Edit tour

Windows Analysis Report
https://it.uptodown.com/android/shopping

Overview

General Information

Sample URL:	https://it.uptodown.com/android/shopping
Analysis ID:	1435371
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 --field-trial-handle=2448,i,4029198109879984000,14902098756349126670,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2580 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e%3cfnc1%3e/ MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2104 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1960,i,7378736224720298931,17377383039568782976,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://it.uptodown.com/android/shopping" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST / HTTP/1.1Host: analytics.ssmas.comConnection: keep-aliveContent-Length: 378sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"charset: UTF-8Content-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://it.uptodown.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://it.uptodown.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	HTTPS traffic detected: 23.41.168.93:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.41.168.93:443 -> 192.168.2.6:49833 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_757.3.dr, chromecache_130.3.dr, chromecache_783.3.dr, chromecache_573.3.dr	String found in binary or memory: "https://www.facebook.com/Uptodown", equals www.facebook.com (Facebook)
Source: chromecache_757.3.dr, chromecache_130.3.dr, chromecache_783.3.dr, chromecache_573.3.dr	String found in binary or memory: "https://www.facebook.com/Uptodown.International", equals www.facebook.com (Facebook)
Source: chromecache_757.3.dr, chromecache_130.3.dr, chromecache_783.3.dr, chromecache_573.3.dr	String found in binary or memory: "https://www.linkedin.com/company/uptodown/", equals www.linkedin.com (Linkedin)
Source: chromecache_757.3.dr, chromecache_130.3.dr, chromecache_783.3.dr, chromecache_573.3.dr	String found in binary or memory: "https://www.youtube.com/user/UptodownVideos", equals www.youtube.com (Youtube)
Source: chromecache_573.3.dr	String found in binary or memory: <a title="Uptodown Facebook URL" href="https://www.facebook.com/Uptodown.International"> equals www.facebook.com (Facebook)
Source: chromecache_573.3.dr	String found in binary or memory: <a title="Uptodown LinkedIn URL" href="https://www.linkedin.com/company/uptodown/"> equals www.linkedin.com (Linkedin)
Source: chromecache_573.3.dr	String found in binary or memory: <a title="Uptodown YouTube URL" href="https://www.youtube.com/uptodown"> equals www.youtube.com (Youtube)
Source: chromecache_340.3.dr	String found in binary or memory: Math.round(p);v["gtm.videoCurrentTime"]=Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},Rj:function(){e=zb()},sd:function(){d()}}};var dc=ka(["data-gtm-yt-inspected-"]),wC=["www.youtube.com","www.youtube-nocookie.com"],xC,yC=!1; equals www.youtube.com (Youtube)
Source: chromecache_340.3.dr	String found in binary or memory: e\|\|f\|\|g.length\|\|h.length))return;var n={Wg:d,Ug:e,Vg:f,Hh:g,Ih:h,ye:m,zb:b},p=G.YT,q=function(){EC(n)};if(p)return p.ready&&p.ready(q),b;var r=G.onYouTubeIframeAPIReady;G.onYouTubeIframeAPIReady=function(){r&&r();q()};I(function(){for(var t=H.getElementsByTagName("script"),u=t.length,v=0;v<u;v++){var w=t[v].getAttribute("src");if(HC(w,"iframe_api")\|\|HC(w,"player_api"))return b}for(var x=H.getElementsByTagName("iframe"),y=x.length,B=0;B<y;B++)if(!yC&&FC(x[B],n.ye))return tc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: it.uptodown.com
Source: global traffic	DNS traffic detected: DNS query: stc.utdstc.com
Source: global traffic	DNS traffic detected: DNS query: geo.cookie-script.com
Source: global traffic	DNS traffic detected: DNS query: ssm.codes
Source: global traffic	DNS traffic detected: DNS query: btloader.com
Source: global traffic	DNS traffic detected: DNS query: img.utdstc.com
Source: global traffic	DNS traffic detected: DNS query: api.btloader.com
Source: global traffic	DNS traffic detected: DNS query: ad-delivery.net
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: scripts.ssm.codes
Source: global traffic	DNS traffic detected: DNS query: analytics.ssmas.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50233
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 50490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50490
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 --field-trial-handle=2448,i,4029198109879984000,14902098756349126670,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e%3cfnc1%3e/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1960,i,7378736224720298931,17377383039568782976,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://it.uptodown.com/android/shopping"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 --field-trial-handle=2448,i,4029198109879984000,14902098756349126670,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1960,i,7378736224720298931,17377383039568782976,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://scripts.ssm.codes/dist/premiumContent.js	0%	Avira URL Cloud	safe
https://btloader.com/tag?o=5175773613260800&upapi=true	0%	Avira URL Cloud	safe
https://api.btloader.com/pv?tid=fi33PZ5XKq&w=6320147589758976&o=5175773613260800&cv=2.1.43&widget=false&r=false&vr=1280x907&pageURL=https%3A%2F%2Fit.uptodown.com%2Fwindows&sid=A1wwwhIjhN&pm=false&upapi=true	0%	Avira URL Cloud	safe
https://btloader.com/tag?o=5175773613260800&upapi=true	0%	Virustotal		Browse
https://scripts.ssm.codes/dist/premiumContent.js	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
google.com	142.251.41.78	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
geo.cookie-script.com	185.14.184.154	true	false	high
api.btloader.com	130.211.23.194	true	false	unknown
ad.doubleclick.net	142.250.65.198	true	false	high
scripts.ssm.codes	172.67.69.203	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
ad-delivery.net	104.26.2.70	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
www.cloudflare.com	104.16.123.96	true	false	high
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	162.222.105.35	true	false	unknown
ssm.codes	104.26.5.120	true	false	unknown
btloader.com	172.67.41.60	true	false	unknown
www.google.com	142.251.40.164	true	false	high
analytics.ssmas.com	88.198.56.206	true	false	unknown
stc.utdstc.com	unknown	unknown	false	high
it.uptodown.com	unknown	unknown	false	high
img.utdstc.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://btloader.com/tag?o=5175773613260800&upapi=true	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.btloader.com/pv?tid=fi33PZ5XKq&w=6320147589758976&o=5175773613260800&cv=2.1.43&widget=false&r=false&vr=1280x907&pageURL=https%3A%2F%2Fit.uptodown.com%2Fwindows&sid=A1wwwhIjhN&pm=false&upapi=true	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.80.46	unknown	United States	15169	GOOGLEUS	false
104.26.5.120	ssm.codes	United States	13335	CLOUDFLARENETUS	false
142.250.176.206	unknown	United States	15169	GOOGLEUS	false
142.251.40.228	unknown	United States	15169	GOOGLEUS	false
130.211.23.194	api.btloader.com	United States	15169	GOOGLEUS	false
142.251.40.174	unknown	United States	15169	GOOGLEUS	false
142.250.65.198	ad.doubleclick.net	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.67.69.203	scripts.ssm.codes	United States	13335	CLOUDFLARENETUS	false
104.16.124.96	unknown	United States	13335	CLOUDFLARENETUS	false
104.26.2.70	ad-delivery.net	United States	13335	CLOUDFLARENETUS	false
142.250.81.228	unknown	United States	15169	GOOGLEUS	false
172.67.41.60	btloader.com	United States	13335	CLOUDFLARENETUS	false
142.251.40.164	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.65.164	unknown	United States	15169	GOOGLEUS	false
185.14.184.154	geo.cookie-script.com	Netherlands	14061	DIGITALOCEAN-ASNUS	false
104.16.123.96	www.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
88.198.56.206	analytics.ssmas.com	Germany	24940	HETZNER-ASDE	false

IP
192.168.2.6
127.0.0.1

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1435371
Start date and time:	2024-05-02 15:55:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://it.uptodown.com/android/shopping
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@34/1096@66/21
Cookbook Comments:	Browse: https://it.uptodown.com/ Browse: https://it.uptodown.com/android/lifestyle

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	3856
Entropy (8bit):	7.935875696362192
Encrypted:	false
SSDEEP:	96:m9c9AvAgYocPFzgooX9Ywrpk0zyGrZHrhmwliCLm:H97g3cJCidG1LhmPCLm
MD5:	18FCFCED0648CB01FDC4A9BB1AE0B51F
SHA1:	58BDFA84D0A0889E2237EB1997F13E576B1BC8F5
SHA-256:	BC0380C60FD0990A5C6C56E21321FBD9E1D6A538153D0157E9679DA3A290209F
SHA-512:	0F2CA8B2148D2379627F4309913DFDD3379A5C0C3BD89EE60926F37EE5CA5251AB0D8B43E8C17D8C4D17D1978E980DE9A3ABD87BE819C588691B24E2D29FD097
Malicious:	false
Reputation:	low
URL:	https://img.utdstc.com/icon/c32/964/c3296435b7fb0fe17b899be25fb025c28ee83dc8080af631b4ac2a6649f133bc:220
Preview:	RIFF....WEBPVP8X..............ALPH.......m.....KF.m..~.lu.m..O.$.]m.9..MDL....^K.B..w.....%d..0&..F....~.xx.......&:....C.Yv...1$W.lf.y....p?D..+...\|7A..V..s"...^..E.C.......hD{x..?..BdiJ.\..4.Z5.n.......>x..R.5k{.UO."\.`.}..P...5........K...72....K....5.j...y...G...c=,.8<..........J....sS.X{l..E-{x.G3......n...j..RJ.Z.sRQK.&:..qEi....#..r5..].LM[.1.... ..Q_X.CPa..".\.YY.....B6..3........?.......[......!W.0.z.FE=...Q...6...eC.E....55....-D.V3..aW..\|.a,].h..CcXUd1..EI....C...$.>.f.P!.4..u........M.<..V.X.\|...!(.`....N,IKUc+f^.\|.....M..kO.H\5"&_.\|..$.uf..\|k...m....X......Y.r..n...:.m...U.....sh..B+(....j.}..7-[4....L\|..w....u[((.N."..+o~.vC}}.k..Y..F!..m..Z.sS...ch...B......t.R.....^Z..Q..Nc.k.:,.i..B...N.%.\.r@.)....o& ... ...vi.....U.).}i.m.-pU.,.~.......O.....2T......P.....VP8 .....?.......>1..C"!....t(.....K..M.}^W......O._y.....?.......u.......?0>z.....f?....i._.)........../.a_..Nog_.O..k.@zA...?h./.b0......sS./...P...>.............

