh[25]&1);_.gDb=!!(_.hh[25]&128);_.hDb=!!(_.hh[25]&256);_.iDb=!!(_.hh[25]&512);_.jDb=!!(_.hh[25]&1024);_.kDb=!!(_.hh[24]>>15&1);_.lDb=!!(_.hh[24]>>19&1);_.mDb=!!(_.hh[25]&64);_.nDb=!!(_.hh[24]>>23&1);_.oDb=!!(_.hh[24]>>24&1);_.pDb=!!(_.hh[24]>>29&1);_.qDb=!!(_.hh[24]>>27&1);_.rDb=!!(_.hh[25]&16);_.sDb=!!(_.hh[25]&8);_.tDb=!!(_.hh[24]>>16&1); source: chromecache_219.16.dr
Source:	Binary string: oHb=function(){var a,b,c,d,e,f,g,h,k;return _.fh(function(l){if(1==l.ka){a=(0,_.Yb.cast)(window.google.aipf,_.aHa);window.google.aipf={push:function(){_.md(Error("rf"))}};_.mHb={};b=_.Ta(a);for(c=b.next();!c.done;c=b.next())d=c.value,_.mHb[d.id]=d;var p=l.yield;nHb||(_.PDb?nHb=Promise.resolve(_.ODb.Pg()):(_.QDb=new _.Bg,nHb=_.QDb.promise));return p.call(l,nHb,2)}e=l.oa;f=(0,_.Yb.zd)(e.Tjd,"Registered RequestFactory implementation does not support hydrating inline prefetches.");g=_.Ta(a);for(h=g.next();!h.done;h= source: chromecache_219.16.dr
Source:	Binary string: var vdb;_.pdb=function(a){this.Ea=_.n(a)};_.C(_.pdb,_.q);_.qdb=function(a){return _.r(a,_.pdb,3)};_.rdb=function(a){this.Ea=_.n(a)};_.C(_.rdb,_.q);_.sdb=[0,_.G,_.$cb,[0,_.G],_.Gk,[0,_.jk,-1],_.G,-1];_.tdb=[0,_.kdb,_.Gk,_.vk,_.nk];_.udb=[0,_.G,-1,_.Lr,_.G,_.F,_.jk,-1,_.G,[0,_.F,_.jk,_.F]]; source: chromecache_219.16.dr

Source: Refund_Document_Protected.pdf	Initial sample: PDF keyword /JS count = 0
Source: Refund_Document_Protected.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Refund_Document_Protected.pdf

Initial sample: PDF keyword /Encrypt count = 1

Source: Refund_Document_Protected.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Data Obfuscation

Source: Refund_Document_Protected.pdf

Initial sample: PDF keyword /Encrypt

Boot Survival

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior