Windows Analysis Report
http://af.uppromote.com

Overview

General Information

Sample URL:	http://af.uppromote.com
Analysis ID:	1428360
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found iframes

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

Found iframes

Source: https://af.uppromote.com/	HTTP Parser: Iframe src: javascript:false
Source: https://af.uppromote.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-VWZPYDCSKQ&gacid=130039912.1713467925&gtm=45je44f0v894741970za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&z=364272637
Source: https://af.uppromote.com/	HTTP Parser: Iframe src: javascript:false
Source: https://af.uppromote.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-VWZPYDCSKQ&gacid=130039912.1713467925&gtm=45je44f0v894741970za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&z=364272637
Source: https://af.uppromote.com/	HTTP Parser: Iframe src: javascript:false
Source: https://af.uppromote.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-VWZPYDCSKQ&gacid=130039912.1713467925&gtm=45je44f0v894741970za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&z=364272637
Source: https://af.uppromote.com/	HTTP Parser: Iframe src: javascript:false
Source: https://af.uppromote.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-VWZPYDCSKQ&gacid=130039912.1713467925&gtm=45je44f0v894741970za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&z=364272637

HTML body contains low number of good links

Source: https://af.uppromote.com/

HTTP Parser: Number of links: 1

HTML title does not match URL

Source: https://af.uppromote.com/

HTTP Parser: Title: AFFILIATE | Login does not match URL

Source: https://af.uppromote.com/	HTTP Parser: No favicon
Source: https://af.uppromote.com/	HTTP Parser: No favicon
Source: https://af.uppromote.com/	HTTP Parser: No favicon
Source: https://af.uppromote.com/	HTTP Parser: No favicon
Source: https://af.uppromote.com/	HTTP Parser: No favicon
Source: about:blank	HTTP Parser: No favicon

Source: https://af.uppromote.com/	HTTP Parser: No <meta name="author".. found
Source: https://af.uppromote.com/	HTTP Parser: No <meta name="author".. found
Source: https://af.uppromote.com/	HTTP Parser: No <meta name="author".. found
Source: https://af.uppromote.com/	HTTP Parser: No <meta name="author".. found