Name	Source	Malicious	Antivirus Detection	Reputation
https://snagit.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://google-play-newsstand.it.uptodown.com/android	chromecache_783.3.dr	false		high
https://appetito.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://img.utdstc.com/icon/07a/b6a/07ab6a6adff36a18caa27fc791527ffe5aa8391580a6739535879bcb6c8ccdfd	chromecache_573.3.dr	false		high
https://my-vodafone-italia.it.uptodown.com/android	chromecache_783.3.dr	false		high
https://andy.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://phoenix-browser.it.uptodown.com/android	chromecache_783.3.dr	false		high
https://img.utdstc.com/icon/94c/a35/94ca3514a654be0fd6557d1a38bfc225e7b3e57715af8c9576edb9d351c283c4	chromecache_573.3.dr	false		high
https://img.utdstc.com/screen/3b1/036/3b1036517c45e378d468e8ae340e94c76a0c487d3f8574560ce549e06f2b36	chromecache_783.3.dr	false		high
https://img.utdstc.com/icon/3d4/07c/3d407cfdf8aa56c16390d2f346850044d3c3ecd86a78080a72b4a4f255a9f492	chromecache_130.3.dr	false		high
https://img.utdstc.com/icon/625/ca4/625ca4d57bab5a6b1cb38ea4deb14b9d9910c567e8f572aa08939b86dd1581f7	chromecache_757.3.dr	false		high
https://call-of-duty-warzone.it.uptodown.com/android	chromecache_783.3.dr	false		high
https://img.utdstc.com/icon/769/c6e/769c6e7ef1ef4ff2ab281f54b7674c2997a7c973a82dce03938f80d0f9552f52	chromecache_783.3.dr	false		high
https://black-clover-m-rise-of-the-wizard-king.it.uptodown.com/android	chromecache_783.3.dr	false		high
https://universal-tv-remote.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://windows-10.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://wish.it.uptodown.com/android	chromecache_757.3.dr	false		high
https://img.utdstc.com/icon/729/92a/72992a83c3b9b59e10b8032bd8aef27be59bf5248c1741ac6a9e54bd64ad597f	chromecache_783.3.dr	false		high
https://img.utdstc.com/icon/7d0/589/7d0589d5f63a4f8aa81950c2cce5a5bb30d0b76335494b57163be4cba67f8b1b	chromecache_573.3.dr	false		high
https://img.utdstc.com/icon/bf7/eae/bf7eae08913d08650324717f8b82ef802b715f7b8347d04810994bd11f339784	chromecache_573.3.dr	false		high
https://google-fit.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://888-casino.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://microsoft-pc-manager.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://character-ai.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://img.utdstc.com/icon/52b/ca7/52bca7c3ba7b1ee97913ca068d5e1d08d64806ecd6a979d4f96eef63d1254c92	chromecache_573.3.dr	false		high
https://img.utdstc.com/screen/914/ebe/914ebeaf7baf5de058d069e96c5700b48f4d6a5c4a7d8b806c30843022a871	chromecache_130.3.dr	false		high
https://k-lite-codec-pack.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://img.utdstc.com/icon/82f/389/82f389d54e3210c4fda5f340ec7fe0f0954e455f482c26a307ef426f0125887c	chromecache_783.3.dr	false		high
https://img.utdstc.com/screen/849/63a/84963a7b7407e3dc6d7e47286d6ed31d5c17abfbc8ab4e840c2d2eeff3ce33	chromecache_573.3.dr	false		high
https://br.uptodown.com	chromecache_783.3.dr	false		high
https://dofu-live-nfl-nba-mlb-nhl-ncaa.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://idealo.it.uptodown.com/android	chromecache_757.3.dr	false		high
https://img.utdstc.com/icon/38b/89a/38b89a668208de992e59fe9941d9f1f4a5e2febe97e4d36039c85250b6675904	chromecache_783.3.dr	false		high
https://tr.uptodown.com/android/lifestyle	chromecache_130.3.dr	false		high
https://it.uptodown.com/android/health	chromecache_130.3.dr	false		high
https://br.uptodown.com/android/shopping	chromecache_757.3.dr	false		high
https://autoclicker.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://qibla-finder-and-kaaba-compass.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://img.utdstc.com/icon/8b5/dc5/8b5dc512959077a98c429c4964dc7eb34128d6b791826286f095147c97fe7e7b	chromecache_783.3.dr	false		high
https://img.utdstc.com/icon/310/ff6/310ff67393d71eb0fa8033ebdda263e5c42b3bf267270bbb9f836ccf86a16c77	chromecache_573.3.dr	false		high
https://img.utdstc.com/icon/313/81f/31381f40bb9a0d9087ec696135306da09fb297e43f3d9c3d715ac22bb38ea0a5	chromecache_757.3.dr	false		high
https://sketch.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://img.utdstc.com/icon/904/4be/9044be36491729f82307420539e09b0be845dee84d092a1fc33f461bbb72e24a	chromecache_130.3.dr	false		high
https://mozilla-firefox-portable.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://img.utdstc.com/icon/7e8/0a0/7e80a0e6f3e3d7e97895a14b861ac60fd0300f1675cbdf915c929bc938a33c72	chromecache_130.3.dr	false		high
https://img.utdstc.com/icon/4b6/05c/4b605c8e4fc1b98b08220dc8963d2d01e7bf78484a49ecc11d99c7e7b974d42a	chromecache_573.3.dr	false		high
https://promoqui.it.uptodown.com/android	chromecache_757.3.dr	false		high
https://momo-app-player.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://tr.uptodown.com/windows	chromecache_573.3.dr	false		high
https://img.utdstc.com/icon/9b7/dc4/9b7dc4ea9a279fd7c8619b8e963f593f63d215f14cfc53aa5c828f4cdcd3b9a5	chromecache_783.3.dr	false		high
https://calca-app.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://img.utdstc.com/screen/745/842/74584293747bceaa7336e44c8b93af1dcd361195c9088db34e7e38d3ae9b7b	chromecache_783.3.dr	false		high
https://img.utdstc.com/screen/190/1aa/1901aa49c61ad9030af657aae7db0a77155dc9b9ecfad7688bbd6fc0189ff0	chromecache_783.3.dr	false		high
https://synced.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://com-glance-lockscreenmlite.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://dvd-shrink.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://sisal-s-p-a-superenalotto.it.uptodown.com/android	chromecache_783.3.dr	false		high
https://duolingo.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://ar-drawing.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://www.uptodown.com/#organization	chromecache_757.3.dr, chromecache_130.3.dr, chromecache_783.3.dr, chromecache_573.3.dr	false		high
https://catawiki.it.uptodown.com/android	chromecache_757.3.dr	false		high
https://img.utdstc.com/icon/6e3/85a/6e385a1d67e8db70d30cd9f5fa5752a52a9d322107aeb9fd8114a889c8f50100	chromecache_783.3.dr	false		high
https://samsung-pay.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://stc.utdstc.com/img/mediakit/isotipo.png	chromecache_757.3.dr, chromecache_130.3.dr, chromecache_783.3.dr, chromecache_573.3.dr	false		high
https://cbs-sports.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://protonvpn.it.uptodown.com/android	chromecache_783.3.dr	false		high
https://img.utdstc.com/screen/cb1/ce4/cb1ce450f8812b89d20680b5a9eda0e7ca29f563dc35cb0f20065cd503049a	chromecache_783.3.dr	false		high
https://img.utdstc.com/icon/0fe/034/0fe034223db0467994b0432d6de22f6056aed1c2861a5c99e0ac4854d82b6500	chromecache_130.3.dr	false		high
https://scripts.ssm.codes/dist/premiumContent.js	chromecache_186.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://kfc-italia.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://img.utdstc.com/icon/c5d/906/c5d906f9978eb9d82fd79adcaa7cafd64e94e58578850d1af120581866c47fd9	chromecache_573.3.dr	false		high
https://img.utdstc.com/icon/d49/c48/d49c4851fcbdecccece71a27cddf0a6bddb23173461e763ec32cd08eeb778c69	chromecache_783.3.dr	false		high
https://img.utdstc.com/icon/88e/365/88e36578aa5a0d31e9c99455654b6614706950ec1136f68489c2dc26e151c741	chromecache_573.3.dr	false		high
https://img.utdstc.com/icon/a89/cb9/a89cb9c95105607afc832362ff352a4e993e698c78f4c53a695d59a02bc4b837	chromecache_783.3.dr	false		high
https://img.utdstc.com/icon/0ac/107/0ac1071b865fb80338deb6b74a73f78ea424f791a87fe8a02549020c8599c5ff	chromecache_130.3.dr	false		high
https://it.uptodown.com/windows/sparatutto-terza-persona	chromecache_573.3.dr	false		high
https://img.utdstc.com/icon/b0e/830/b0e830cf50c169f6d2b75d37876678b5dea24a192e5016238a62de0fc00600ab	chromecache_130.3.dr	false		high
https://img.utdstc.com/icon/1c2/8e3/1c28e3e40acf2042f5d19f2beb8a33ff674773bf92737c6ee8d0eabe686af3ef	chromecache_783.3.dr	false		high
https://opera.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://img.utdstc.com/icon/713/b25/713b253990a5a3ecdcd240bb4b1a5bca497d941b03d5662759e942fcc5dc6919	chromecache_757.3.dr	false		high
https://img.utdstc.com/icon/8d9/55e/8d955ecf899a70d6831d44aa0bd0de72e2c2f385e930742a29ea17ed756e1179	chromecache_573.3.dr	false		high
https://free-ico-converter.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://img.utdstc.com/icon/9c4/58d/9c458dc566d565f67010dd63299a838474526f43f3ac00fca211b970daf7d42d	chromecache_573.3.dr	false		high
https://www.youtube.com/user/UptodownVideos	chromecache_757.3.dr, chromecache_130.3.dr, chromecache_783.3.dr, chromecache_573.3.dr	false		high
https://it.uptodown.com/favicon.ico	chromecache_783.3.dr, chromecache_573.3.dr	false		high
https://img.utdstc.com/screen/c4c/169/c4c1694ba348c32e74c4c98e946c6bdc87ebc717cce011bebad546bbc0c20f	chromecache_130.3.dr	false		high
https://google-earth.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://img.utdstc.com/icon/bb1/1d2/bb11d279478633f64a26e8f7e4dad961716e500fe98ba7a9eef6c6d9ee378bf6	chromecache_573.3.dr	false		high
https://img.utdstc.com/icon/f92/826/f928265369c03ab9d542fd5f5ce76d8eac25a69a9374b65539983bc9d3bc940e	chromecache_130.3.dr	false		high
https://speedify.it.uptodown.com/android	chromecache_783.3.dr	false		high
https://com-omada-social.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://img.utdstc.com/icon/ee2/425/ee24258f83ed3b93eadbc1c76b5eba314c789610806d9ab4b58b4cdd6f8fd565	chromecache_573.3.dr	false		high
https://deluge.it.uptodown.com/windows	chromecache_573.3.dr	false		high
https://live-sports-plus-hd.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://didi-food.it.uptodown.com/android	chromecache_130.3.dr	false		high
https://img.utdstc.com/screen/118/e03/118e034e9d101e90fe98cdf346f8f682fe4d8b987c5d54428a6fc242396d42	chromecache_783.3.dr	false		high
https://kr.uptodown.com/android/lifestyle	chromecache_130.3.dr	false		high
https://nike.it.uptodown.com/android	chromecache_757.3.dr	false		high

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 2, 2024 15:56:37.501437902 CEST	53	55629	1.1.1.1	192.168.2.6
May 2, 2024 15:56:37.569705009 CEST	53	59877	1.1.1.1	192.168.2.6
May 2, 2024 15:56:38.187016010 CEST	64720	53	192.168.2.6	8.8.8.8
May 2, 2024 15:56:38.187248945 CEST	58622	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:38.274439096 CEST	53	64720	8.8.8.8	192.168.2.6
May 2, 2024 15:56:38.275579929 CEST	53	58622	1.1.1.1	192.168.2.6
May 2, 2024 15:56:38.322504044 CEST	53	58113	1.1.1.1	192.168.2.6
May 2, 2024 15:56:38.550272942 CEST	59428	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:38.550772905 CEST	49787	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:38.726289034 CEST	53	49787	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.223200083 CEST	57777	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.223547935 CEST	57271	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.226005077 CEST	63493	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.226308107 CEST	64126	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.227821112 CEST	51889	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.228044033 CEST	51010	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.228431940 CEST	53012	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.228553057 CEST	60770	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.316627979 CEST	53	57271	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.317897081 CEST	53	63493	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.319541931 CEST	53	51889	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.319802046 CEST	53	51403	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.320033073 CEST	53	60770	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.320234060 CEST	53	51010	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.321358919 CEST	53	53012	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.325939894 CEST	53	64126	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.342149019 CEST	65409	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.342339039 CEST	59276	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.435476065 CEST	53	59276	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.789402008 CEST	53	62942	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.789638996 CEST	53	51840	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.805527925 CEST	58997	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.805799961 CEST	63814	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.808160067 CEST	58189	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.808293104 CEST	50849	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.808949947 CEST	60414	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.809209108 CEST	58981	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:39.893564939 CEST	53	58997	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.894009113 CEST	53	63814	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.896243095 CEST	53	58189	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.896763086 CEST	53	50849	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.897030115 CEST	53	60414	1.1.1.1	192.168.2.6
May 2, 2024 15:56:39.897690058 CEST	53	58981	1.1.1.1	192.168.2.6
May 2, 2024 15:56:41.237360954 CEST	52409	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:41.237514019 CEST	51387	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:41.325628996 CEST	53	52409	1.1.1.1	192.168.2.6
May 2, 2024 15:56:41.326451063 CEST	53	51387	1.1.1.1	192.168.2.6
May 2, 2024 15:56:41.523690939 CEST	61617	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:41.523849010 CEST	62112	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:41.611618996 CEST	53	62112	1.1.1.1	192.168.2.6
May 2, 2024 15:56:41.612929106 CEST	53	61617	1.1.1.1	192.168.2.6
May 2, 2024 15:56:42.631373882 CEST	53775	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:42.631717920 CEST	51413	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:42.644517899 CEST	62283	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:42.644846916 CEST	49440	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:42.655122042 CEST	50150	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:42.655738115 CEST	63894	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:42.693766117 CEST	62045	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:42.694652081 CEST	53192	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:42.700309038 CEST	63246	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:42.700691938 CEST	52606	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:42.724225044 CEST	53	51413	1.1.1.1	192.168.2.6
May 2, 2024 15:56:42.737689972 CEST	53	49440	1.1.1.1	192.168.2.6
May 2, 2024 15:56:42.744690895 CEST	53	50150	1.1.1.1	192.168.2.6
May 2, 2024 15:56:42.745368958 CEST	53	63894	1.1.1.1	192.168.2.6
May 2, 2024 15:56:42.782949924 CEST	53	53192	1.1.1.1	192.168.2.6
May 2, 2024 15:56:42.782985926 CEST	53	62045	1.1.1.1	192.168.2.6
May 2, 2024 15:56:42.788748980 CEST	53	63246	1.1.1.1	192.168.2.6
May 2, 2024 15:56:42.788990021 CEST	53	52606	1.1.1.1	192.168.2.6
May 2, 2024 15:56:42.983988047 CEST	50473	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:42.984581947 CEST	57278	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:43.073421955 CEST	53	50473	1.1.1.1	192.168.2.6
May 2, 2024 15:56:43.075608969 CEST	53	57278	1.1.1.1	192.168.2.6
May 2, 2024 15:56:48.825861931 CEST	59431	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:48.827267885 CEST	59419	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:48.914752007 CEST	53	59431	1.1.1.1	192.168.2.6
May 2, 2024 15:56:48.918154955 CEST	53	60006	1.1.1.1	192.168.2.6
May 2, 2024 15:56:48.919159889 CEST	53	59419	1.1.1.1	192.168.2.6
May 2, 2024 15:56:50.989420891 CEST	62629	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:50.989573956 CEST	61043	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:51.077366114 CEST	53	62629	1.1.1.1	192.168.2.6
May 2, 2024 15:56:51.077609062 CEST	53	61043	1.1.1.1	192.168.2.6
May 2, 2024 15:56:52.847367048 CEST	53423	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:52.863327026 CEST	59844	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:52.938307047 CEST	53	53423	1.1.1.1	192.168.2.6
May 2, 2024 15:56:53.317830086 CEST	53	59844	1.1.1.1	192.168.2.6
May 2, 2024 15:56:58.387816906 CEST	60527	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:58.387974977 CEST	65020	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:58.477715969 CEST	53	60527	1.1.1.1	192.168.2.6
May 2, 2024 15:56:58.477957010 CEST	53	65020	1.1.1.1	192.168.2.6
May 2, 2024 15:56:59.846102953 CEST	64363	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:59.846313000 CEST	51423	53	192.168.2.6	1.1.1.1
May 2, 2024 15:56:59.935082912 CEST	53	51423	1.1.1.1	192.168.2.6
May 2, 2024 15:56:59.935396910 CEST	53	64363	1.1.1.1	192.168.2.6
May 2, 2024 15:57:02.293903112 CEST	53	52383	1.1.1.1	192.168.2.6
May 2, 2024 15:57:04.784482002 CEST	52212	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:04.784847975 CEST	63119	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:04.876395941 CEST	53	52212	1.1.1.1	192.168.2.6
May 2, 2024 15:57:04.876606941 CEST	53	63119	1.1.1.1	192.168.2.6
May 2, 2024 15:57:04.910130978 CEST	65255	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:04.910356998 CEST	53582	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:05.012082100 CEST	53	65255	1.1.1.1	192.168.2.6
May 2, 2024 15:57:05.091424942 CEST	53	53582	1.1.1.1	192.168.2.6
May 2, 2024 15:57:18.548336029 CEST	63071	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:18.548635960 CEST	58369	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:18.635957003 CEST	53	63071	1.1.1.1	192.168.2.6
May 2, 2024 15:57:18.636905909 CEST	53	58369	1.1.1.1	192.168.2.6
May 2, 2024 15:57:23.535645962 CEST	53	64547	1.1.1.1	192.168.2.6
May 2, 2024 15:57:25.081613064 CEST	63048	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:25.082619905 CEST	50823	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:25.170461893 CEST	53	63048	1.1.1.1	192.168.2.6
May 2, 2024 15:57:25.171756029 CEST	53	64089	1.1.1.1	192.168.2.6
May 2, 2024 15:57:25.175432920 CEST	53	50823	1.1.1.1	192.168.2.6
May 2, 2024 15:57:25.290771008 CEST	61769	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:25.291107893 CEST	57494	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:25.462394953 CEST	53	57494	1.1.1.1	192.168.2.6
May 2, 2024 15:57:27.342763901 CEST	58556	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:27.343950987 CEST	54385	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:27.431298018 CEST	53	58556	1.1.1.1	192.168.2.6
May 2, 2024 15:57:27.431621075 CEST	53	54385	1.1.1.1	192.168.2.6
May 2, 2024 15:57:37.027710915 CEST	53	62901	1.1.1.1	192.168.2.6
May 2, 2024 15:57:39.755161047 CEST	51575	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:39.755325079 CEST	59837	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:39.847332954 CEST	53	59837	1.1.1.1	192.168.2.6
May 2, 2024 15:57:42.762052059 CEST	62565	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:42.762304068 CEST	50328	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:42.853641033 CEST	53	50328	1.1.1.1	192.168.2.6
May 2, 2024 15:57:48.817579985 CEST	53	61069	1.1.1.1	192.168.2.6
May 2, 2024 15:57:57.337201118 CEST	55311	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:57.337201118 CEST	64670	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:57.426706076 CEST	53	55311	1.1.1.1	192.168.2.6
May 2, 2024 15:57:57.426796913 CEST	53	64670	1.1.1.1	192.168.2.6
May 2, 2024 15:57:57.427624941 CEST	53	63191	1.1.1.1	192.168.2.6
May 2, 2024 15:57:57.795627117 CEST	57367	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:57.795768023 CEST	51379	53	192.168.2.6	1.1.1.1
May 2, 2024 15:57:57.883528948 CEST	53	51379	1.1.1.1	192.168.2.6
May 2, 2024 15:57:57.884078026 CEST	53	57367	1.1.1.1	192.168.2.6
May 2, 2024 15:57:58.405225039 CEST	53	63896	1.1.1.1	192.168.2.6