Source: https://af.uppromote.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://af.uppromote.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://af.uppromote.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://af.uppromote.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49771 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: af.uppromote.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/bootstrap.min.css HTTP/1.1Host: af.uppromote.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InppOEtYM0hPXC8yWFJzMnRvODZrRGhRPT0iLCJ2YWx1ZSI6IkRsckxwSDRBTGtGU1pNUjVWdldIZjZvbTBiSXFJWVE2TUgzK0pKcXRiTitab0JRZGNHMWZVK2o4R2JDNHo2SkEiLCJtYWMiOiI0NWY1NGFkMWI1NzBhMmZhMjQ1N2JlZjIzMTA1M2Y0YmFiYjc1Njk2Y2FlYmJhOWZiMDRkYTNkOTFmNzQwYzhjIn0%3D; laravel_session=eyJpdiI6ImhseUNxSzk2UWZQRFBLYzhkZTJwUFE9PSIsInZhbHVlIjoiam9OK2RRa2xmSUlqbWZTeEZJc2hLUVZRS2c2S3AwT1FIaU5aZHQ1UU1sYjJIZlMzQWdVWDl3OVRwZU52bWR0QmhvRVgrOW9qeVA0QmtKTVBpdjVwMWdaa3FuWkxCeU1CSEVZaXRYRzM4MTIwMlhxWlwvbVZURk5kYVJxQXZnVmk4IiwibWFjIjoiNzMxYjMyNDVlYjE2NjEwYTFiN2ZiM2ZlZWQ4N2VlNWFkYjE2MzE2ODI2MWEzNDg3YzA3MTNlYWQ1YmRlNWZiOSJ9
Source: global traffic	HTTP traffic detected: GET /css/animate.css HTTP/1.1Host: af.uppromote.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InppOEtYM0hPXC8yWFJzMnRvODZrRGhRPT0iLCJ2YWx1ZSI6IkRsckxwSDRBTGtGU1pNUjVWdldIZjZvbTBiSXFJWVE2TUgzK0pKcXRiTitab0JRZGNHMWZVK2o4R2JDNHo2SkEiLCJtYWMiOiI0NWY1NGFkMWI1NzBhMmZhMjQ1N2JlZjIzMTA1M2Y0YmFiYjc1Njk2Y2FlYmJhOWZiMDRkYTNkOTFmNzQwYzhjIn0%3D; laravel_session=eyJpdiI6ImhseUNxSzk2UWZQRFBLYzhkZTJwUFE9PSIsInZhbHVlIjoiam9OK2RRa2xmSUlqbWZTeEZJc2hLUVZRS2c2S3AwT1FIaU5aZHQ1UU1sYjJIZlMzQWdVWDl3OVRwZU52bWR0QmhvRVgrOW9qeVA0QmtKTVBpdjVwMWdaa3FuWkxCeU1CSEVZaXRYRzM4MTIwMlhxWlwvbVZURk5kYVJxQXZnVmk4IiwibWFjIjoiNzMxYjMyNDVlYjE2NjEwYTFiN2ZiM2ZlZWQ4N2VlNWFkYjE2MzE2ODI2MWEzNDg3YzA3MTNlYWQ1YmRlNWZiOSJ9
Source: global traffic	HTTP traffic detected: GET /css/style.css HTTP/1.1Host: af.uppromote.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InppOEtYM0hPXC8yWFJzMnRvODZrRGhRPT0iLCJ2YWx1ZSI6IkRsckxwSDRBTGtGU1pNUjVWdldIZjZvbTBiSXFJWVE2TUgzK0pKcXRiTitab0JRZGNHMWZVK2o4R2JDNHo2SkEiLCJtYWMiOiI0NWY1NGFkMWI1NzBhMmZhMjQ1N2JlZjIzMTA1M2Y0YmFiYjc1Njk2Y2FlYmJhOWZiMDRkYTNkOTFmNzQwYzhjIn0%3D; laravel_session=eyJpdiI6ImhseUNxSzk2UWZQRFBLYzhkZTJwUFE9PSIsInZhbHVlIjoiam9OK2RRa2xmSUlqbWZTeEZJc2hLUVZRS2c2S3AwT1FIaU5aZHQ1UU1sYjJIZlMzQWdVWDl3OVRwZU52bWR0QmhvRVgrOW9qeVA0QmtKTVBpdjVwMWdaa3FuWkxCeU1CSEVZaXRYRzM4MTIwMlhxWlwvbVZURk5kYVJxQXZnVmk4IiwibWFjIjoiNzMxYjMyNDVlYjE2NjEwYTFiN2ZiM2ZlZWQ4N2VlNWFkYjE2MzE2ODI2MWEzNDg3YzA3MTNlYWQ1YmRlNWZiOSJ9
Source: global traffic	HTTP traffic detected: GET /npm/slick-carousel@1.8.1/slick/slick.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/slick-carousel@1.8.1/slick/slick-theme.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /affbootstrap/css/aff-style.css HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/merchant/auth/auth.min.css HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/jquery-3.1.1.min.js HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/merchant/auth/login_left_side.png HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/merchant/auth/right_side_bg.png HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/merchant/auth/logo_with_text.png HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bootstrap.min.js HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/plugins/slick/1.8.1/slick.min.js HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/merchant/auth/login_register.min.js HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/merchant/auth/logo_with_text.png HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/merchant/auth/right_side_bg.png HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/merchant/auth/login_left_side.png HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/slick-carousel@1.8.1/slick/ajax-loader.gif HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick-theme.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/slick-carousel@1.8.1/slick/fonts/slick.woff HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://af.uppromote.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick-theme.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /embeddable_framework/main.js HTTP/1.1Host: assets.zendesk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/slick-carousel@1.8.1/slick/ajax-loader.gif HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ekr/asset_composer.js HTTP/1.1Host: static.zdassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/ga/rul?tid=G-VWZPYDCSKQ&gacid=130039912.1713467925&gtm=45je44f0v894741970za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&z=364272637 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /compose/web_widget/secomapp.zendesk.com HTTP/1.1Host: ekr.zdassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://af.uppromote.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-53113273-27&cid=130039912.1713467925&jid=1329057363&gjid=2076597767&_gid=1443929882.1713467925&_u=YEBAAUAAAAAAACAAI~&z=1669976494 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-53113273-27&cid=130039912.1713467925&jid=1329057363&_u=YEBAAUAAAAAAACAAI~&z=152713507 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web_widget/classic/latest/web-widget-main-7bc1c0f.js HTTP/1.1Host: static.zdassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /compose/web_widget/secomapp.zendesk.com HTTP/1.1Host: ekr.zdassets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: af.uppromote.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InppOEtYM0hPXC8yWFJzMnRvODZrRGhRPT0iLCJ2YWx1ZSI6IkRsckxwSDRBTGtGU1pNUjVWdldIZjZvbTBiSXFJWVE2TUgzK0pKcXRiTitab0JRZGNHMWZVK2o4R2JDNHo2SkEiLCJtYWMiOiI0NWY1NGFkMWI1NzBhMmZhMjQ1N2JlZjIzMTA1M2Y0YmFiYjc1Njk2Y2FlYmJhOWZiMDRkYTNkOTFmNzQwYzhjIn0%3D; laravel_session=eyJpdiI6ImhseUNxSzk2UWZQRFBLYzhkZTJwUFE9PSIsInZhbHVlIjoiam9OK2RRa2xmSUlqbWZTeEZJc2hLUVZRS2c2S3AwT1FIaU5aZHQ1UU1sYjJIZlMzQWdVWDl3OVRwZU52bWR0QmhvRVgrOW9qeVA0QmtKTVBpdjVwMWdaa3FuWkxCeU1CSEVZaXRYRzM4MTIwMlhxWlwvbVZURk5kYVJxQXZnVmk4IiwibWFjIjoiNzMxYjMyNDVlYjE2NjEwYTFiN2ZiM2ZlZWQ4N2VlNWFkYjE2MzE2ODI2MWEzNDg3YzA3MTNlYWQ1YmRlNWZiOSJ9; _gid=GA1.2.1443929882.1713467925; _gat_gtag_UA_53113273_27=1; _ga=GA1.1.130039912.1713467925; _ga_VWZPYDCSKQ=GS1.1.1713467924.1.0.1713467924.60.0.0
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-53113273-27&cid=130039912.1713467925&jid=1329057363&_u=YEBAAUAAAAAAACAAI~&z=152713507 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: af.uppromote.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InppOEtYM0hPXC8yWFJzMnRvODZrRGhRPT0iLCJ2YWx1ZSI6IkRsckxwSDRBTGtGU1pNUjVWdldIZjZvbTBiSXFJWVE2TUgzK0pKcXRiTitab0JRZGNHMWZVK2o4R2JDNHo2SkEiLCJtYWMiOiI0NWY1NGFkMWI1NzBhMmZhMjQ1N2JlZjIzMTA1M2Y0YmFiYjc1Njk2Y2FlYmJhOWZiMDRkYTNkOTFmNzQwYzhjIn0%3D; laravel_session=eyJpdiI6ImhseUNxSzk2UWZQRFBLYzhkZTJwUFE9PSIsInZhbHVlIjoiam9OK2RRa2xmSUlqbWZTeEZJc2hLUVZRS2c2S3AwT1FIaU5aZHQ1UU1sYjJIZlMzQWdVWDl3OVRwZU52bWR0QmhvRVgrOW9qeVA0QmtKTVBpdjVwMWdaa3FuWkxCeU1CSEVZaXRYRzM4MTIwMlhxWlwvbVZURk5kYVJxQXZnVmk4IiwibWFjIjoiNzMxYjMyNDVlYjE2NjEwYTFiN2ZiM2ZlZWQ4N2VlNWFkYjE2MzE2ODI2MWEzNDg3YzA3MTNlYWQ1YmRlNWZiOSJ9; _gid=GA1.2.1443929882.1713467925; _gat_gtag_UA_53113273_27=1; _ga=GA1.1.130039912.1713467925; _ga_VWZPYDCSKQ=GS1.1.1713467924.1.0.1713467924.60.0.0
Source: global traffic	HTTP traffic detected: GET /web_widget/classic/latest/web-widget-locales/classic/en-us-json-7bc1c0f.js HTTP/1.1Host: static.zdassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /embeddable/config HTTP/1.1Host: secomapp.zendesk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://af.uppromote.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /embeddable/config HTTP/1.1Host: secomapp.zendesk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4azP9xWtRUeNfXy&MD=XhVKEk1h HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgRRtTk0GKPkhbEGIjDXNNgTxoHfWVKTTBihP5c2kHUHsukbzZky06WzqUC1whYr2AOgh-8SrTqeGy3xSDYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4azP9xWtRUeNfXy&MD=XhVKEk1h HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: af.uppromote.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: chromecache_154.1.dr	String found in binary or memory: Math.round(p);v["gtm.videoCurrentTime"]=Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},Hj:function(){e=zb()},od:function(){d()}}};var gc=ia(["data-gtm-yt-inspected-"]),qC=["www.youtube.com","www.youtube-nocookie.com"],rC,sC=!1; equals www.youtube.com (Youtube)
Source: chromecache_154.1.dr	String found in binary or memory: e\|\|f\|\|g.length\|\|h.length))return;var n={Sg:d,Qg:e,Rg:f,Ch:g,Dh:h,we:m,zb:b},p=D.YT,q=function(){yC(n)};if(p)return p.ready&&p.ready(q),b;var r=D.onYouTubeIframeAPIReady;D.onYouTubeIframeAPIReady=function(){r&&r();q()};I(function(){for(var t=G.getElementsByTagName("script"),u=t.length,v=0;v<u;v++){var w=t[v].getAttribute("src");if(BC(w,"iframe_api")\|\|BC(w,"player_api"))return b}for(var x=G.getElementsByTagName("iframe"),y=x.length,B=0;B<y;B++)if(!sC&&zC(x[B],n.we))return Lc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: af.uppromote.com