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 2, 2024 15:56:53.317960024 CEST	192.168.2.6	1.1.1.1	c22a	(Port unreachable)	Destination Unreachable
May 2, 2024 15:57:05.091486931 CEST	192.168.2.6	1.1.1.1	c22a	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:39 UTC	532	OUT	GET /smart-tag/uptodown-ng.js HTTP/1.1 Host: ssm.codes Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://it.uptodown.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:39 UTC	834	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 13:56:39 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: public, max-age=3600 Cf-Bgj: minify Cf-Polished: origSize=117516 last-modified: Mon, 04 Mar 2024 09:46:17 GMT vary: Accept-Encoding x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block CF-Cache-Status: HIT Age: 22623 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6fjLLLpDFzDvBFqlQ2zcGu%2Bw4onVy7Fon5KlSumkR0QMilDrTySszRIPLwe9gv2tTKDGa8UQ%2FV6kBPamd6xHB93YisAK0dcfvudKKfMfJjPF3WPPkBZelTTHUQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d88413fb280f7f-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 13:56:39 UTC	535	IN	Data Raw: 37 63 36 66 0d 0a 77 69 6e 64 6f 77 2e 73 73 6d 5f 63 6f 6e 66 69 67 3d 7b 22 74 61 72 67 65 74 69 6e 67 4b 65 79 22 3a 22 35 31 5f 75 70 74 6f 64 6f 77 22 2c 22 72 75 6e 5f 63 6f 6e 64 69 74 69 6f 6e 22 3a 22 74 72 75 65 22 2c 22 67 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 74 61 72 67 65 74 69 6e 67 22 3a 7b 7d 2c 22 6d 61 78 5f 72 65 66 72 65 73 68 5f 73 65 73 73 69 6f 6e 22 3a 35 2c 22 68 61 73 5f 73 63 68 61 69 6e 22 3a 74 72 75 65 2c 22 73 63 68 61 69 6e 5f 63 6f 6e 66 69 67 22 3a 7b 22 6e 61 6d 65 22 3a 22 55 70 74 6f 64 6f 77 6e 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 2c 20 53 2e 4c 2e 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 75 70 74 6f 64 6f 77 6e 2e 63 6f 6d 22 2c 22 73 65 6c 6c 65 72 5f 69 64 22 3a 22 63 30 35 38 66 35 34 34 63 37 33 37 Data Ascii: 7c6fwindow.ssm_config={"targetingKey":"51_uptodow","run_condition":"true","geolocation":true,"targeting":{},"max_refresh_session":5,"has_schain":true,"schain_config":{"name":"Uptodown Technologies, S.L.","domain":"uptodown.com","seller_id":"c058f544c737
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 6c 5f 32 5f 61 64 27 29 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 20 3d 20 27 73 74 69 63 6b 79 27 5c 72 5c 6e 5c 74 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 23 6c 61 74 65 72 61 6c 5f 32 5f 61 64 27 29 2e 73 74 79 6c 65 2e 74 6f 70 20 3d 20 27 31 30 70 78 27 5c 72 5c 6e 7d 5c 72 5c 6e 5c 72 5c 6e 69 66 28 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 23 6c 61 74 65 72 61 6c 5f 61 64 27 29 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 62 75 74 74 6f 6e 23 64 65 74 61 69 6c 2d 64 6f 77 6e 6c 6f 61 64 2d 62 75 74 74 6f 6e 5c 22 29 29 20 7b 5c 72 5c 6e 5c 74 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 23 6c 61 74 65 72 61 6c 5f 61 Data Ascii: l_2_ad').style.position = 'sticky'\r\n\tdocument.querySelector('#lateral_2_ad').style.top = '10px'\r\n}\r\n\r\nif(document.querySelector('#lateral_ad') && document.querySelector(\"button#detail-download-button\")) {\r\n\tdocument.querySelector('#lateral_a
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 74 65 6d 70 74 73 5f 6f 6e 5f 65 6d 70 74 79 22 3a 6e 75 6c 6c 2c 22 64 65 6c 65 74 65 5f 68 6f 72 69 7a 6f 6e 74 61 6c 5f 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 69 73 5f 6c 69 6d 69 74 65 64 5f 61 64 73 22 3a 66 61 6c 73 65 2c 22 65 78 74 65 72 6e 61 6c 5f 72 75 6e 22 3a 66 61 6c 73 65 2c 22 6f 75 74 5f 70 61 67 65 5f 66 6f 72 6d 61 74 22 3a 6e 75 6c 6c 2c 22 6e 6f 5f 64 65 6c 65 74 65 5f 73 74 79 6c 65 5f 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 70 6c 61 63 65 6d 65 6e 74 5f 72 75 62 69 63 6f 6e 5f 73 73 70 22 3a 6e 75 6c 6c 2c 22 66 61 6c 6c 62 61 63 6b 22 3a 22 22 2c 22 63 72 65 61 74 69 76 65 50 72 65 62 69 64 73 22 3a 5b 5d 7d 5d 3b 77 69 6e 64 6f 77 2e 73 73 6d 5f 63 6f 6e 66 69 67 2e 76 61 72 73 3d 5b 5d 3b 77 69 6e 64 6f 77 2e 73 73 6d 5f Data Ascii: tempts_on_empty":null,"delete_horizontal_mobile":false,"is_limited_ads":false,"external_run":false,"out_page_format":null,"no_delete_style_empty":false,"placement_rubicon_ssp":null,"fallback":"","creativePrebids":[]}];window.ssm_config.vars=[];window.ssm_
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 61 63 6b 5f 65 78 70 6f 72 74 73 5f 5f 2c 22 68 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 61 66 65 45 76 61 6c 7d 29 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 2e 64 28 5f 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 5f 5f 2c 22 64 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 73 44 6f 63 75 6d 65 6e 74 52 65 61 64 79 7d 29 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 2e 64 28 5f 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 5f 5f 2c 22 6f 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 61 69 74 69 6e 67 49 6d 61 53 64 6b 7d 29 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 2e 64 28 5f 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 5f Data Ascii: ack_exports__,"h",(function(){return safeEval})),__webpack_require__.d(__webpack_exports__,"d",(function(){return isDocumentReady})),__webpack_require__.d(__webpack_exports__,"o",(function(){return waitingImaSdk})),__webpack_require__.d(__webpack_exports_
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 61 62 65 6c 5f 72 75 6e 74 69 6d 65 5f 72 65 67 65 6e 65 72 61 74 6f 72 5f 5f 57 45 42 50 41 43 4b 5f 49 4d 50 4f 52 54 45 44 5f 4d 4f 44 55 4c 45 5f 30 5f 5f 5f 64 65 66 61 75 6c 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 2e 6e 28 5f 62 61 62 65 6c 5f 72 75 6e 74 69 6d 65 5f 72 65 67 65 6e 65 72 61 74 6f 72 5f 5f 57 45 42 50 41 43 4b 5f 49 4d 50 4f 52 54 45 44 5f 4d 4f 44 55 4c 45 5f 30 5f 5f 29 3b 66 75 6e 63 74 69 6f 6e 20 5f 74 79 70 65 6f 66 28 65 29 7b 72 65 74 75 72 6e 28 5f 74 79 70 65 6f 66 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 Data Ascii: abel_runtime_regenerator__WEBPACK_IMPORTED_MODULE_0___default=__webpack_require__.n(_babel_runtime_regenerator__WEBPACK_IMPORTED_MODULE_0__);function _typeof(e){return(_typeof="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 65 74 75 72 6e 20 65 2e 61 62 72 75 70 74 28 22 72 65 74 75 72 6e 22 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 3d 5f 74 79 70 65 6f 66 28 77 69 6e 64 6f 77 2e 67 72 29 29 76 61 72 20 74 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 3d 5f 74 79 70 65 6f 66 28 77 69 6e 64 6f 77 2e 67 72 29 26 26 22 6f 62 6a 65 63 74 22 3d 3d 3d 5f 74 79 70 65 6f 66 28 77 69 6e 64 6f 77 2e 67 72 2e 61 75 74 68 29 26 26 22 6f 62 6a 65 63 74 22 3d 3d 3d 5f 74 79 70 65 6f 66 28 77 69 6e 64 6f 77 2e 67 72 2e 61 75 74 68 2e 6d 65 29 26 26 28 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 74 29 2c 65 28 29 29 7d 29 2c 31 30 30 29 3b 65 6c 73 65 20 65 28 Data Ascii: eturn e.abrupt("return",new Promise((function(e){if("object"!==_typeof(window.gr))var t=setInterval((function(){"object"===_typeof(window.gr)&&"object"===_typeof(window.gr.auth)&&"object"===_typeof(window.gr.auth.me)&&(clearInterval(t),e())}),100);else e(
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 6f 69 64 20 30 21 3d 3d 77 69 6e 64 6f 77 2e 5f 5f 74 63 66 61 70 69 26 26 65 28 29 3b 76 61 72 20 74 3d 31 30 2c 6e 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2b 3d 31 30 2c 28 76 6f 69 64 20 30 21 3d 3d 77 69 6e 64 6f 77 2e 5f 5f 74 63 66 61 70 69 7c 7c 74 3e 35 30 30 29 26 26 28 74 3e 35 30 30 3f 73 73 6d 53 6d 61 72 74 54 61 67 2e 6c 6f 67 28 22 74 63 66 61 70 69 20 6e 6f 74 20 66 6f 75 6e 64 22 2c 74 29 3a 73 73 6d 53 6d 61 72 74 54 61 67 2e 6c 6f 67 28 22 74 63 66 61 70 69 20 6c 6f 61 64 65 64 22 2c 74 29 2c 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 6e 29 2c 65 28 29 29 7d 29 2c 31 30 29 7d 29 29 29 3b 63 61 73 65 20 31 3a 63 61 73 65 22 Data Ascii: new Promise((function(e){void 0!==window.__tcfapi&&e();var t=10,n=setInterval((function(){t+=10,(void 0!==window.__tcfapi\|\|t>500)&&(t>500?ssmSmartTag.log("tcfapi not found",t):ssmSmartTag.log("tcfapi loaded",t),clearInterval(n),e())}),10)})));case 1:case"
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 7b 72 65 74 75 72 6e 28 5f 77 61 69 74 69 6e 67 50 77 74 3d 5f 61 73 79 6e 63 54 6f 47 65 6e 65 72 61 74 6f 72 28 5f 62 61 62 65 6c 5f 72 75 6e 74 69 6d 65 5f 72 65 67 65 6e 65 72 61 74 6f 72 5f 5f 57 45 42 50 41 43 4b 5f 49 4d 50 4f 52 54 45 44 5f 4d 4f 44 55 4c 45 5f 30 5f 5f 5f 64 65 66 61 75 6c 74 2e 61 2e 6d 61 72 6b 28 28 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 72 65 74 75 72 6e 20 5f 62 61 62 65 6c 5f 72 75 6e 74 69 6d 65 5f 72 65 67 65 6e 65 72 61 74 6f 72 5f 5f 57 45 42 50 41 43 4b 5f 49 4d 50 4f 52 54 45 44 5f 4d 4f 44 55 4c 45 5f 30 5f 5f 5f 64 65 66 61 75 6c 74 2e 61 2e 77 72 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 3b 3b 29 73 77 69 74 63 68 28 65 2e 70 72 65 76 3d 65 2e 6e 65 78 74 29 7b 63 61 73 65 20 30 3a 72 65 74 75 72 Data Ascii: {return(_waitingPwt=_asyncToGenerator(_babel_runtime_regenerator__WEBPACK_IMPORTED_MODULE_0___default.a.mark((function e(){return _babel_runtime_regenerator__WEBPACK_IMPORTED_MODULE_0___default.a.wrap((function(e){for(;;)switch(e.prev=e.next){case 0:retur
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 76 69 64 65 6f 2e 70 61 72 61 6d 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 3d 5f 74 79 70 65 6f 66 28 65 2e 76 69 64 65 6f 2e 70 61 72 61 6d 73 29 26 26 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 2e 76 69 64 65 6f 2e 70 61 72 61 6d 73 29 2e 6c 65 6e 67 74 68 26 26 28 65 2e 70 61 72 61 6d 73 2e 76 69 64 65 6f 3d 65 2e 76 69 64 65 6f 2e 70 61 72 61 6d 73 29 2c 7b 62 69 64 64 65 72 3a 65 2e 62 69 64 64 65 72 2c 70 61 72 61 6d 73 3a 65 2e 70 61 72 61 6d 73 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 66 69 6c 74 65 72 49 6e 64 65 78 65 73 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 65 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 6e 6c 79 49 6e 64 65 78 65 73 28 65 2c 74 29 7d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 73 73 6d 49 6e 41 72 72 61 79 28 65 Data Ascii: video.params&&"object"===_typeof(e.video.params)&&Object.keys(e.video.params).length&&(e.params.video=e.video.params),{bidder:e.bidder,params:e.params})}function filterIndexes(e,t){return e.map((function(e){return onlyIndexes(e,t)}))}function ssmInArray(e
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 75 6c 74 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 70 72 65 50 61 72 61 6d 73 29 7b 4f 62 6a 65 63 74 2e 6b 65 79 73 28 70 72 65 50 61 72 61 6d 73 2e 70 61 72 61 6d 73 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 70 61 72 61 6d 29 7b 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 70 72 65 50 61 72 61 6d 73 2e 70 61 72 61 6d 73 5b 70 61 72 61 6d 5d 26 26 2d 31 21 3d 3d 70 72 65 50 61 72 61 6d 73 2e 70 61 72 61 6d 73 5b 70 61 72 61 6d 5d 2e 69 6e 64 65 78 4f 66 28 22 66 75 6e 63 74 69 6f 6e 22 29 26 26 28 70 72 65 50 61 72 61 6d 73 2e 70 61 72 61 6d 73 5b 70 61 72 61 6d 5d 3d 65 76 61 6c 28 70 72 65 50 61 72 61 6d 73 2e 70 61 72 61 6d 73 5b 70 61 72 61 6d 5d 29 29 7d 29 29 7d 29 29 2c 76 61 6c 69 64 50 72 65 62 69 64 73 3d Data Ascii: ult.forEach((function(preParams){Object.keys(preParams.params).forEach((function(param){"string"==typeof preParams.params[param]&&-1!==preParams.params[param].indexOf("function")&&(preParams.params[param]=eval(preParams.params[param]))}))})),validPrebids=