Source: unknown

HTTP traffic detected: POST /g/collect?v=2&tid=G-VWZPYDCSKQ&gtm=45je44f0v894741970za200&_p=1713467923933&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=130039912.1713467925&ul=en-us&sr=1280x1024&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&pscdl=noapi&_eu=AAAI&_s=1&sid=1713467924&sct=1&seg=0&dl=https%3A%2F%2Faf.uppromote.com%2F&dt=AFFILIATE%20%7C%20Login&en=page_view&_fv=1&_ss=1&tfd=3693 HTTP/1.1Host: analytics.google.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://af.uppromote.comX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_147.1.dr	String found in binary or memory: http://af.secomapp.com/
Source: chromecache_155.1.dr	String found in binary or memory: http://daneden.me/animate
Source: chromecache_161.1.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_154.1.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: chromecache_154.1.dr	String found in binary or memory: https://adservice.googlesyndication.com/pagead/regclk
Source: chromecache_143.1.dr	String found in binary or memory: https://af.uppromote.com/
Source: chromecache_143.1.dr	String found in binary or memory: https://af.uppromote.com/css/animate.css
Source: chromecache_143.1.dr	String found in binary or memory: https://af.uppromote.com/css/bootstrap.min.css
Source: chromecache_143.1.dr	String found in binary or memory: https://af.uppromote.com/css/style.css
Source: chromecache_143.1.dr	String found in binary or memory: https://af.uppromote.com/login
Source: chromecache_144.1.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_143.1.dr	String found in binary or memory: https://assets.zendesk.com/embeddable_framework/main.js
Source: chromecache_154.1.dr, chromecache_139.1.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_143.1.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/slick-carousel
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/affbootstrap/css/aff-style.css
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/css/merchant/auth/auth.min.css
Source: chromecache_133.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/css/patterns/3.png
Source: chromecache_133.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/css/patterns/4.png
Source: chromecache_133.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/css/patterns/header-profile-skin-1.png
Source: chromecache_133.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/css/patterns/header-profile-skin-3.png
Source: chromecache_133.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/css/patterns/header-profile.png
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/img/merchant/auth/login_left_side.png
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/img/merchant/auth/logo_with_text.png
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/img/merchant/auth/right_side_bg.png
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/js/bootstrap.min.js
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/js/jquery-3.1.1.min.js
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/js/merchant/auth/login_register.min.js
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/js/plugins/slick/1.8.1/slick.min.js
Source: chromecache_135.1.dr	String found in binary or memory: https://developer.zendesk.com/documentation/classic-web-widget-sdks/web-widget/getting-started/legal
Source: chromecache_145.1.dr, chromecache_148.1.dr	String found in binary or memory: https://ekr.zendesk.com/compose_product/web_widget/7bc1c0f290501106fa41dc515076261e2325fb83?features
Source: chromecache_166.1.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_166.1.dr	String found in binary or memory: https://fontawesome.com/license
Source: chromecache_143.1.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Poppins:ital
Source: chromecache_133.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: chromecache_133.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: chromecache_132.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLCz7Z1JlFc-K.woff2)
Source: chromecache_132.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2)
Source: chromecache_132.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2)
Source: chromecache_132.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJnecmNE.woff2)
Source: chromecache_132.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v21/pxiGyp8kv8JHgFVrJJLucHtA.woff2)
Source: chromecache_132.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v21/pxiGyp8kv8JHgFVrJJLufntAKPY.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_155.1.dr	String found in binary or memory: https://github.com/nickpettit/glide
Source: chromecache_133.1.dr	String found in binary or memory: https://github.com/onokumus/metisMenu
Source: chromecache_154.1.dr, chromecache_139.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_154.1.dr, chromecache_139.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_143.1.dr	String found in binary or memory: https://pro.fontawesome.com/releases/v5.15.1/css/all.css
Source: chromecache_145.1.dr, chromecache_148.1.dr	String found in binary or memory: https://static.zdassets.com/web_widget/classic/latest/web-widget-main-7bc1c0f.js
Source: chromecache_154.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_154.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: chromecache_144.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_144.1.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_154.1.dr, chromecache_139.1.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_139.1.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_144.1.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_144.1.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_144.1.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_154.1.dr, chromecache_139.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_144.1.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_154.1.dr, chromecache_139.1.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_154.1.dr, chromecache_139.1.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_144.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_143.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-53113273-27
Source: chromecache_154.1.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_154.1.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49771 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@15/85@42/17

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://af.uppromote.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1956,i,5459667013927682966,7205913079346083900,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1956,i,5459667013927682966,7205913079346083900,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
108.139.16.113	d1639lhkj5l89m.cloudfront.net	United States	16509	AMAZON-02US	false
151.101.193.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
142.250.105.157	td.doubleclick.net	United States	15169	GOOGLEUS	false
104.16.51.111	secomapp.zendesk.com	United States	13335	CLOUDFLARENETUS	false
104.18.72.113	ekr.zdassets.com	United States	13335	CLOUDFLARENETUS	false
74.125.138.105	unknown	United States	15169	GOOGLEUS	false
172.253.124.154	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
216.239.36.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
104.16.53.111	unknown	United States	13335	CLOUDFLARENETUS	false
108.138.82.25	unknown	United States	16509	AMAZON-02US	false
142.251.15.156	unknown	United States	15169	GOOGLEUS	false
108.177.122.106	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.18.70.113	static.zdassets.com	United States	13335	CLOUDFLARENETUS	false
64.233.176.103	www.google.com	United States	15169	GOOGLEUS	false
206.189.254.86	af.uppromote.com	United States	14061	DIGITALOCEAN-ASNUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
jsdelivr.map.fastly.net	151.101.193.229	true
static.zdassets.com	104.18.70.113	true
analytics-alv.google.com	216.239.36.181	true
d1639lhkj5l89m.cloudfront.net	108.139.16.113	true
cf.zdassets.com	104.18.70.113	true
secomapp.zendesk.com	104.16.51.111	true
ekr.zdassets.com	104.18.72.113	true
td.doubleclick.net	142.250.105.157	true
www.google.com	64.233.176.103	true
af.uppromote.com	206.189.254.86	true
stats.g.doubleclick.net	172.253.124.154	true
assets.zendesk.com	unknown	unknown
cdn.jsdelivr.net	unknown	unknown
analytics.google.com	unknown	unknown
pro.fontawesome.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://af.uppromote.com/css/bootstrap.min.css	false	unknown
https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/fonts/slick.woff	false	high
https://d1639lhkj5l89m.cloudfront.net/js/merchant/auth/login_register.min.js	false	high
https://ekr.zdassets.com/compose/web_widget/secomapp.zendesk.com	false	high
https://af.uppromote.com/css/animate.css	false	unknown
https://d1639lhkj5l89m.cloudfront.net/css/merchant/auth/auth.min.css	false	high
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-53113273-27&cid=130039912.1713467925&jid=1329057363&_u=YEBAAUAAAAAAACAAI~&z=152713507	false	high
https://secomapp.zendesk.com/embeddable/config	false	high
https://d1639lhkj5l89m.cloudfront.net/img/merchant/auth/right_side_bg.png	false	high
https://static.zdassets.com/web_widget/classic/latest/web-widget-main-7bc1c0f.js	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgRRtTk0GKPkhbEGIjDXNNgTxoHfWVKTTBihP5c2kHUHsukbzZky06WzqUC1whYr2AOgh-8SrTqeGy3xSDYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://d1639lhkj5l89m.cloudfront.net/img/merchant/auth/logo_with_text.png	false	high
about:blank	false	low
https://analytics.google.com/g/collect?v=2&tid=G-VWZPYDCSKQ&gtm=45je44f0v894741970za200&_p=1713467923933&gcd=13l3l3l3l1&npa=0&dma=0&cid=130039912.1713467925&ul=en-us&sr=1280x1024&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&pscdl=noapi&_eu=AEAI&_s=2&sid=1713467924&sct=1&seg=0&dl=https%3A%2F%2Faf.uppromote.com%2F&dt=AFFILIATE%20%7C%20Login&en=scroll&epn.percent_scrolled=90&_et=12&tfd=8717	false	high
https://af.uppromote.com/favicon.ico	false	unknown
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-53113273-27&cid=130039912.1713467925&jid=1329057363&gjid=2076597767&_gid=1443929882.1713467925&_u=YEBAAUAAAAAAACAAI~&z=1669976494	false	high
https://d1639lhkj5l89m.cloudfront.net/js/bootstrap.min.js	false	high
https://af.uppromote.com/	false	unknown
https://static.zdassets.com/ekr/asset_composer.js	false	high
https://d1639lhkj5l89m.cloudfront.net/affbootstrap/css/aff-style.css	false	high
https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick.css	false	high
https://static.zdassets.com/web_widget/classic/latest/web-widget-locales/classic/en-us-json-7bc1c0f.js	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://d1639lhkj5l89m.cloudfront.net/js/jquery-3.1.1.min.js	false	high
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-VWZPYDCSKQ&cid=130039912.1713467925&gtm=45je44f0v894741970za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0	false	high
https://af.uppromote.com/css/style.css	false	unknown
https://d1639lhkj5l89m.cloudfront.net/js/plugins/slick/1.8.1/slick.min.js	false	high
https://d1639lhkj5l89m.cloudfront.net/img/merchant/auth/login_left_side.png	false	high
http://af.uppromote.com/	false	unknown
https://td.doubleclick.net/td/ga/rul?tid=G-VWZPYDCSKQ&gacid=130039912.1713467925&gtm=45je44f0v894741970za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&z=364272637	false	high
https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/ajax-loader.gif	false	high
https://analytics.google.com/g/collect?v=2&tid=G-VWZPYDCSKQ&gtm=45je44f0v894741970za200&_p=1713467923933&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=130039912.1713467925&ul=en-us&sr=1280x1024&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&pscdl=noapi&_eu=AAAI&_s=1&sid=1713467924&sct=1&seg=0&dl=https%3A%2F%2Faf.uppromote.com%2F&dt=AFFILIATE%20%7C%20Login&en=page_view&_fv=1&_ss=1&tfd=3693	false	high
https://assets.zendesk.com/embeddable_framework/main.js	false	high
https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick-theme.css	false	high

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 18:18:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	AA5E10A761AD6C5D2E9B3FD6C49B7A59	4C00443ED2EB26E66AAB11358AD42D69C7EB37AF	A6355E4A1DBC5FBE7CD837E5E8912ED4922C71493966B78F817E6CA54396032F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 18:18:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6EC036E35C04AFA9FA1E6885F6321CB7	EEDABD6C894B7B64C0528BF20B180C87782B8530	A6C516B2AD3AE30414380E08CC75EAFD60FB2A6567807A45AE6B962667DE8BA8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7989243C382937815E8ABFA11E212125	D35407BC0D2B53B6DF301905BD0B0EDB0416EE6B	0C34C9D8ECBA4D0C71D15591B746AE711001D7AD4E517EBDCBF0B41FBED48847
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 18:18:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	10432F1825238462D7F701E1B0CE4CB0	BDA1B60DD13E4C4AE7DFB631C07405CB7701E1E6	5D96E1333FAAE7547BBAC3B0CE25D0B3EDF3A9BCC38491068414BE747C0B8F49
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 18:18:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	67058387FE9A7512B99EAB1C5C044446	9D5103A328FEC7B4B8FCD479FC8FAF599DFE8A8D	49C779F67E66DD14F315F044957831A2CAE07408EF551F51F46654C954C4AADA
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 18:18:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	922017028A78F444BDE00E0DF8C156B7	4AD4D585CD936AE267464EECCBAF29188435718E	60E0740CC639F4F3EC6ABC31552CDACCE9CC9A8CBAF3C8D23832C3624B09B762
Chrome Cache Entry: 127	ASCII text, with no line terminators	9B533814759386E5DCE300ADEF1AF644	A5A1BDA8ECDCD410A4937DD9F4DCD49F298789B8	60C0C85FA2AB2EC2A71020A1A09DC6C8DD714EBEF4D188BC4DD2FF203CB76AC4
Chrome Cache Entry: 128	Web Open Font Format (Version 2), TrueType, length 7884, version 1.0	9212F6F9860F9FC6C69B02FEDF6DB8C3	AC6D71B4D5FDD2B3DABC9A06FF6C001E4251DA0B	7D93459D86585BFCDBB7E0376056226ADB25821EE54B96236FE2123E9560929F
Chrome Cache Entry: 129	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	41BBB5A57E551BD81C8F9AD73C95B058	53EF4385E62044966871D37209949B5AB8B17ED3	881F74D0EFE1D85B3FBA4F200A4096612D8284F6644B10AA22EC73D64EF4AA5E
Chrome Cache Entry: 130	ASCII text, with very long lines (32030)	E071ABDA8FE61194711CFC2AB99FE104	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
Chrome Cache Entry: 131	PNG image data, 960 x 1080, 8-bit/color RGBA, non-interlaced	CED9E91EFFA5C50AFC930B2AC4BC2A23	377DEADACDBBAAD71E5AA601187B7871B0D1D28C	3655DBC7F1EFEFBB634D821623799CB477C29975F134685F1F2F205CCF786F52
Chrome Cache Entry: 132	ASCII text	61A63313FE6BF5F778834224A1C01357	C9A43240DFE085C212C319676FD8CFD38AF4552B	894DF9F98F2C26FCC85AC55008D4EB0B9B3440A4603A07BAE1FA85E3D596D43C
Chrome Cache Entry: 133	ASCII text	4D72A707046C864EA151267DB5AF84BB	EF6D3F2DDBF579BCBFBA0DC35219CD77242438DD	DCDF0B14F0A1F012B7EB30042D98F9F597B02A2C40F87CE26D30FC2C767FA8DE
Chrome Cache Entry: 134	Web Open Font Format, CFF, length 1380, version 1.0	B7C9E1E479DE3B53F1E4E30EBAC2403A	AF91C12F0F406A4F801AEB3B398768FE41D8F864	26726BAC4060ABB1226E6CEEBC1336E84930FE7A7AF1B3895A109D067F5B5DCC
Chrome Cache Entry: 135	ASCII text, with very long lines (65307)	3784CF5E1DDD3A68E335F3BB4A5E2FCD	617BEBEE8C2ACFFF41763B25AA8E2B65BDEBC1D3	7F4AC95D1AB40C0D78D98ACF1DA862B901CE896B43F738C7B1731C986A612BF4
Chrome Cache Entry: 136	Unicode text, UTF-8 text	F9FABA678C4D6DCFDDE69E5B11B37A2E	81A434F94F2B1124F3232BB86F2944F82FB23AC0	7ADAF08052C6A6A0F8A0D0055B4F191FD07389FE41C972B69573472B2ECB406A
Chrome Cache Entry: 137	JSON data	F1F4D7C9D026A8CFB6E3C8974B3C7931	F2C5D2B39E47479B0C093A32934A2F9025CBFA34	DAA6CFDB36C7890DC4001517991D263A88A38F935747B804897D25D9CED340A6
Chrome Cache Entry: 138	HTML document, ASCII text, with no line terminators	C83301425B2AD1D496473A5FF3D9ECCA	941EFB7368E46B27B937D34B07FC4D41DA01B002	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
Chrome Cache Entry: 139	ASCII text, with very long lines (1900)	2A1B6A29F50F831BFC7008087E375F54	2C70929F5547C524BFDD8B713BE9AB2D4BFBBDD1	77E7CD61685F3D47A95C6502308F4D75A3A86AEFD08821B1E9A29E46103B165C
Chrome Cache Entry: 140	ASCII text	F38B2DB10E01B1572732A3191D538707	A94A059B3178B4ADEC09E3281ACE2819A30095A4	DE1E399B07289F3B0A8D35142E363E128124A1185770E214E25E58030DAD48E5
Chrome Cache Entry: 141	Web Open Font Format (Version 2), TrueType, length 7816, version 1.0	25B0E113CA7CCE3770D542736DB26368	CB726212D5D525021752A1D8470A0FB593E0C49E	9338E65FC077355C7A87AE0D64CC101E23B9BF8AD78AE65F0F319C857311B526
Chrome Cache Entry: 142	GIF image data, version 89a, 32 x 32	C5CD7F5300576AB4C88202B42F6DED62	7A1AA43614396382BB15E5FDE574D9CDCD21698F	E7B44C86B050FCA766A96DDAC2D0932AF0126DA6F2305280342D909168DCCE6B
Chrome Cache Entry: 143	HTML document, ASCII text, with very long lines (841)	BC89928FCFEE755F2632FACD272EF6FF	84BDFC771C5AE8B6D932F379C73DF8D1F60C074B	0FE33C88C9C54A96B8CCD78178E81E14D15232B8950A594C6F16B253894B58FB
Chrome Cache Entry: 144	ASCII text, with very long lines (2343)	575B5480531DA4D14E7453E2016FE0BC	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
Chrome Cache Entry: 145	JSON data	0D9AAE0D08F45F7F2B7673FCE2AE831A	05DB4F2F8DEF0FD83F657D0AF8DD9CAF6F3F3CA0	F7BD410822025F7A263E9A01D11C71E2C925144BD36AB81A43EBFAE0FB7C8E8A