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:39 UTC	544	OUT	GET /tag?o=5175773613260800&upapi=true HTTP/1.1 Host: btloader.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://it.uptodown.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:39 UTC	447	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 13:56:39 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Cache-Control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300 Etag: W/"717413da3b3f772bbba85ac095b277c0" Last-Modified: Thu, 02 May 2024 13:25:00 GMT Vary: Origin Via: 1.1 google CF-Cache-Status: HIT Age: 1788 Server: cloudflare CF-RAY: 87d88413fc2519bb-EWR
2024-05-02 13:56:39 UTC	922	IN	Data Raw: 37 64 65 32 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 31 2c 73 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 3c 73 3b 6e 2b 2b 29 66 6f 72 28 76 61 72 20 72 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 26 26 28 65 5b 72 5d 3d 74 5b 72 5d 29 3b 72 65 74 75 72 6e 20 65 7d 2c 65 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 74 28 65 Data Ascii: 7de2!function(){"use strict";var e=function(){return e=Object.assign\|\|function(e){for(var t,n=1,s=arguments.length;n<s;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},e.apply(this,arguments)};function t(e
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 6f 77 7c 7c 28 28 72 3d 73 2e 72 65 74 75 72 6e 29 26 26 72 2e 63 61 6c 6c 28 73 29 2c 30 29 3a 73 2e 6e 65 78 74 29 26 26 21 28 72 3d 72 2e 63 61 6c 6c 28 73 2c 69 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 72 3b 73 77 69 74 63 68 28 73 3d 30 2c 72 26 26 28 69 3d 5b 32 26 69 5b 30 5d 2c 72 2e 76 61 6c 75 65 5d 29 2c 69 5b 30 5d 29 7b 63 61 73 65 20 30 3a 63 61 73 65 20 31 3a 72 3d 69 3b 62 72 65 61 6b 3b 63 61 73 65 20 34 3a 72 65 74 75 72 6e 20 6f 2e 6c 61 62 65 6c 2b 2b 2c 7b 76 61 6c 75 65 3a 69 5b 31 5d 2c 64 6f 6e 65 3a 21 31 7d 3b 63 61 73 65 20 35 3a 6f 2e 6c 61 62 65 6c 2b 2b 2c 73 3d 69 5b 31 5d 2c 69 3d 5b 30 5d 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 20 37 3a 69 3d 6f 2e 6f 70 73 2e 70 6f 70 28 29 2c 6f 2e 74 72 79 73 2e 70 6f 70 Data Ascii: ow\|\|((r=s.return)&&r.call(s),0):s.next)&&!(r=r.call(s,i[1])).done)return r;switch(s=0,r&&(i=[2&i[0],r.value]),i[0]){case 0:case 1:r=i;break;case 4:return o.label++,{value:i[1],done:!1};case 5:o.label++,s=i[1],i=[0];continue;case 7:i=o.ops.pop(),o.trys.pop
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 76 6f 69 64 20 30 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 69 2c 61 2c 63 3b 72 65 74 75 72 6e 20 6e 28 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 73 77 69 74 63 68 28 6e 2e 6c 61 62 65 6c 29 7b 63 61 73 65 20 30 3a 72 65 74 75 72 6e 20 6e 2e 74 72 79 73 2e 70 75 73 68 28 5b 30 2c 33 2c 2c 34 5d 29 2c 77 69 6e 64 6f 77 2e 5f 5f 62 74 3d 77 69 6e 64 6f 77 2e 5f 5f 62 74 7c 7c 7b 7d 2c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 5f 5f 62 74 2e 63 75 73 74 6f 6d 44 65 74 65 63 74 41 64 42 6c 6f 63 6b 3f 5b 33 2c 32 5d 3a 5b 34 2c 77 69 6e 64 6f 77 2e 5f 5f 62 74 2e 63 75 73 74 6f 6d 44 65 74 65 63 74 41 64 42 6c 6f 63 6b 28 29 5d 3b 63 61 73 65 20 31 3a 72 65 74 75 72 6e 5b 32 2c 6e 2e 73 65 Data Ascii: void 0,(function(){var e,t,i,a,c;return n(this,(function(n){switch(n.label){case 0:return n.trys.push([0,3,,4]),window.__bt=window.__bt\|\|{},"function"!=typeof window.__bt.customDetectAdBlock?[3,2]:[4,window.__bt.customDetectAdBlock()];case 1:return[2,n.se
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 29 29 7d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 28 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 7c 7c 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 29 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 65 29 7d 76 61 72 20 75 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 77 69 6e 64 6f 77 3b 74 72 79 7b 69 66 28 74 6f 70 2e 64 6f 63 75 6d 65 6e 74 29 72 65 74 75 72 6e 20 74 6f 70 7d 63 61 74 63 68 28 65 29 7b 7d 74 72 79 7b 66 6f 72 28 3b 65 2e 70 61 72 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 3b 29 65 3d 65 2e 70 61 72 65 6e 74 7d 63 61 74 63 68 28 65 29 7b 7d 72 65 74 75 72 6e 20 65 7d 28 29 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 22 22 21 3d 3d Data Ascii: ))}))}function l(e){(window.document.body\|\|window.document.documentElement).removeChild(e)}var u=function(){var e=window;try{if(top.document)return top}catch(e){}try{for(;e.parent.document;)e=e.parent}catch(e){}return e}();var d=function(){try{return""!==
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 22 6e 61 6d 65 22 3a 22 22 2c 20 22 76 69 65 77 22 3a 22 22 2c 20 22 73 69 6e 67 6c 65 5f 63 6c 69 63 6b 5f 65 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 20 22 70 61 67 65 5f 76 69 65 77 73 5f 74 6f 5f 72 65 6e 64 65 72 22 3a 22 30 22 2c 20 22 70 72 65 6d 69 75 6d 5f 62 79 70 61 73 73 5f 6d 6f 64 65 5f 65 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 20 22 68 61 72 64 5f 6d 65 73 73 61 67 65 5f 77 61 6c 6c 5f 6d 6f 64 65 5f 65 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 20 22 61 6c 6c 6f 77 5f 72 65 6e 64 65 72 5f 74 6f 5f 61 61 5f 75 73 65 72 73 22 3a 66 61 6c 73 65 2c 20 22 6c 61 6e 64 69 6e 67 5f 74 65 78 74 5f 65 6e 22 3a 22 22 2c 20 22 63 74 61 5f 62 75 74 74 6f 6e 5f 63 6f 6c 6f 72 22 3a 22 22 2c 20 22 66 6f 6e 74 5f 74 79 70 65 22 3a 22 22 2c 20 22 72 65 Data Ascii: "name":"", "view":"", "single_click_enabled":false, "page_views_to_render":"0", "premium_bypass_mode_enabled":false, "hard_message_wall_mode_enabled":false, "allow_render_to_aa_users":false, "landing_text_en":"", "cta_button_color":"", "font_type":"", "re
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 49 44 22 3b 64 3f 75 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 75 6e 6c 6f 61 64 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 75 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 72 65 6d 6f 76 65 49 74 65 6d 28 65 29 2c 75 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 72 65 6d 6f 76 65 49 74 65 6d 28 74 29 7d 29 29 3a 28 75 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 72 65 6d 6f 76 65 49 74 65 6d 28 65 29 2c 75 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 72 65 6d 6f 76 65 49 74 65 6d 28 74 29 29 7d 28 29 3b 76 61 72 20 41 3d 28 6e 75 6c 6c 3d 3d 3d 28 62 3d 75 2e 5f 5f 62 74 5f 69 6e 74 72 6e 6c 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 62 3f 76 6f 69 64 20 30 3a 62 2e 74 72 61 63 65 49 44 29 7c 7c 68 28 22 42 54 5f 74 72 61 63 65 49 44 22 Data Ascii: ID";d?u.addEventListener("unload",(function(){u.sessionStorage.removeItem(e),u.sessionStorage.removeItem(t)})):(u.sessionStorage.removeItem(e),u.sessionStorage.removeItem(t))}();var A=(null===(b=u.__bt_intrnl)\|\|void 0===b?void 0:b.traceID)\|\|h("BT_traceID"
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 6e 66 69 67 22 29 29 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 73 65 74 28 22 62 74 5f 65 6e 76 22 2c 4c 2e 62 74 5f 65 6e 76 7c 7c 22 70 72 6f 64 22 29 2c 76 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 73 65 74 28 22 6f 22 2c 77 29 2c 76 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 73 65 74 28 22 77 22 2c 67 29 2c 6e 2e 6c 61 62 65 6c 3d 31 3b 63 61 73 65 20 31 3a 72 65 74 75 72 6e 20 6e 2e 74 72 79 73 2e 70 75 73 68 28 5b 31 2c 34 2c 2c 35 5d 29 2c 5b 34 2c 66 65 74 63 68 28 76 2e 74 6f 53 74 72 69 6e 67 28 29 29 5d 3b 63 61 73 65 20 32 3a 69 66 28 21 28 62 3d 6e 2e 73 65 6e 74 28 29 29 2e 6f 6b 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 3b 72 65 74 75 72 6e 5b 34 2c 62 2e 6a 73 6f 6e 28 29 5d 3b 63 61 73 65 20 33 3a 72 65 74 75 72 6e 20 45 3d 6e 2e 73 Data Ascii: nfig")).searchParams.set("bt_env",L.bt_env\|\|"prod"),v.searchParams.set("o",w),v.searchParams.set("w",g),n.label=1;case 1:return n.trys.push([1,4,,5]),[4,fetch(v.toString())];case 2:if(!(b=n.sent()).ok)throw new Error;return[4,b.json()];case 3:return E=n.s
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 6f 77 2e 54 65 78 74 45 6e 63 6f 64 65 72 29 56 3d 28 6e 65 77 20 77 69 6e 64 6f 77 2e 54 65 78 74 45 6e 63 6f 64 65 72 29 2e 65 6e 63 6f 64 65 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 44 29 29 2e 62 75 66 66 65 72 3b 65 6c 73 65 7b 66 6f 72 28 50 3d 75 6e 65 73 63 61 70 65 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 44 29 29 29 2c 6b 3d 6e 65 77 20 55 69 6e 74 38 41 72 72 61 79 28 50 2e 6c 65 6e 67 74 68 29 2c 78 3d 30 3b 78 3c 50 2e 6c 65 6e 67 74 68 3b 78 2b 2b 29 6b 5b 78 5d 3d 50 2e 63 68 61 72 43 6f 64 65 41 74 28 78 29 3b 56 3d 6b 2e 62 75 66 66 65 72 7d 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 73 29 7b 76 Data Ascii: ow.TextEncoder)V=(new window.TextEncoder).encode(JSON.stringify(D)).buffer;else{for(P=unescape(encodeURIComponent(JSON.stringify(D))),k=new Uint8Array(P.length),x=0;x<P.length;x++)k[x]=P.charCodeAt(x);V=k.buffer}!function(e,t){new Promise((function(n,s){v
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 22 2c 32 30 5d 2c 5b 22 56 22 2c 32 31 5d 2c 5b 22 57 22 2c 32 32 5d 2c 5b 22 58 22 2c 32 33 5d 2c 5b 22 59 22 2c 32 34 5d 2c 5b 22 5a 22 2c 32 35 5d 2c 5b 22 61 22 2c 32 36 5d 2c 5b 22 62 22 2c 32 37 5d 2c 5b 22 63 22 2c 32 38 5d 2c 5b 22 64 22 2c 32 39 5d 2c 5b 22 65 22 2c 33 30 5d 2c 5b 22 66 22 2c 33 31 5d 2c 5b 22 67 22 2c 33 32 5d 2c 5b 22 68 22 2c 33 33 5d 2c 5b 22 69 22 2c 33 34 5d 2c 5b 22 6a 22 2c 33 35 5d 2c 5b 22 6b 22 2c 33 36 5d 2c 5b 22 6c 22 2c 33 37 5d 2c 5b 22 6d 22 2c 33 38 5d 2c 5b 22 6e 22 2c 33 39 5d 2c 5b 22 6f 22 2c 34 30 5d 2c 5b 22 70 22 2c 34 31 5d 2c 5b 22 71 22 2c 34 32 5d 2c 5b 22 72 22 2c 34 33 5d 2c 5b 22 73 22 2c 34 34 5d 2c 5b 22 74 22 2c 34 35 5d 2c 5b 22 75 22 2c 34 36 5d 2c 5b 22 76 22 2c 34 37 5d 2c 5b 22 77 22 2c 34 Data Ascii: ",20],["V",21],["W",22],["X",23],["Y",24],["Z",25],["a",26],["b",27],["c",28],["d",29],["e",30],["f",31],["g",32],["h",33],["i",34],["j",35],["k",36],["l",37],["m",38],["n",39],["o",40],["p",41],["q",42],["r",43],["s",44],["t",45],["u",46],["v",47],["w",4
2024-05-02 13:56:39 UTC	1369	IN	Data Raw: 74 29 7d 7b 63 6f 6e 73 74 20 74 3d 7b 7d 3b 66 6f 72 28 63 6f 6e 73 74 20 6e 20 69 6e 20 65 29 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 6e 29 26 26 28 74 5b 6e 5d 3d 74 68 69 73 2e 64 65 65 70 43 6c 6f 6e 65 28 65 5b 6e 5d 29 29 3b 72 65 74 75 72 6e 20 74 7d 7d 7d 7d 63 6c 61 73 73 20 6a 20 65 78 74 65 6e 64 73 20 48 7b 72 6f 6f 74 3d 6e 75 6c 6c 3b 67 65 74 52 6f 6f 74 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 72 6f 6f 74 7d 69 73 45 6d 70 74 79 28 29 7b 72 65 74 75 72 6e 21 74 68 69 73 2e 72 6f 6f 74 7d 61 64 64 28 65 29 7b 63 6f 6e 73 74 20 74 3d 7b 76 61 6c 75 65 3a 65 2c 6c 65 66 74 3a 6e 75 6c 6c 2c 72 69 67 68 74 3a 6e 75 6c 6c 7d 3b 6c 65 74 20 6e 3b 69 66 28 74 68 69 73 2e 69 73 45 6d 70 74 79 28 29 29 74 68 69 73 2e 72 6f 6f 74 3d Data Ascii: t)}{const t={};for(const n in e)e.hasOwnProperty(n)&&(t[n]=this.deepClone(e[n]));return t}}}}class j extends H{root=null;getRoot(){return this.root}isEmpty(){return!this.root}add(e){const t={value:e,left:null,right:null};let n;if(this.isEmpty())this.root=