Chrome Cache Entry: 146	ASCII text	9901D8E86EB3CC0B0EA24D6939D67A3A	235A544A3F9024C6A123CC71D679097D2D7E1C80	D3F4104957E76483ACBA4180738253208FD8D4D81C64931244860514AF502B82
Chrome Cache Entry: 147	assembler source, ASCII text, with very long lines (47558)	0BF371FB4F24B65BB242CFF279B3A2D4	2716C1594AF5050E81E4B5C019944B542B0FD2CE	C75A7E2F976F3A6F98768E31F973C2F4FE382E1A8C8B012C20449BEB2489A938
Chrome Cache Entry: 148	JSON data	0D9AAE0D08F45F7F2B7673FCE2AE831A	05DB4F2F8DEF0FD83F657D0AF8DD9CAF6F3F3CA0	F7BD410822025F7A263E9A01D11C71E2C925144BD36AB81A43EBFAE0FB7C8E8A
Chrome Cache Entry: 149	Web Open Font Format (Version 2), TrueType, length 140996, version 331.-31392	25D740D42658B6E2C293CE7B3322AAC7	41CC9AE4B5DD70FD3988059DFB864F20F99AE371	8B5A3FF47C2413E0BF3DD3BB7899A25AEEF9B390A055847A1185A39AD48A2DA2
Chrome Cache Entry: 150	JSON data	F1F4D7C9D026A8CFB6E3C8974B3C7931	F2C5D2B39E47479B0C093A32934A2F9025CBFA34	DAA6CFDB36C7890DC4001517991D263A88A38F935747B804897D25D9CED340A6
Chrome Cache Entry: 151	PNG image data, 275 x 74, 8-bit/color RGBA, non-interlaced	348CCB1A47A98A15FC0F0A62DF30C6F7	CB45527B54D5933A699370BF04AF8D945198740F	5F6EE6ED726E9F1785A957467DFCBCBF20C6AFAF424B3B7CE2782CA04232B450
Chrome Cache Entry: 152	Web Open Font Format (Version 2), TrueType, length 8668, version 1.0	A242BA0DF3A128A2CAB929A8C45D5056	D70E2C70B21CBB66CD883AE56E2DEDACEFD81C7C	50D0C1742D80AC71F4CDE20E8C04D41A24806AF342831F479938B527FBFF0972
Chrome Cache Entry: 153	PNG image data, 960 x 1080, 8-bit/color RGBA, non-interlaced	CED9E91EFFA5C50AFC930B2AC4BC2A23	377DEADACDBBAAD71E5AA601187B7871B0D1D28C	3655DBC7F1EFEFBB634D821623799CB477C29975F134685F1F2F205CCF786F52
Chrome Cache Entry: 154	ASCII text, with very long lines (7711)	AE56B0239D4FC112CAD494C4A5542115	79A107E6EA4C4B4EC134CCD2346EAB74FC18D754	1533F461F0CCF5A35969837677A5600C0D763808CA95A1CCA0D41C9B06D20988
Chrome Cache Entry: 155	ASCII text, with very long lines (460)	D6F644FFBB7B72F4CC9318119A71506E	05169B5679045498CA8BA9A74AD354F12C473661	49C388D627D292A4A1A12F8A8210033B119609962EAF3AAB0F0C0FD232A04EB8
Chrome Cache Entry: 156	ASCII text, with very long lines (1572)	CB6AFEA6EE75D2FC22E4A22512425465	F91258C83A54D1D44DF8637909885B300B5D305B	31FE46164CE2459191CA1F7727FD742CE01833EE4F705459E88D43F53FCC9F80
Chrome Cache Entry: 157	GIF image data, version 89a, 32 x 32	C5CD7F5300576AB4C88202B42F6DED62	7A1AA43614396382BB15E5FDE574D9CDCD21698F	E7B44C86B050FCA766A96DDAC2D0932AF0126DA6F2305280342D909168DCCE6B
Chrome Cache Entry: 158	ASCII text, with very long lines (42862), with no line terminators	EFE2DC57BF7B73137E9642E586EE272B	EF584ADD252EF75060DA8DF06EB5E859CAAEDB37	27BEBE78E3B6A4B1664DD4FA83A8CD0187F051631A06248FEFA3EF3991A5A92A
Chrome Cache Entry: 159	Unicode text, UTF-8 text, with very long lines (25709), with no line terminators	6EB45E96A7CBB4B8CA10897F3CF09981	2A12B20D1CA65377448DCE30519C629AA4273346	A48FD35C61908D912B5AC9E1FACE12E0962A0D9ECC8679E87DB4031697CEC54E
Chrome Cache Entry: 160	PNG image data, 275 x 74, 8-bit/color RGBA, non-interlaced	348CCB1A47A98A15FC0F0A62DF30C6F7	CB45527B54D5933A699370BF04AF8D945198740F	5F6EE6ED726E9F1785A957467DFCBCBF20C6AFAF424B3B7CE2782CA04232B450
Chrome Cache Entry: 161	ASCII text, with very long lines (32033)	5869C96CC8F19086AEE625D670D741F9	430A443D74830FE9BE26EFCA431F448C1B3740F9	53964478A7C634E8DAD34ECC303DD8048D00DCE4993906DE1BACF67F663486EF
Chrome Cache Entry: 162	ASCII text, with very long lines (65536), with no line terminators	47F86AC9DF33B55BB62DDEB36E7EC0B2	B890107272180013DF5497C70122ED3A84DDF811	3443B1CDDE7010A735F0A89F859ED127E98B922E7B1EB396DD2083525D12F9F3
Chrome Cache Entry: 163	ASCII text, with very long lines (309), with no line terminators	0E5AC07DCAA9FB6187C5BC216A296461	11485BECBA8C4B2D175C3263B25027C24079BF82	F72F3A1C551F39E965346E98BA850E56DCFC3833296554AD8CA6D1D008527E9A
Chrome Cache Entry: 164	PNG image data, 960 x 1080, 8-bit colormap, non-interlaced	4E823D7ACFC54046DA6807D6F9CBA28D	65CD7A07642518D86CAA1807DF8476D3A329A127	826FBC1D556E0CF1CC2DCBAA3D49CA152CFF58F8B19A26C892CC3CC3F3116FC9
Chrome Cache Entry: 165	ASCII text, with very long lines (6844)	EEFF2190D5F1AABA1F8981FF8558D8F9	C62D55E92F71587FBCA2E05657AE7BF0B93DFE63	C928AD073FEDB172AD105F8830AF70F4F9258F5385C2F2654A5DF83FA0F58B87
Chrome Cache Entry: 166	ASCII text, with very long lines (65393)	95FE9653F2C45892B7E58090566F510F	BE3795CAEAADA195D12C96BB689A7F0B6F8D63B1	257418DE09101FF7791D410F420F9320141CE0436C264B076D46539B0EA0F830
Chrome Cache Entry: 167	ASCII text, with very long lines (10187), with no line terminators	C0053B411B753138AF468DB1BD3B19F3	7C3A187AA58F2B9E5446EDB761B3D4D2BA506FE7	CE337EC7DDA4B3A741363A2673C7EDCE5C736F1660E2AA908131ECFD9DD1343F
Chrome Cache Entry: 168	PNG image data, 960 x 1080, 8-bit colormap, non-interlaced	4E823D7ACFC54046DA6807D6F9CBA28D	65CD7A07642518D86CAA1807DF8476D3A329A127	826FBC1D556E0CF1CC2DCBAA3D49CA152CFF58F8B19A26C892CC3CC3F3116FC9
Chrome Cache Entry: 169	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	41BBB5A57E551BD81C8F9AD73C95B058	53EF4385E62044966871D37209949B5AB8B17ED3	881F74D0EFE1D85B3FBA4F200A4096612D8284F6644B10AA22EC73D64EF4AA5E