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:41 UTC	602	OUT	GET /s/a52be48a31f50475bd697e1db8507f9d.js?country=no-is-li-gb-ch-br&state=ca&region=eu HTTP/1.1 Host: geo.cookie-script.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://it.uptodown.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:41 UTC	199	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Content-Type: application/javascript X-Cache-Status: RESET JS Date: Thu, 02 May 2024 13:56:41 GMT Connection: close Transfer-Encoding: chunked
2024-05-02 13:56:41 UTC	987	IN	Data Raw: 66 38 30 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 27 5b 64 61 74 61 2d 63 6f 6f 6b 69 65 73 63 72 69 70 74 3d 22 61 63 63 65 70 74 65 64 22 5d 27 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 72 79 7b 76 61 72 20 61 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 45 76 65 6e 74 3f 61 3d 6e 65 77 20 43 75 73 74 6f 6d 45 76 65 6e 74 28 74 2c 7b 62 75 62 62 6c 65 73 3a 21 30 2c 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 2c 64 65 74 61 69 6c 3a 65 7d 29 3a 28 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 43 75 73 74 6f 6d 45 76 65 6e 74 22 29 29 2e 69 6e 69 74 43 75 73 74 6f 6d 45 76 65 6e 74 28 74 2c 21 30 2c 21 30 2c 65 29 2c 77 69 6e 64 6f 77 2e Data Ascii: f80!function(){var t=function(){var t='[data-cookiescript="accepted"]',e=function(t,e){try{var a;"function"==typeof Event?a=new CustomEvent(t,{bubbles:!0,cancelable:!0,detail:e}):(a=document.createEvent("CustomEvent")).initCustomEvent(t,!0,!0,e),window.
2024-05-02 13:56:41 UTC	2372	IN	Data Raw: 72 61 6e 74 65 64 22 7d 29 2c 65 3f 28 6f 28 65 2c 22 61 64 5f 70 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 29 26 26 67 74 61 67 28 22 63 6f 6e 73 65 6e 74 22 2c 74 2c 7b 61 64 5f 70 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 3a 22 67 72 61 6e 74 65 64 22 7d 29 2c 6f 28 65 2c 22 61 64 5f 75 73 65 72 5f 64 61 74 61 22 29 26 26 67 74 61 67 28 22 63 6f 6e 73 65 6e 74 22 2c 74 2c 7b 61 64 5f 75 73 65 72 5f 64 61 74 61 3a 22 67 72 61 6e 74 65 64 22 7d 29 29 3a 28 67 74 61 67 28 22 63 6f 6e 73 65 6e 74 22 2c 74 2c 7b 61 64 5f 70 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 3a 22 67 72 61 6e 74 65 64 22 7d 29 2c 67 74 61 67 28 22 63 6f 6e 73 65 6e 74 22 2c 74 2c 7b 61 64 5f 75 73 65 72 5f 64 61 74 61 3a 22 67 72 61 6e 74 65 64 22 7d 29 29 2c 67 74 61 67 28 22 63 Data Ascii: ranted"}),e?(o(e,"ad_personalization")&&gtag("consent",t,{ad_personalization:"granted"}),o(e,"ad_user_data")&&gtag("consent",t,{ad_user_data:"granted"})):(gtag("consent",t,{ad_personalization:"granted"}),gtag("consent",t,{ad_user_data:"granted"})),gtag("c
2024-05-02 13:56:41 UTC	538	IN	Data Raw: 2d 74 61 72 67 65 74 69 6e 67 22 2c 22 43 6f 6f 6b 69 65 53 63 72 69 70 74 43 61 74 65 67 6f 72 79 2d 70 65 72 66 6f 72 6d 61 6e 63 65 22 2c 22 43 6f 6f 6b 69 65 53 63 72 69 70 74 43 61 74 65 67 6f 72 79 2d 66 75 6e 63 74 69 6f 6e 61 6c 69 74 79 22 2c 22 43 6f 6f 6b 69 65 53 63 72 69 70 74 43 61 74 65 67 6f 72 79 2d 75 6e 63 6c 61 73 73 69 66 69 65 64 22 2c 22 43 6f 6f 6b 69 65 53 63 72 69 70 74 43 61 74 65 67 6f 72 79 2d 61 6c 6c 22 5d 2c 65 3d 30 3b 65 3c 74 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 7b 65 76 65 6e 74 3a 74 5b 65 5d 7d 29 7d 28 29 2c 6e 28 22 75 70 64 61 74 65 22 29 2c 77 69 6e 64 6f 77 2e 66 62 71 26 26 66 62 71 28 22 63 6f 6e 73 65 6e 74 22 2c 22 67 72 61 6e 74 22 29 2c 66 75 Data Ascii: -targeting","CookieScriptCategory-performance","CookieScriptCategory-functionality","CookieScriptCategory-unclassified","CookieScriptCategory-all"],e=0;e<t.length;e++)window.dataLayer.push({event:t[e]})}(),n("update"),window.fbq&&fbq("consent","grant"),fu
2024-05-02 13:56:41 UTC	83	IN	Data Raw: 7d 3b 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 3f 74 28 29 3a 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 74 29 7d 28 29 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: };"complete"===document.readyState?t():window.addEventListener("load",t)}();0

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:41 UTC	585	OUT	GET /px.gif?ch=2 HTTP/1.1 Host: ad-delivery.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://it.uptodown.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:41 UTC	1216	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 13:56:41 GMT Content-Type: image/gif Content-Length: 43 Connection: close X-GUploader-UploadID: ABPtcPof8oVZy8f-YawZYTApO5mAq3xTkpTgU5AAGDdN2ngyWVPi1E3pZwAWofBj9c1HY-4-Yxw x-goog-generation: 1620242732037093 x-goog-metageneration: 5 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 43 x-goog-hash: crc32c=cpEfJQ== x-goog-hash: md5=rUsPYG4PhGW8TEwXCzfhow== x-goog-storage-class: MULTI_REGIONAL Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace Expires: Fri, 03 May 2024 13:56:41 GMT Cache-Control: public, max-age=86400 Age: 50 Last-Modified: Wed, 05 May 2021 19:25:32 GMT ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3" CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ciS%2BDHZRVcdC1y0U78VYNuA1tetg8yNNfMC4xhIb3B7IAY28god2pM9ETlFmPADU8HPI5KiTDHtvb9QcGoVpnPs6eVgB1GHwwCuDlMTUPX7vIwCUYH2rjiNiStDW%2Bgaylw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d8841deb740f81-EWR
2024-05-02 13:56:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:41 UTC	564	OUT	GET /mw/state?bt_env=prod HTTP/1.1 Host: api.btloader.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://it.uptodown.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://it.uptodown.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:41 UTC	203	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Vary: Origin Date: Thu, 02 May 2024 13:56:41 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:41 UTC	716	OUT	GET /favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://it.uptodown.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:41 UTC	746	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-doubleclick-media" Report-To: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} Content-Length: 1078 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 01 May 2024 16:26:51 GMT Expires: Thu, 02 May 2024 16:26:51 GMT Cache-Control: public, max-age=86400 Last-Modified: Tue, 08 May 2012 13:08:06 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 77390 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-02 13:56:41 UTC	509	IN	Data Raw: 00 00 01 00 02 00 10 10 10 00 00 00 00 00 28 01 00 00 26 00 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 4e 01 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 04 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 Data Ascii: (& N(
2024-05-02 13:56:41 UTC	569	IN	Data Raw: 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:41 UTC	559	OUT	GET /cdn-cgi/trace HTTP/1.1 Host: www.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://it.uptodown.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://it.uptodown.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:41 UTC	332	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 13:56:41 GMT Content-Type: text/plain Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 87d884208e95c324-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache
2024-05-02 13:56:41 UTC	317	IN	Data Raw: 31 33 36 0d 0a 66 6c 3d 31 31 66 35 34 34 0a 68 3d 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 0a 74 73 3d 31 37 31 34 36 35 38 32 30 31 2e 36 38 36 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 31 37 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 0a 63 6f 6c 6f 3d 45 57 52 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c Data Ascii: 136fl=11f544h=www.cloudflare.comip=191.96.150.225ts=1714658201.686visit_scheme=httpsuag=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36colo=EWRsliver=nonehttp=http/1.1loc=UStls=TL
2024-05-02 13:56:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://it.uptodown.com/android/shopping

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Windows Analysis Report
https://it.uptodown.com/android/shopping

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:42 UTC	606	OUT	GET /px.gif?ch=1&e=0.3246888217459225 HTTP/1.1 Host: ad-delivery.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://it.uptodown.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:43 UTC	1238	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 13:56:43 GMT Content-Type: image/gif Content-Length: 43 Connection: close X-GUploader-UploadID: ABPtcPpZTUTu4e6c_efmOyuszwoX1p9ak88nGPSMqWu-Q_qLOm3xr7pZAf6cQUOjfGR7q1Msd5GZ-lcMog x-goog-generation: 1620242732037093 x-goog-metageneration: 5 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 43 x-goog-hash: crc32c=cpEfJQ== x-goog-hash: md5=rUsPYG4PhGW8TEwXCzfhow== x-goog-storage-class: MULTI_REGIONAL Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace Expires: Fri, 03 May 2024 13:56:43 GMT Cache-Control: public, max-age=86400 Age: 1310086 Last-Modified: Wed, 05 May 2021 19:25:32 GMT ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3" CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8MQZ8Ogwf%2FYgB%2BcrARDzxFyRLha2Osf%2BoYH258EmYaBc5%2FhTWRoqD0FRPhO6%2BK7yr%2FMcMTIGfBdsHs1bS96Sd4OxmtRaePF7D8Te11SP8c6JcZycNZX%2B2meGLXf7BZ5l2w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d884290b8e43a9-EWR
2024-05-02 13:56:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:47 UTC	536	OUT	GET /utd/utd-campaigns.js HTTP/1.1 Host: scripts.ssm.codes Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://it.uptodown.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:47 UTC	1188	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 13:56:47 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Cf-Bgj: minify Cf-Polished: origSize=62296 access-control-allow-origin: * access-control-expose-headers: Content-Type alt-svc: h3=":443"; ma=86400 etag: W/"7f5cc61e75cb5122f0378598a31df56d" last-modified: Mon, 29 Apr 2024 10:53:33 GMT vary: Accept-Encoding x-goog-generation: 1714388013401202 x-goog-hash: crc32c=pGAaXw== x-goog-hash: md5=f1zGHnXLUSLwN4WYox31bQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 62296 x-guploader-uploadid: ABPtcPp5btagxX-Y2NpcDr_HBGjogSqGuedSxmN1FK94JTyrX10gv0g8GyxlrgB7yBCZOEiFvdo CF-Cache-Status: HIT Age: 10904 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UvwhGUj12u9p8abMAJZrnVUrdgvHDB1ZsHtiNmlnXMUeOfdtfKxVbaD4xndHWYLcj2C%2F%2BRkv6HHEeOKvba1vtD31Np5SuRZSUnG7M9pq%2FCZV1cydE0LYdpEYaP0GiBZXmzW7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d884470fe678d9-EWR
2024-05-02 13:56:47 UTC	181	IN	Data Raw: 37 61 63 64 0d 0a 77 69 6e 64 6f 77 2e 73 73 6d 43 61 6d 70 61 69 67 6e 73 3d 7b 22 63 61 6d 70 61 69 67 6e 73 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 31 30 35 34 2c 22 75 75 69 64 22 3a 22 66 63 31 65 38 33 30 64 2d 63 38 62 35 2d 34 64 39 64 2d 38 61 32 31 2d 33 64 36 34 33 35 66 33 65 32 38 32 22 2c 22 63 70 6d 22 3a 6e 75 6c 6c 2c 22 70 6c 61 74 66 6f 72 6d 22 3a 22 61 6e 64 72 6f 69 64 22 2c 22 64 65 76 69 63 65 22 3a 22 62 6f 74 68 22 2c 22 63 6f 75 6e 74 72 69 65 73 22 3a 22 61 6c 6c 22 2c 22 73 69 7a 65 73 22 3a 5b Data Ascii: 7acdwindow.ssmCampaigns={"campaigns":[{"campaign_id":1054,"uuid":"fc1e830d-c8b5-4d9d-8a21-3d6435f3e282","cpm":null,"platform":"android","device":"both","countries":"all","sizes":[
2024-05-02 13:56:47 UTC	1369	IN	Data Raw: 5b 33 30 30 2c 32 35 30 5d 2c 5b 37 32 38 2c 39 30 5d 5d 2c 22 62 61 6e 6e 65 72 73 5f 75 72 6c 73 22 3a 7b 22 64 65 22 3a 7b 22 37 32 38 78 39 30 22 3a 5b 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 63 72 69 70 74 73 2e 73 73 6d 2e 63 6f 64 65 73 5c 2f 64 69 73 74 5c 2f 75 74 64 2d 6e 6f 72 64 56 50 4e 5c 2f 66 61 73 74 65 72 2d 74 68 61 6e 2d 65 76 65 72 2d 64 65 2d 37 32 38 78 39 30 2e 70 6e 67 22 5d 2c 22 33 30 30 78 32 35 30 22 3a 5b 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 63 72 69 70 74 73 2e 73 73 6d 2e 63 6f 64 65 73 5c 2f 64 69 73 74 5c 2f 75 74 64 2d 6e 6f 72 64 56 50 4e 5c 2f 66 61 73 74 65 72 2d 74 68 61 6e 2d 65 76 65 72 2d 64 65 2d 33 30 30 78 32 35 30 2e 70 6e 67 22 5d 7d 2c 22 65 6e 22 3a 7b 22 37 32 38 78 39 30 22 3a 5b 22 68 74 74 70 73 3a 5c 2f 5c Data Ascii: [300,250],[728,90]],"banners_urls":{"de":{"728x90":["https:\/\/scripts.ssm.codes\/dist\/utd-nordVPN\/faster-than-ever-de-728x90.png"],"300x250":["https:\/\/scripts.ssm.codes\/dist\/utd-nordVPN\/faster-than-ever-de-300x250.png"]},"en":{"728x90":["https:\/\
2024-05-02 13:56:47 UTC	1369	IN	Data Raw: 64 65 78 22 3a 66 61 6c 73 65 2c 22 66 72 65 71 75 65 6e 63 79 5f 63 61 70 22 3a 6e 75 6c 6c 2c 22 74 79 70 65 22 3a 22 68 6f 75 73 65 22 2c 22 70 65 72 63 65 6e 74 61 67 65 22 3a 31 30 30 7d 2c 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 31 30 35 35 2c 22 75 75 69 64 22 3a 22 30 35 31 37 30 66 30 63 2d 32 61 62 66 2d 34 31 34 65 2d 62 65 65 38 2d 65 62 38 38 33 39 36 64 30 31 65 32 22 2c 22 63 70 6d 22 3a 6e 75 6c 6c 2c 22 70 6c 61 74 66 6f 72 6d 22 3a 22 6d 61 63 6f 73 22 2c 22 64 65 76 69 63 65 22 3a 22 62 6f 74 68 22 2c 22 63 6f 75 6e 74 72 69 65 73 22 3a 22 61 6c 6c 22 2c 22 73 69 7a 65 73 22 3a 5b 5b 33 30 30 2c 32 35 30 5d 2c 5b 37 32 38 2c 39 30 5d 5d 2c 22 62 61 6e 6e 65 72 73 5f 75 72 6c 73 22 3a 7b 22 64 65 22 3a 7b 22 37 32 38 78 39 30 22 3a Data Ascii: dex":false,"frequency_cap":null,"type":"house","percentage":100},{"campaign_id":1055,"uuid":"05170f0c-2abf-414e-bee8-eb88396d01e2","cpm":null,"platform":"macos","device":"both","countries":"all","sizes":[[300,250],[728,90]],"banners_urls":{"de":{"728x90":
2024-05-02 13:56:47 UTC	1369	IN	Data Raw: 61 73 74 65 72 2d 74 68 61 6e 2d 65 76 65 72 2d 70 74 2d 37 32 38 78 39 30 2e 70 6e 67 22 5d 2c 22 33 30 30 78 32 35 30 22 3a 5b 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 63 72 69 70 74 73 2e 73 73 6d 2e 63 6f 64 65 73 5c 2f 64 69 73 74 5c 2f 75 74 64 2d 6e 6f 72 64 56 50 4e 5c 2f 66 61 73 74 65 72 2d 74 68 61 6e 2d 65 76 65 72 2d 70 74 2d 33 30 30 78 32 35 30 2e 70 6e 67 22 5d 7d 7d 2c 22 61 76 61 69 6c 61 62 69 6c 69 74 79 22 3a 30 2c 22 64 69 73 70 6c 61 79 65 64 22 3a 32 35 37 33 2c 22 70 72 69 6f 72 69 74 79 22 3a 31 2c 22 65 78 63 6c 75 64 65 5f 63 6f 75 6e 74 72 69 65 73 22 3a 66 61 6c 73 65 2c 22 61 64 65 78 22 3a 66 61 6c 73 65 2c 22 66 72 65 71 75 65 6e 63 79 5f 63 61 70 22 3a 6e 75 6c 6c 2c 22 74 79 70 65 22 3a 22 68 6f 75 73 65 22 2c 22 70 65 72 63 Data Ascii: aster-than-ever-pt-728x90.png"],"300x250":["https:\/\/scripts.ssm.codes\/dist\/utd-nordVPN\/faster-than-ever-pt-300x250.png"]}},"availability":0,"displayed":2573,"priority":1,"exclude_countries":false,"adex":false,"frequency_cap":null,"type":"house","perc
2024-05-02 13:56:47 UTC	1369	IN	Data Raw: 64 56 50 4e 5c 2f 66 61 73 74 65 72 2d 74 68 61 6e 2d 65 76 65 72 2d 69 74 2d 33 30 30 78 32 35 30 2e 70 6e 67 22 5d 7d 2c 22 6a 70 22 3a 7b 22 37 32 38 78 39 30 22 3a 5b 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 63 72 69 70 74 73 2e 73 73 6d 2e 63 6f 64 65 73 5c 2f 64 69 73 74 5c 2f 75 74 64 2d 6e 6f 72 64 56 50 4e 5c 2f 67 65 6e 65 72 69 63 2d 62 61 6e 6e 65 72 73 2d 37 32 38 78 39 30 2d 6a 70 2e 70 6e 67 22 5d 7d 2c 22 70 74 22 3a 7b 22 37 32 38 78 39 30 22 3a 5b 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 63 72 69 70 74 73 2e 73 73 6d 2e 63 6f 64 65 73 5c 2f 64 69 73 74 5c 2f 75 74 64 2d 6e 6f 72 64 56 50 4e 5c 2f 66 61 73 74 65 72 2d 74 68 61 6e 2d 65 76 65 72 2d 70 74 2d 37 32 38 78 39 30 2e 70 6e 67 22 5d 2c 22 33 30 30 78 32 35 30 22 3a 5b 22 68 74 74 70 73 3a Data Ascii: dVPN\/faster-than-ever-it-300x250.png"]},"jp":{"728x90":["https:\/\/scripts.ssm.codes\/dist\/utd-nordVPN\/generic-banners-728x90-jp.png"]},"pt":{"728x90":["https:\/\/scripts.ssm.codes\/dist\/utd-nordVPN\/faster-than-ever-pt-728x90.png"],"300x250":["https:
2024-05-02 13:56:47 UTC	1369	IN	Data Raw: 65 2c 22 64 69 73 70 6c 61 79 5f 6f 6e 22 3a 22 64 65 73 6b 74 6f 70 22 2c 22 72 75 6e 5f 63 6f 6e 64 69 74 69 6f 6e 22 3a 22 74 72 75 65 22 2c 22 6c 6f 63 61 74 69 6f 6e 22 3a 22 62 65 66 6f 72 65 22 2c 22 6c 6f 61 64 22 3a 22 73 63 72 65 65 6e 22 7d 2c 7b 22 69 64 22 3a 35 37 32 36 2c 22 6e 61 6d 65 22 3a 22 63 61 72 64 5f 61 64 22 2c 22 74 79 70 65 22 3a 22 63 75 73 74 6f 6d 22 2c 22 61 64 63 6f 64 65 22 3a 22 63 61 72 64 5f 61 64 22 2c 22 73 69 7a 65 73 22 3a 5b 5b 33 30 30 2c 32 35 30 5d 2c 5b 37 32 38 2c 39 30 5d 5d 2c 22 73 65 6c 65 63 74 6f 72 22 3a 22 23 63 61 72 64 5f 61 64 22 2c 22 64 69 73 70 6c 61 79 5f 6f 6e 22 3a 22 62 6f 74 68 22 2c 22 72 75 6e 5f 63 6f 6e 64 69 74 69 6f 6e 22 3a 22 74 72 75 65 22 2c 22 6c 6f 63 61 74 69 6f 6e 22 3a 22 62 Data Ascii: e,"display_on":"desktop","run_condition":"true","location":"before","load":"screen"},{"id":5726,"name":"card_ad","type":"custom","adcode":"card_ad","sizes":[[300,250],[728,90]],"selector":"#card_ad","display_on":"both","run_condition":"true","location":"b
2024-05-02 13:56:47 UTC	1369	IN	Data Raw: 69 6f 6e 22 3a 22 74 72 75 65 22 2c 22 6c 6f 63 61 74 69 6f 6e 22 3a 22 62 65 66 6f 72 65 22 2c 22 6c 6f 61 64 22 3a 22 73 63 72 65 65 6e 22 7d 2c 7b 22 69 64 22 3a 31 30 32 37 31 2c 22 6e 61 6d 65 22 3a 22 4c 65 61 64 65 72 62 6f 61 72 64 5f 50 6f 73 74 5f 44 6f 77 6e 6c 6f 61 64 22 2c 22 74 79 70 65 22 3a 22 63 75 73 74 6f 6d 22 2c 22 61 64 63 6f 64 65 22 3a 22 4c 65 61 64 65 72 62 6f 61 72 64 5f 50 6f 73 74 5f 44 6f 77 6e 6c 6f 61 64 22 2c 22 73 69 7a 65 73 22 3a 5b 5b 33 30 30 2c 32 35 30 5d 2c 5b 33 33 36 2c 32 38 30 5d 5d 2c 22 73 65 6c 65 63 74 6f 72 22 3a 22 23 70 6f 73 74 5f 64 6f 77 6e 6c 6f 61 64 5f 61 64 22 2c 22 69 6e 73 69 64 65 22 3a 74 72 75 65 2c 22 64 69 73 70 6c 61 79 5f 6f 6e 22 3a 22 6d 6f 62 69 6c 65 22 2c 22 72 75 6e 5f 63 6f 6e 64 Data Ascii: ion":"true","location":"before","load":"screen"},{"id":10271,"name":"Leaderboard_Post_Download","type":"custom","adcode":"Leaderboard_Post_Download","sizes":[[300,250],[336,280]],"selector":"#post_download_ad","inside":true,"display_on":"mobile","run_cond
2024-05-02 13:56:47 UTC	1369	IN	Data Raw: 61 72 20 74 3d 65 26 26 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 2e 64 65 66 61 75 6c 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 3b 72 65 74 75 72 6e 20 6e 2e 64 28 74 2c 22 61 22 2c 74 29 2c 74 7d 2c 6e 2e 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 65 2c 74 29 7d 2c 6e 2e 70 3d 22 2f 22 2c 6e 28 6e 2e 73 3d 35 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 28 36 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 2c 5f 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 5f 5f 2c 5f 5f 77 65 62 70 Data Ascii: ar t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="/",n(n.s=5)}([function(e,t,n){e.exports=n(6)},function(module,__webpack_exports__,__webp
2024-05-02 13:56:47 UTC	1369	IN	Data Raw: 29 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 73 61 66 65 45 76 61 6c 28 63 6f 64 65 2c 63 6f 6e 74 65 78 74 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 65 76 61 6c 28 63 6f 64 65 29 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 46 61 69 6c 65 64 20 65 78 65 63 75 74 69 6e 67 3a 20 22 2c 63 6f 64 65 2c 63 6f 6e 74 65 78 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 69 73 44 6f 63 75 6d 65 6e 74 52 65 61 64 79 28 29 7b 72 65 74 75 72 6e 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 7c 7c 22 6c 6f 61 64 65 64 22 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 7c 7c 22 69 6e 74 65 72 61 63 74 69 76 65 22 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 72 65 Data Ascii: ))}}function safeEval(code,context){try{return eval(code)}catch(e){return void console.error("Failed executing: ",code,context)}}function isDocumentReady(){return"complete"===document.readyState\|\|"loaded"===document.readyState\|\|"interactive"===document.re
2024-05-02 13:56:47 UTC	1369	IN	Data Raw: 62 6a 65 63 74 22 3d 3d 3d 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 2e 69 6d 61 26 26 65 28 29 3b 76 61 72 20 74 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 3d 5f 74 79 70 65 6f 66 28 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 29 26 26 22 6f 62 6a 65 63 74 22 3d 3d 3d 5f 74 79 70 65 6f 66 28 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 2e 69 6d 61 29 26 26 28 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 74 29 2c 65 28 29 29 7d 29 2c 31 30 30 29 7d 29 29 29 3b 63 61 73 65 20 31 3a 63 61 73 65 22 65 6e 64 22 3a 72 65 74 75 72 6e 20 65 2e 73 74 6f 70 28 29 7d 7d 29 2c 65 29 7d 29 29 29 29 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 66 75 6e 63 74 69 6f 6e 20 77 61 69 74 69 6e 67 46 6f 72 Data Ascii: bject"===window.google.ima&&e();var t=setInterval((function(){"object"===_typeof(window.google)&&"object"===_typeof(window.google.ima)&&(clearInterval(t),e())}),100)})));case 1:case"end":return e.stop()}}),e)})))).apply(this,arguments)}function waitingFor