Found iframes

Source: https://af.uppromote.com/	HTTP Parser: Iframe src: javascript:false
Source: https://af.uppromote.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-VWZPYDCSKQ&gacid=130039912.1713467925&gtm=45je44f0v894741970za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&z=364272637
Source: https://af.uppromote.com/	HTTP Parser: Iframe src: javascript:false
Source: https://af.uppromote.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-VWZPYDCSKQ&gacid=130039912.1713467925&gtm=45je44f0v894741970za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&z=364272637
Source: https://af.uppromote.com/	HTTP Parser: Iframe src: javascript:false
Source: https://af.uppromote.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-VWZPYDCSKQ&gacid=130039912.1713467925&gtm=45je44f0v894741970za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&z=364272637
Source: https://af.uppromote.com/	HTTP Parser: Iframe src: javascript:false
Source: https://af.uppromote.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-VWZPYDCSKQ&gacid=130039912.1713467925&gtm=45je44f0v894741970za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&z=364272637

HTML body contains low number of good links

Source: https://af.uppromote.com/

HTTP Parser: Number of links: 1

HTML title does not match URL

Source: https://af.uppromote.com/

HTTP Parser: Title: AFFILIATE | Login does not match URL

Source: https://af.uppromote.com/	HTTP Parser: No favicon
Source: https://af.uppromote.com/	HTTP Parser: No favicon
Source: https://af.uppromote.com/	HTTP Parser: No favicon
Source: https://af.uppromote.com/	HTTP Parser: No favicon
Source: https://af.uppromote.com/	HTTP Parser: No favicon
Source: about:blank	HTTP Parser: No favicon

Source: https://af.uppromote.com/	HTTP Parser: No <meta name="author".. found
Source: https://af.uppromote.com/	HTTP Parser: No <meta name="author".. found
Source: https://af.uppromote.com/	HTTP Parser: No <meta name="author".. found
Source: https://af.uppromote.com/	HTTP Parser: No <meta name="author".. found