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:48 UTC	570	OUT	GET /country?o=5175773613260800 HTTP/1.1 Host: api.btloader.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://it.uptodown.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://it.uptodown.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:48 UTC	332	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Cache-Control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600 Content-Type: application/json Vary: Origin Date: Thu, 02 May 2024 13:56:48 GMT Content-Length: 37 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-02 13:56:48 UTC	37	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 69 73 52 65 73 74 72 69 63 74 65 64 22 3a 66 61 6c 73 65 7d Data Ascii: {"country":"US","isRestricted":false}

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:48 UTC	736	OUT	GET /pv?tid=QTNSoXXwJS&w=6320147589758976&o=5175773613260800&cv=2.1.43&widget=false&r=false&vr=1280x907&pageURL=https%3A%2F%2Fit.uptodown.com%2Fandroid%2Fshopping&sid=WUYkwUzmEy&pm=false&upapi=true HTTP/1.1 Host: api.btloader.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://it.uptodown.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://it.uptodown.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:48 UTC	255	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate Vary: Origin Date: Thu, 02 May 2024 13:56:48 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:49 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-02 13:56:49 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=41976 Date: Thu, 02 May 2024 13:56:49 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:49 UTC	544	OUT	GET /utd-dpy HTTP/1.1 Host: ssm.codes Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://it.uptodown.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://it.uptodown.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:49 UTC	1300	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 13:56:49 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close vary: Accept-Encoding Cache-Control: public access-control-allow-origin: * access-control-allow-methods: GET access-control-allow-headers: Content-Type, Authorization set-cookie: XSRF-TOKEN=eyJpdiI6IkcvSDFkWXk2ZS83TXpvODF5NU14OVE9PSIsInZhbHVlIjoiQk9EVDFWV3dYQVVNcFJUQ1BWODBJMzR1WUhyZGdRTXhzRE1ybzg0TDFQY1Q4U3lPTGdCdUdVNnJvdUtVNkxWUmtSam15RFpjY1pFelBUN3VCMG9KNkRHMGJqcmYrK0ZrbWVEU1I4VmNGZ2JkS28rM0ZMd2FHWXpmNERUYkFOSjIiLCJtYWMiOiI0ODI1MTYwMzFmZjNhOGJiNzAxYWFjNDAwNGJjZDVjMDY1ZDdiMTYzMTllN2QxOGE0ZDg4NTNjMDY4NDM4ZDQxIiwidGFnIjoiIn0%3D; expires=Thu, 02-May-2024 21:56:49 GMT; Max-Age=28800; path=/ set-cookie: ssmcodes_session=eyJpdiI6Im5iK1NsYytuYXhTbllHY1dKRDRybWc9PSIsInZhbHVlIjoiSHlCdnZtVlpHMDlBSXlWc0I3WXJXS3ArSHdYZVNpUWRXc1pMaFM1MjMrRXd1S3dYVkgvQi9KT1E2RUZpVFJCb3h0dmdITnZBbHZ3ZURPemgrZjl0K2taVkwyeFBJa0pwR2dWYWRNQ0p6bDRkTTZzMGZBL3NIMmlpY0p3citsaHkiLCJtYWMiOiIyNWU2Mzc4YzY4ODM0ZjlmYmJlMDJmNTM5MWYxNzBhYWIxMDMxMGRmYjczYTgyMjQxNTYxY2M1MDJhOGQzMzM0IiwidGFnIjoiIn0%3D; expires=Thu, 02-May-2024 21:56:49 GMT; Max-Age=28800; path=/; httponly x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff CF-Cache-Status: DYNAMIC
2024-05-02 13:56:49 UTC	401	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 63 53 76 6b 54 25 32 46 77 48 79 4b 31 54 48 31 59 31 48 4f 34 38 54 75 48 46 6c 47 36 71 66 63 5a 6b 4e 57 30 67 76 4d 32 78 6f 50 68 35 79 67 49 6b 30 78 77 76 5a 70 38 47 4c 6d 77 39 46 77 77 69 77 4a 52 57 59 69 39 69 56 57 48 39 36 4a 36 42 25 32 46 58 44 4d 44 45 4b 54 35 41 33 49 55 44 49 61 51 4d 31 76 58 6e 49 6d 50 47 31 44 6e 6f 25 32 42 6c 42 45 62 45 68 72 52 53 43 51 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cSvkT%2FwHyK1TH1Y1HO48TuHFlG6qfcZkNW0gvM2xoPh5ygIk0xwvZp8GLmw9FwwiwJRWYi9iVWH96J6B%2FXDMDEKT5A3IUDIaQM1vXnImPG1Dno%2BlBEbEhrRSCQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL
2024-05-02 13:56:49 UTC	316	IN	Data Raw: 31 33 35 0d 0a 7b 22 30 22 3a 22 32 30 32 34 2d 30 35 2d 30 32 20 31 35 3a 35 35 3a 30 34 22 2c 22 31 30 35 34 22 3a 37 39 30 37 38 31 2c 22 31 30 35 36 22 3a 31 32 34 38 38 32 2c 22 31 30 35 35 22 3a 32 32 37 30 35 2c 22 36 38 30 22 3a 38 32 2c 22 35 33 39 22 3a 37 31 2c 22 36 37 34 22 3a 36 33 2c 22 37 31 32 22 3a 35 38 2c 22 37 33 34 22 3a 34 32 2c 22 37 34 30 22 3a 34 31 2c 22 33 33 36 22 3a 33 33 2c 22 37 33 31 22 3a 33 33 2c 22 34 33 34 22 3a 33 32 2c 22 36 36 38 22 3a 33 31 2c 22 37 33 37 22 3a 32 37 2c 22 37 32 38 22 3a 32 33 2c 22 37 30 36 22 3a 31 36 2c 22 35 32 36 22 3a 39 2c 22 36 38 33 22 3a 39 2c 22 36 38 39 22 3a 39 2c 22 37 30 33 22 3a 39 2c 22 36 37 37 22 3a 38 2c 22 36 38 36 22 3a 36 2c 22 31 30 35 33 22 3a 36 2c 22 33 38 34 22 3a 35 2c Data Ascii: 135{"0":"2024-05-02 15:55:04","1054":790781,"1056":124882,"1055":22705,"680":82,"539":71,"674":63,"712":58,"734":42,"740":41,"336":33,"731":33,"434":32,"668":31,"737":27,"728":23,"706":16,"526":9,"683":9,"689":9,"703":9,"677":8,"686":6,"1053":6,"384":5,
2024-05-02 13:56:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:49 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-02 13:56:49 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 08K+nYgAAAACXC/Ywsy9UQ60qHfPpvzYzU0pDRURHRTA1MTIAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=61641 Date: Thu, 02 May 2024 13:56:49 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-02 13:56:49 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:49 UTC	386	OUT	GET /.well-known/web-identity HTTP/1.1 Host: google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:49 UTC	467	IN	HTTP/1.1 301 Moved Permanently Location: https://www.google.com/.well-known/web-identity Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Server: sffe Content-Length: 244 X-XSS-Protection: 0 Date: Thu, 02 May 2024 13:35:41 GMT Expires: Thu, 02 May 2024 14:05:41 GMT Cache-Control: public, max-age=1800 Content-Type: text/html; charset=UTF-8 Age: 1268 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-02 13:56:49 UTC	244	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 2e 77 65 6c 6c 2d 6b 6e 6f 77 6e 2f 77 65 62 2d 69 64 65 6e 74 69 74 79 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://www.google.com/.well-known/web-identity">here</A>.</BODY></HTML>