Source: https://af.uppromote.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://af.uppromote.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://af.uppromote.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://af.uppromote.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49771 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: af.uppromote.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/bootstrap.min.css HTTP/1.1Host: af.uppromote.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InppOEtYM0hPXC8yWFJzMnRvODZrRGhRPT0iLCJ2YWx1ZSI6IkRsckxwSDRBTGtGU1pNUjVWdldIZjZvbTBiSXFJWVE2TUgzK0pKcXRiTitab0JRZGNHMWZVK2o4R2JDNHo2SkEiLCJtYWMiOiI0NWY1NGFkMWI1NzBhMmZhMjQ1N2JlZjIzMTA1M2Y0YmFiYjc1Njk2Y2FlYmJhOWZiMDRkYTNkOTFmNzQwYzhjIn0%3D; laravel_session=eyJpdiI6ImhseUNxSzk2UWZQRFBLYzhkZTJwUFE9PSIsInZhbHVlIjoiam9OK2RRa2xmSUlqbWZTeEZJc2hLUVZRS2c2S3AwT1FIaU5aZHQ1UU1sYjJIZlMzQWdVWDl3OVRwZU52bWR0QmhvRVgrOW9qeVA0QmtKTVBpdjVwMWdaa3FuWkxCeU1CSEVZaXRYRzM4MTIwMlhxWlwvbVZURk5kYVJxQXZnVmk4IiwibWFjIjoiNzMxYjMyNDVlYjE2NjEwYTFiN2ZiM2ZlZWQ4N2VlNWFkYjE2MzE2ODI2MWEzNDg3YzA3MTNlYWQ1YmRlNWZiOSJ9
Source: global traffic	HTTP traffic detected: GET /css/animate.css HTTP/1.1Host: af.uppromote.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InppOEtYM0hPXC8yWFJzMnRvODZrRGhRPT0iLCJ2YWx1ZSI6IkRsckxwSDRBTGtGU1pNUjVWdldIZjZvbTBiSXFJWVE2TUgzK0pKcXRiTitab0JRZGNHMWZVK2o4R2JDNHo2SkEiLCJtYWMiOiI0NWY1NGFkMWI1NzBhMmZhMjQ1N2JlZjIzMTA1M2Y0YmFiYjc1Njk2Y2FlYmJhOWZiMDRkYTNkOTFmNzQwYzhjIn0%3D; laravel_session=eyJpdiI6ImhseUNxSzk2UWZQRFBLYzhkZTJwUFE9PSIsInZhbHVlIjoiam9OK2RRa2xmSUlqbWZTeEZJc2hLUVZRS2c2S3AwT1FIaU5aZHQ1UU1sYjJIZlMzQWdVWDl3OVRwZU52bWR0QmhvRVgrOW9qeVA0QmtKTVBpdjVwMWdaa3FuWkxCeU1CSEVZaXRYRzM4MTIwMlhxWlwvbVZURk5kYVJxQXZnVmk4IiwibWFjIjoiNzMxYjMyNDVlYjE2NjEwYTFiN2ZiM2ZlZWQ4N2VlNWFkYjE2MzE2ODI2MWEzNDg3YzA3MTNlYWQ1YmRlNWZiOSJ9
Source: global traffic	HTTP traffic detected: GET /css/style.css HTTP/1.1Host: af.uppromote.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InppOEtYM0hPXC8yWFJzMnRvODZrRGhRPT0iLCJ2YWx1ZSI6IkRsckxwSDRBTGtGU1pNUjVWdldIZjZvbTBiSXFJWVE2TUgzK0pKcXRiTitab0JRZGNHMWZVK2o4R2JDNHo2SkEiLCJtYWMiOiI0NWY1NGFkMWI1NzBhMmZhMjQ1N2JlZjIzMTA1M2Y0YmFiYjc1Njk2Y2FlYmJhOWZiMDRkYTNkOTFmNzQwYzhjIn0%3D; laravel_session=eyJpdiI6ImhseUNxSzk2UWZQRFBLYzhkZTJwUFE9PSIsInZhbHVlIjoiam9OK2RRa2xmSUlqbWZTeEZJc2hLUVZRS2c2S3AwT1FIaU5aZHQ1UU1sYjJIZlMzQWdVWDl3OVRwZU52bWR0QmhvRVgrOW9qeVA0QmtKTVBpdjVwMWdaa3FuWkxCeU1CSEVZaXRYRzM4MTIwMlhxWlwvbVZURk5kYVJxQXZnVmk4IiwibWFjIjoiNzMxYjMyNDVlYjE2NjEwYTFiN2ZiM2ZlZWQ4N2VlNWFkYjE2MzE2ODI2MWEzNDg3YzA3MTNlYWQ1YmRlNWZiOSJ9
Source: global traffic	HTTP traffic detected: GET /npm/slick-carousel@1.8.1/slick/slick.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/slick-carousel@1.8.1/slick/slick-theme.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /affbootstrap/css/aff-style.css HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/merchant/auth/auth.min.css HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/jquery-3.1.1.min.js HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/merchant/auth/login_left_side.png HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/merchant/auth/right_side_bg.png HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/merchant/auth/logo_with_text.png HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bootstrap.min.js HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/plugins/slick/1.8.1/slick.min.js HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/merchant/auth/login_register.min.js HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/merchant/auth/logo_with_text.png HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/merchant/auth/right_side_bg.png HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/merchant/auth/login_left_side.png HTTP/1.1Host: d1639lhkj5l89m.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/slick-carousel@1.8.1/slick/ajax-loader.gif HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick-theme.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/slick-carousel@1.8.1/slick/fonts/slick.woff HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://af.uppromote.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick-theme.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /embeddable_framework/main.js HTTP/1.1Host: assets.zendesk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/slick-carousel@1.8.1/slick/ajax-loader.gif HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ekr/asset_composer.js HTTP/1.1Host: static.zdassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/ga/rul?tid=G-VWZPYDCSKQ&gacid=130039912.1713467925&gtm=45je44f0v894741970za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&z=364272637 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /compose/web_widget/secomapp.zendesk.com HTTP/1.1Host: ekr.zdassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://af.uppromote.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-53113273-27&cid=130039912.1713467925&jid=1329057363&gjid=2076597767&_gid=1443929882.1713467925&_u=YEBAAUAAAAAAACAAI~&z=1669976494 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-53113273-27&cid=130039912.1713467925&jid=1329057363&_u=YEBAAUAAAAAAACAAI~&z=152713507 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web_widget/classic/latest/web-widget-main-7bc1c0f.js HTTP/1.1Host: static.zdassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /compose/web_widget/secomapp.zendesk.com HTTP/1.1Host: ekr.zdassets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: af.uppromote.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://af.uppromote.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InppOEtYM0hPXC8yWFJzMnRvODZrRGhRPT0iLCJ2YWx1ZSI6IkRsckxwSDRBTGtGU1pNUjVWdldIZjZvbTBiSXFJWVE2TUgzK0pKcXRiTitab0JRZGNHMWZVK2o4R2JDNHo2SkEiLCJtYWMiOiI0NWY1NGFkMWI1NzBhMmZhMjQ1N2JlZjIzMTA1M2Y0YmFiYjc1Njk2Y2FlYmJhOWZiMDRkYTNkOTFmNzQwYzhjIn0%3D; laravel_session=eyJpdiI6ImhseUNxSzk2UWZQRFBLYzhkZTJwUFE9PSIsInZhbHVlIjoiam9OK2RRa2xmSUlqbWZTeEZJc2hLUVZRS2c2S3AwT1FIaU5aZHQ1UU1sYjJIZlMzQWdVWDl3OVRwZU52bWR0QmhvRVgrOW9qeVA0QmtKTVBpdjVwMWdaa3FuWkxCeU1CSEVZaXRYRzM4MTIwMlhxWlwvbVZURk5kYVJxQXZnVmk4IiwibWFjIjoiNzMxYjMyNDVlYjE2NjEwYTFiN2ZiM2ZlZWQ4N2VlNWFkYjE2MzE2ODI2MWEzNDg3YzA3MTNlYWQ1YmRlNWZiOSJ9; _gid=GA1.2.1443929882.1713467925; _gat_gtag_UA_53113273_27=1; _ga=GA1.1.130039912.1713467925; _ga_VWZPYDCSKQ=GS1.1.1713467924.1.0.1713467924.60.0.0
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-53113273-27&cid=130039912.1713467925&jid=1329057363&_u=YEBAAUAAAAAAACAAI~&z=152713507 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: af.uppromote.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InppOEtYM0hPXC8yWFJzMnRvODZrRGhRPT0iLCJ2YWx1ZSI6IkRsckxwSDRBTGtGU1pNUjVWdldIZjZvbTBiSXFJWVE2TUgzK0pKcXRiTitab0JRZGNHMWZVK2o4R2JDNHo2SkEiLCJtYWMiOiI0NWY1NGFkMWI1NzBhMmZhMjQ1N2JlZjIzMTA1M2Y0YmFiYjc1Njk2Y2FlYmJhOWZiMDRkYTNkOTFmNzQwYzhjIn0%3D; laravel_session=eyJpdiI6ImhseUNxSzk2UWZQRFBLYzhkZTJwUFE9PSIsInZhbHVlIjoiam9OK2RRa2xmSUlqbWZTeEZJc2hLUVZRS2c2S3AwT1FIaU5aZHQ1UU1sYjJIZlMzQWdVWDl3OVRwZU52bWR0QmhvRVgrOW9qeVA0QmtKTVBpdjVwMWdaa3FuWkxCeU1CSEVZaXRYRzM4MTIwMlhxWlwvbVZURk5kYVJxQXZnVmk4IiwibWFjIjoiNzMxYjMyNDVlYjE2NjEwYTFiN2ZiM2ZlZWQ4N2VlNWFkYjE2MzE2ODI2MWEzNDg3YzA3MTNlYWQ1YmRlNWZiOSJ9; _gid=GA1.2.1443929882.1713467925; _gat_gtag_UA_53113273_27=1; _ga=GA1.1.130039912.1713467925; _ga_VWZPYDCSKQ=GS1.1.1713467924.1.0.1713467924.60.0.0
Source: global traffic	HTTP traffic detected: GET /web_widget/classic/latest/web-widget-locales/classic/en-us-json-7bc1c0f.js HTTP/1.1Host: static.zdassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /embeddable/config HTTP/1.1Host: secomapp.zendesk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://af.uppromote.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /embeddable/config HTTP/1.1Host: secomapp.zendesk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4azP9xWtRUeNfXy&MD=XhVKEk1h HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgRRtTk0GKPkhbEGIjDXNNgTxoHfWVKTTBihP5c2kHUHsukbzZky06WzqUC1whYr2AOgh-8SrTqeGy3xSDYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4azP9xWtRUeNfXy&MD=XhVKEk1h HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: af.uppromote.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: chromecache_154.1.dr	String found in binary or memory: Math.round(p);v["gtm.videoCurrentTime"]=Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},Hj:function(){e=zb()},od:function(){d()}}};var gc=ia(["data-gtm-yt-inspected-"]),qC=["www.youtube.com","www.youtube-nocookie.com"],rC,sC=!1; equals www.youtube.com (Youtube)
Source: chromecache_154.1.dr	String found in binary or memory: e\|\|f\|\|g.length\|\|h.length))return;var n={Sg:d,Qg:e,Rg:f,Ch:g,Dh:h,we:m,zb:b},p=D.YT,q=function(){yC(n)};if(p)return p.ready&&p.ready(q),b;var r=D.onYouTubeIframeAPIReady;D.onYouTubeIframeAPIReady=function(){r&&r();q()};I(function(){for(var t=G.getElementsByTagName("script"),u=t.length,v=0;v<u;v++){var w=t[v].getAttribute("src");if(BC(w,"iframe_api")\|\|BC(w,"player_api"))return b}for(var x=G.getElementsByTagName("iframe"),y=x.length,B=0;B<y;B++)if(!sC&&zC(x[B],n.we))return Lc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: af.uppromote.com

Source: unknown

Source: chromecache_147.1.dr	String found in binary or memory: http://af.secomapp.com/
Source: chromecache_155.1.dr	String found in binary or memory: http://daneden.me/animate
Source: chromecache_161.1.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_154.1.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: chromecache_154.1.dr	String found in binary or memory: https://adservice.googlesyndication.com/pagead/regclk
Source: chromecache_143.1.dr	String found in binary or memory: https://af.uppromote.com/
Source: chromecache_143.1.dr	String found in binary or memory: https://af.uppromote.com/css/animate.css
Source: chromecache_143.1.dr	String found in binary or memory: https://af.uppromote.com/css/bootstrap.min.css
Source: chromecache_143.1.dr	String found in binary or memory: https://af.uppromote.com/css/style.css
Source: chromecache_143.1.dr	String found in binary or memory: https://af.uppromote.com/login
Source: chromecache_144.1.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_143.1.dr	String found in binary or memory: https://assets.zendesk.com/embeddable_framework/main.js
Source: chromecache_154.1.dr, chromecache_139.1.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_143.1.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/slick-carousel
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/affbootstrap/css/aff-style.css
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/css/merchant/auth/auth.min.css
Source: chromecache_133.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/css/patterns/3.png
Source: chromecache_133.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/css/patterns/4.png
Source: chromecache_133.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/css/patterns/header-profile-skin-1.png
Source: chromecache_133.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/css/patterns/header-profile-skin-3.png
Source: chromecache_133.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/css/patterns/header-profile.png
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/img/merchant/auth/login_left_side.png
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/img/merchant/auth/logo_with_text.png
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/img/merchant/auth/right_side_bg.png
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/js/bootstrap.min.js
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/js/jquery-3.1.1.min.js
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/js/merchant/auth/login_register.min.js
Source: chromecache_143.1.dr	String found in binary or memory: https://d1639lhkj5l89m.cloudfront.net/js/plugins/slick/1.8.1/slick.min.js
Source: chromecache_135.1.dr	String found in binary or memory: https://developer.zendesk.com/documentation/classic-web-widget-sdks/web-widget/getting-started/legal
Source: chromecache_145.1.dr, chromecache_148.1.dr	String found in binary or memory: https://ekr.zendesk.com/compose_product/web_widget/7bc1c0f290501106fa41dc515076261e2325fb83?features
Source: chromecache_166.1.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_166.1.dr	String found in binary or memory: https://fontawesome.com/license
Source: chromecache_143.1.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Poppins:ital
Source: chromecache_133.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: chromecache_133.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_156.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: chromecache_132.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLCz7Z1JlFc-K.woff2)
Source: chromecache_132.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2)
Source: chromecache_132.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2)
Source: chromecache_132.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJnecmNE.woff2)
Source: chromecache_132.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v21/pxiGyp8kv8JHgFVrJJLucHtA.woff2)
Source: chromecache_132.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v21/pxiGyp8kv8JHgFVrJJLufntAKPY.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_146.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_155.1.dr	String found in binary or memory: https://github.com/nickpettit/glide
Source: chromecache_133.1.dr	String found in binary or memory: https://github.com/onokumus/metisMenu
Source: chromecache_154.1.dr, chromecache_139.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_154.1.dr, chromecache_139.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_143.1.dr	String found in binary or memory: https://pro.fontawesome.com/releases/v5.15.1/css/all.css
Source: chromecache_145.1.dr, chromecache_148.1.dr	String found in binary or memory: https://static.zdassets.com/web_widget/classic/latest/web-widget-main-7bc1c0f.js
Source: chromecache_154.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_154.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: chromecache_144.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_144.1.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_154.1.dr, chromecache_139.1.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_139.1.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_144.1.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_144.1.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_144.1.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_154.1.dr, chromecache_139.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_144.1.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_154.1.dr, chromecache_139.1.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_154.1.dr, chromecache_139.1.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_144.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_143.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-53113273-27
Source: chromecache_154.1.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_154.1.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49771 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@15/85@42/17

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://af.uppromote.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1956,i,5459667013927682966,7205913079346083900,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1956,i,5459667013927682966,7205913079346083900,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1428360
Product:	CloudBasic
Start time:	21:18:12
Start date:	18.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
http://af.uppromote.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://af.uppromote.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://af.uppromote.com