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:52 UTC	390	OUT	GET /.well-known/web-identity HTTP/1.1 Host: www.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:52 UTC	662	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 78 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 02 May 2024 12:17:13 GMT Expires: Fri, 03 May 2024 12:17:13 GMT Cache-Control: public, max-age=86400 Age: 5979 Last-Modified: Fri, 23 Jun 2023 19:00:00 GMT Content-Type: application/json Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-02 13:56:52 UTC	78	IN	Data Raw: 7b 0a 20 20 22 70 72 6f 76 69 64 65 72 5f 75 72 6c 73 22 3a 20 5b 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2e 6a 73 6f 6e 22 0a 20 20 5d 0a 7d 0a Data Ascii: { "provider_urls": [ "https://accounts.google.com/gsi/fedcm.json" ]}

Timestamp	Bytes transferred	Direction	Data
2024-05-02 13:56:52 UTC	623	OUT	GET /dist/utd-nordVPN/faster-than-ever-it-728x90.png HTTP/1.1 Host: scripts.ssm.codes Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://it.uptodown.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 13:56:53 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 13:56:53 GMT Content-Type: image/webp Content-Length: 6632 Connection: close Cache-Control: max-age=3600 Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=18341 Content-Disposition: inline; filename="faster-than-ever-it-728x90.webp" Vary: Accept access-control-allow-origin: * access-control-expose-headers: Content-Type alt-svc: h3=":443"; ma=86400 etag: "44e9e7fea3e53f90f6a1f5df4474ef68" last-modified: Wed, 24 Apr 2024 15:22:09 GMT x-goog-generation: 1713972129234384 x-goog-hash: crc32c=eehvag== x-goog-hash: md5=ROnn/qPlP5D2ofXfRHTvaA== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 18341 x-guploader-uploadid: ABPtcPp7HaSHrcfLy1jenWTIbz5zx38PEPFZPh-8rV_lybglS6SX9YXtxrbBv0MJxuz71UZcM3U CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ickYOwJNDn6dsNl9s6H7uhAtk0cUFhJ75%2BbGgO05fryMob4UVaFGfB2rBX4xmfS%2B2E55dptwpasuPtPXizEcWNTpUUW%2F%2BFg6h35BYqI7zRNF0QIR8A6NLP%2F0yqGEuhiPkHIJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d884678bdb4264-EWR
2024-05-02 13:56:53 UTC	103	IN	Data Raw: 52 49 46 46 e0 19 00 00 57 45 42 50 56 50 38 4c d4 19 00 00 2f d7 42 16 00 55 e1 95 b6 7f 95 24 39 62 66 66 c9 63 66 96 96 99 99 61 98 79 a6 b9 7b 99 77 bb 57 d0 db a2 81 65 1a 5a 66 66 de 61 e6 99 65 26 4f a1 73 7e ff ff 39 79 fe a7 4e e7 94 25 2c a7 4a 17 c0 5a 5e ab 62 a0 b5 3e 7b c2 f1 e4 76 a4 58 5e c9 Data Ascii: RIFFWEBPVP8L/BU$9bffcfay{wWeZffae&Os~9yN%,JZ^b>{vX^
2024-05-02 13:56:53 UTC	1369	IN	Data Raw: 1b aa 58 57 11 29 96 2c 56 29 8e a0 ca 1a 7f 2e a3 e3 1f e3 a5 e8 36 3a 67 19 7e 32 cb 12 95 33 6b 4a 1d 51 22 bb 1c b1 c6 3c a2 2b 60 66 4c 31 33 b3 74 c4 aa 15 8e 27 9b e9 08 32 da 5b be 87 72 52 58 e9 a4 c0 da 2b 10 33 33 8d 25 26 bb c4 0c 16 33 b3 6c ec 48 77 af 60 4d 45 5a eb 8a 59 a7 23 2d 81 db 11 6d 09 5a eb a7 73 14 29 be 8d 8e 58 e8 2b d8 b1 c4 cc 30 5e 5b 52 09 6e 62 6e 41 68 29 a2 fc 1d af cd 32 45 e9 08 8f 58 3e e3 b8 1b 92 04 00 2c 24 29 a3 b6 6d db a3 b5 6d db b6 6d db bb 27 9d 77 ef fb 85 1e db b6 ad 9a 2e a4 d0 25 47 00 00 43 92 aa cd 31 f7 6c db b6 19 ad 8d ec 36 bb f0 b2 0b 2f db 6c 2f bb 2f d8 b6 cd f1 2c bb c6 d3 c6 54 6f ff 69 41 b6 1d b6 6d f6 89 81 21 89 d4 63 47 b0 28 40 84 dc df 9d e5 af f0 0e 63 f7 53 fe 3d ce 78 a7 85 84 97 68 Data Ascii: XW),V).6:g~23kJQ"<+`fL13t'2[rRX+33%&3lHw`MEZY#-mZs)X+0^[RnbnAh)2EX>,$)mmm'w.%GC1l6/l//,ToiAm!cG(@cS=xh
2024-05-02 13:56:53 UTC	1369	IN	Data Raw: 02 3c 96 b1 3b 94 1d d3 fa 3f 47 22 c6 b4 24 bc 1d 79 0f 56 52 a2 ee 4b 4c 30 6c 67 54 6c 3c 97 54 37 cf 03 ee b0 9d b1 95 0c 06 8b 06 e8 0d 57 6f b3 68 a9 84 d5 b5 35 e9 ba cb b9 9b 5c c6 88 b7 d8 11 f9 84 d4 62 22 6a a6 ae 44 1e fe 24 78 39 90 b3 27 8e ae eb 95 9c a7 c8 3d 29 82 7b e2 14 0b 99 51 f8 c4 4c 8b 5d 15 0e e1 b7 d9 90 8b 46 3b 42 bf 2b a1 f4 2f a7 18 6b 52 4e 1a f8 8e 37 39 44 8e 94 83 7d ac 77 23 4f f8 59 e5 97 73 c4 58 44 74 8a c5 aa 6c 6e 10 61 f4 df 1b a6 43 c4 f3 9b 11 7c 41 32 9f 01 7a 43 20 01 6b 23 55 0b a0 76 a7 cb 10 08 f3 88 71 2e 91 79 11 d4 b2 71 b6 85 20 0a c0 9e e8 88 98 84 af 57 7e 87 b2 27 45 30 73 47 7a 4f 54 37 84 ff e7 e4 88 fd 95 94 96 b2 ba cc 14 01 e6 1f 75 c1 d3 1c e9 38 b6 77 83 b2 78 b0 c2 c9 55 50 af e3 29 c1 e9 d2 Data Ascii: <;?G"$yVRKL0lgTl<T7Woh5\b"jD$x9'=){QL]F;B+/kRN79D}w#OYsXDtlnaC\|A2zC k#Uvq.yq W~'E0sGzOT7u8wxUP)
2024-05-02 13:56:53 UTC	1369	IN	Data Raw: 4b ac 39 63 30 b2 3b 8c cd 51 41 75 ab 76 e6 d1 4d ad 8a 03 4f c5 88 6a 21 79 88 f3 92 f7 41 5a a0 24 4f ea e0 28 8f 91 14 d2 fb 10 8b c5 aa 34 47 00 5a 83 63 29 46 27 fb b6 dd 02 28 89 88 5f 45 b6 48 4c 81 46 5c 44 79 95 e2 4a 28 a6 25 ea 99 7b 50 c1 04 dc b4 a5 e9 32 ed 8b 4b af 85 59 f2 2a 18 ea 6c b9 7d c6 d4 b0 58 c2 2f f5 c6 d5 a7 3e 4f 3c 9e a7 34 9b 99 bf 4e d8 24 1d c3 7a 9d 54 eb 4a 49 5f fd 66 88 68 15 25 fd 05 18 56 06 31 2c 64 25 93 41 24 38 20 91 ae fe 20 92 e3 9e d4 3c 62 8a 70 c0 1b 80 64 11 b1 27 6a 9e 47 ed 2f 5b 54 b7 36 87 5b 9a 89 17 89 cb 55 88 fd 8d eb 2c 6f 61 66 9b 73 1f d1 6d 3b e7 25 0b 0d ce 3b a6 a6 45 a7 03 a9 0c b1 cd 11 aa ba 46 2e 3f 4b 19 28 ba 1d ce 3f 4a 05 82 88 18 93 4a e3 63 a5 b9 48 c4 c7 5a 4a e1 ed 28 7d 2e c4 b3 Data Ascii: K9c0;QAuvMOj!yAZ$O(4GZc)F'(_EHLF\DyJ(%{P2KY*l}X/>O<4N$zTJI_fh%V1,d%A$8 <bpd'jG/[T6[U,oafsm;%;EF.?K(?JJcHZJ(}.
2024-05-02 13:56:53 UTC	1369	IN	Data Raw: eb 40 69 69 99 b2 7d a6 21 b3 be 50 a8 0b d2 55 b5 09 d0 92 f7 19 92 e9 1b b3 ca f7 7f 68 83 94 85 f8 b1 64 a6 12 2f 1f 41 8d bc f3 11 28 56 01 49 8a d7 57 be 7a 5d 14 2d f7 3a 8c 86 3a e7 94 a5 aa 2c 63 26 e2 b9 26 55 c6 ce 98 89 5a 09 15 b5 62 6b a8 b0 33 e6 35 8b ff 64 cc 63 da f9 84 1e b9 a6 19 0f 41 85 b9 a6 49 55 68 d6 da 99 74 ae 69 12 aa ca e2 85 26 bc da 04 12 f5 72 2b 6d 53 9c bb 95 5c 0e 1e 4b 26 53 9a 78 e7 cb 9d 8e 74 e1 0c 3e 39 e2 39 38 6d a3 ec c6 82 86 7e 52 a7 35 ad 3e 0f ca fa 2e f9 fb b4 cb ec 78 c2 34 f7 59 56 65 56 d9 3d c4 47 29 2c 0b 95 15 9a 12 ea 43 a1 b2 84 19 b7 cb 42 82 b2 78 ae 5d 65 0a f2 ed b2 4c 22 1e cf 2d 4b 40 35 76 8f 10 54 68 f7 30 af d9 8e 3f 8a 9d 09 c0 5c 60 d5 4e 48 30 6b 65 3a 50 db 15 e7 14 5a fc 67 35 1c 81 62 Data Ascii: @ii}!PUhd/A(VIWz]-::,c&&UZbk35dcAIUhti&r+mS\K&Sxt>998m~R5>.x4YVeV=G),CBx]eL"-K@5vTh0?\`NH0ke:PZg5b
2024-05-02 13:56:53 UTC	1053	IN	Data Raw: a4 dd 27 41 17 d7 05 f9 ea 1e f3 91 5d 92 90 86 15 0f 0f 7d b9 42 49 7e a1 ec 3b be 03 f4 4a 0a 25 bf 66 9c c1 a3 7a 74 99 53 db b6 f0 ac 06 5b 7e 44 17 70 82 a0 a7 cf 45 2b 88 4e a5 85 58 24 48 85 d1 05 75 a8 ff be 30 de a7 83 56 2f 0c 02 4e ac 9a 2b a9 1c 34 5d 17 11 63 84 b7 a6 45 91 3c c5 4a a1 6c eb ad 3b bf 4f 10 d0 ae e2 33 89 52 b1 34 e7 bb 61 99 5b 8e 00 83 78 ab ca 25 7f 14 8f 92 fa fe 47 d7 b0 33 85 e7 31 0c c6 f4 43 a2 95 12 59 58 d0 0b f1 63 5d 44 7c 6b d7 c2 02 f0 6c 05 d5 18 de 27 17 04 fd 41 c4 98 20 15 c6 47 16 30 19 a0 b7 c8 3a 68 25 ff 48 7d c9 22 a5 10 d1 92 51 29 f2 08 d9 53 e3 fa c4 bb 64 45 2f cb a2 54 4c b7 43 c9 1c 0b 52 fa cf 2e ea 36 8b a7 a7 c3 6b d5 95 8f fe fd 06 7b 29 0b 8b 04 31 b4 7c dc c5 b0 c0 e5 31 b4 38 77 45 2e 5a a0 Data Ascii: 'A]}BI~;J%fztS[~DpE+NX$Hu0V/N+4]cE<Jl;O3R4a[x%G31CYXc]D\|kl'A G0:h%H}"Q)SdE/TLCR.6k{)1\|18wE.Z